Huntress Managed SIEM Reviews

I use Huntress Managed SIEM for centralizing the security logs from the endpoints, firewalls, Microsoft 365 applications, and other supported sources. This helps the security team identify suspicious activities, investigate security incidents, and detect potential threats.

I review security events and investigations in Huntress Managed SIEM. I look for suspicious authentication activity, unusual account behavior, or potential threats which required any attention. I also check the suspicious login detections every day, monitor Microsoft 365 logs, firewall logs, and if any brute force detection or something had happened. My main use case is centralized security monitoring across the company's infrastructure. My typical daily workflow involves reviewing suspicious authentication activity, investigating firewall events, and checking security incidents. As a managed SOC team, I provide additional investigation and threat detection, which reduces the amount of manual monitoring required from the team. Huntress Managed SIEM helps reduce a lot of work for us.

An employee normally logged in from Mumbai, but suddenly there were multiple failed login attempts followed by a successful login from another country. Huntress Managed SIEM helped me identify the suspicious activity by analyzing the authentication log and correlating the security events.

The main features of Huntress Managed SIEM are the 24x7 managed SOC and the centralized log collection. It collects the security logs from supported sources and centralizes them. The features I find most useful are the managed threat detection and the 24x7 SOC. Having security analysts investigate suspicious activities is particularly valuable because it reduces my time. When I work as an internal team, it reduces my time spent reviewing the logs. The incident escalation process also helps me prioritize events that require immediate attention.

The 24/7 managed SOC feature is one of the most valuable features because security threats can occur at any time, including outside of business hours. Huntress security analysts continuously monitor for threats, investigate suspicious activity, and escalate incidents that require attention. For example, if a suspicious activity occurs at 2:00 AM, the managed SOC can investigate it without waiting for my internal team to start its shift. This reduces my monitoring workload, provides around-the-clock security coverage, and helps me respond to potential threats more quickly.

The biggest positive impact of Huntress Managed SIEM has been reducing the workload on my internal security team. With the 24x7 managed SOC, I don't have to rely entirely on manual monitoring, especially during weekends or outside business hours. It has also helped me focus on incidents that actually require attention instead of spending hours reviewing every security event. Having a dedicated security analyst investigate suspicious activities provides additional support during incident response. The main benefits are improved security visibility, reduced alert fatigue, faster incident investigation, and better utilization of my team's time.

Huntress Managed SIEM could be improved if there were more flexible dashboards or reporting options for different clients and security requirements, if it had more powerful filtering and correlation capabilities, just like Wazuh, and also broader native integrations with firewalls, cloud platforms, and third-party security tools. Alert customization is important. One area where I would like to see improvements is the reporting. More detailed, customizable reports which show security trends, incident timelines, and response metrics would be beneficial.

The reason I chose nine out of ten is that the improvements I was discussing, which include dashboard customization and advanced filtering options, would make it easier for me to conduct investigations. The advanced log filtering and reporting flexibility also need some tuning. More control over these features would make daily investigations much easier.

I have been using Huntress Managed SIEM for 1.7 years.

Huntress Managed SIEM is stable and has been stable in daily operations. The log collection and security monitoring generally work without requiring constant manual interventions. The managed SOC also reduces the dependency. Huntress has experienced occasional service disruptions, including signal processing delays and potential portal issues, but it is sufficient for the company.

Huntress Managed SIEM is very easy to scale. It is designed to scale as an organization grows. I can add more endpoints, users, and supported log sources without having to build and maintain any additional SIEM infrastructure. Its cloud-based architecture and 24x7 managed SOC are particularly useful when expanding security monitoring across multiple locations and clients. One consideration is that subscription costs may increase as additional data sources are added. It was seamless, and I have personally experienced expanding my Huntress deployment in my company, so it was very easy.

The customer support for Huntress Managed SIEM is very particularly useful. One area I would evaluate is the response time for routine technical queries. The support team can help investigate suspicious activity, explain exact findings, and provide remediation guidance. Overall, the customer support is really good.

I previously used Wazuh and CrowdStrike for security monitoring. The reason for considering Huntress Managed SIEM was its managed security approach. Instead of relying entirely on an internal team to monitor alerts and investigate events, Huntress provides a 24x7 SOC. This is particularly useful outside business hours and helps reduce the operational workload on my team. It has reduced the number of members in my team. Huntress can also ingest CrowdStrike Falcon alerts, so adopting it does not necessarily require replacing existing security tools.

It took just an hour or so to see any good alerts or detections for Huntress Managed SIEM.

The main return on investment with Huntress Managed SIEM is the reduction in operational cost and the time saved by my internal security team with Huntress providing the 24x7 monitoring. I can reduce the need for additional resources dedicated to continuous monitoring. It also helps me focus on critical incidents instead of spending hours reviewing logs. Faster threat detection and investigation can potentially reduce the financial impact of security incidents. I haven't calculated the exact ROI, but it is a good return on investment.

Huntress Managed SIEM has a straightforward pricing model based on the number of data sources rather than log volume. The 24x7 managed SOC is included in the subscription, which makes budgeting more predictable. However, the overall cost can increase as more data sources are needed. It was a very good experience.

I evaluated integrating the whole CrowdStrike NG-SIEM before, but it wasn't as good. I also tried Kaspersky, but then I checked on Huntress Managed SIEM, so I liked it and decided to use it.

Security without complexity is extremely important because not every company has a large, dedicated security team. A solution like Huntress Managed SIEM helps simplify security operations through centralized monitoring and a 24x7 managed SOC. Instead of spending hours manually reviewing logs and investigating every alert, my internal team can focus on incidents that require attention. This is especially valuable for smaller IT teams because it reduces operational complexity while maintaining continuous security monitoring.

I use Huntress Managed SIEM with minimal manual alert tuning. The managed SOC handles much of the threat investigation, so my internal team doesn't need to spend as much time creating and maintaining detection rules. However, I still review alerts and make configuration adjustments when necessary.

The main improvement has been the reduction in manual monitoring. My team can focus more on critical incidents because Huntress Managed SIEM provides 24x7 monitoring. This is especially useful outside business hours when I don't have dedicated analysts available.

Huntress Managed SIEM provided me centralized visibility into security events across my environment instead of checking multiple platforms individually. I could see what was happening in my environment right away.

I use AWS for Huntress Managed SIEM. I did not purchase Huntress Managed SIEM through the AWS Marketplace.

The 24/7 managed SOC feature is one of the most valuable features because security threats can occur at any time, including outside of business hours. Huntress security analysts continuously monitor for threats, investigate suspicious activity, and escalate incidents that require attention. For example, if a suspicious activity occurs at 2:00 AM, the managed SOC can investigate it without waiting for my internal team to start its shift. This reduces my monitoring workload, provides around-the-clock security coverage, and helps me respond to potential threats more quickly.

I provided a review rating of nine out of ten for Huntress Managed SIEM.

My main use case for Huntress Managed SIEM is working with partners who will then be able to deliver the customer needs to the end user. I work with enabling partners and discuss security information and SIEM solutions as a whole along with different vendors such as Exabeam, Huntress, Splunk, and Sentinel.

I primarily use Huntress Managed SIEM to help our partners deliver it to the customers, providing intelligent data filtering and real-time detection. The solution collects logs, gathers data, and ensures that partners can collect logs, detect threats, and investigate them.

Huntress Managed SIEM is designed to make powerful threat response and compliance support accessible without complexities. It is a very simple solution to use, especially compared to the cost associated with a traditional SIEM. The feature of intelligent data filtering stands out significantly.

One of the best features Huntress Managed SIEM offers is how simple it is to set up. The alerts are filtered so I do not get tons of alerts and unnecessary noise. Low expertise is needed because traditional SIEMs normally require quite high knowledge and expertise. Huntress Managed SIEM includes human analysis, so it is not all aided by AI.

Huntress Managed SIEM combines machine detection with human investigation, which adds context and helps confirm if something is actually a threat rather than just noise. This provides a real-life comparison of who is affected, how it happened, if it is spreading, and how bad it is, along with clear actions that can be taken, such as isolating a machine, enabling MFA, resetting the password, or completely killing the process. Without humans, everything looks urgent, but with them, it provides real-time, real risk escalation which prevents alert fatigue. The ROI of human analysis lies in time saved; I am not doing a deep investigation or log digging for an hour, allowing for fast incident response.

The confidence aspect provided by Huntress Managed SIEM is significant because it prevents costly mistakes and breaches. The massive reduction in downtime gives people confidence knowing they will not lose money due to easily avoidable problems. Additionally, I do not incur high costs for numerous SOC analysts when I can use Huntress Managed SIEM, which replaces costly security overheads. Those are major points of ROI that help ensure confidence, not only regarding financial aspects but also compliance benefits through audit logs, security reporting, and satisfying cyber insurance requirements.

I believe Huntress Managed SIEM could be improved by increasing integrations with non-Microsoft solutions as this would broaden its appeal. A broader out-of-the-box solution for diverse environments including IoT, Mac OS, and Linux servers would be valuable.

I would rate Huntress Managed SIEM an eight because a couple of things could be changed, such as having more integrations with non-Microsoft systems, improved customization on the dashboard, and enhanced reporting in the threat intelligence updates. Being unable to click on new niche variants of threats is another point I would mention, but overall an eight out of ten is a good score because I think it is a very well-priced solution for its capabilities and all the positives I have outlined.

The eight rating is primarily influenced by those integration and customization points I mentioned, which are the main requests from customers.

I have been using Huntress Managed SIEM for about twelve months, and I have eighteen months of selling SIEM experience.

Huntress Managed SIEM is very stable, which I consider a major positive. I can rely on its capacity to deliver true detections without a lot of noise, which forms a big part of why I think it is an excellent solution.

Huntress Managed SIEM performs well regarding scalability, as does any other SIEM solution. The level of expertise needed is quite low, making scalability really good. It is designed for small to medium businesses; however, the challenge arises in enterprise settings. The scalability for SMEs and MSPs is noteworthy for a few hundred endpoints, but it struggles with scalability when dealing with high logs, multi-site, multi-tenant setups, and large volumes of endpoints, which poses a challenge.

Customer support through our channel partners is excellent. They have a great team, and the CSMs are really good. They operate a solid channel model within the UK channel.

I have previously used various different solutions, including Exabeam, and looked into others such as Splunk.

The pricing, setup cost, and licensing for Huntress Managed SIEM are quite good, averaging around £20 to £40, though this is variable. However, it pays for itself by avoiding breaches, reducing downtime, and eliminating the need to pay for highly expert SOC analysts, which can cost over £100,000.

Huntress Managed SIEM has positively impacted my organization by providing several ROIs. First, the cost is typically £20 to £50 per endpoint per month, although this varies. Avoiding one breach can save in excess of £50,000 to £200,000. The reduction in downtime can exceed £10,000 plus, and it also avoids the need to hire SOC staff, which can cost over £100,000. I can expect an estimated five to twenty times return on investment with this solution.

Beyond the money, the real ROI is the confidence during incidents, knowing what has actually happened instead of what could be happening. I can make fast decisions without guessing, aided by human support, and sleep at night knowing that alerts have been actioned and are legitimate.

While I do not have the exact numbers myself, I acknowledge that any breach can range from £10,000 to over £100,000, with average downtime per day costing tens of thousands. Huntress Managed SIEM eradicates these losses and provides a complete return on investment by preventing downtime and breaches, ensuring no money is lost.

Before choosing Huntress Managed SIEM, I evaluated other options such as Splunk, Exabeam, and Sentinel, among others.

My advice for others looking into using Huntress Managed SIEM is to research and compare it with other SIEM solutions. If I am a small to medium enterprise that wants to avoid spending a lot and minimize the risk of breaches while receiving alerts without excessive noise, this is a good solution.

Huntress Managed SIEM is a great solution overall. To summarize, Huntress Managed SIEM is a security solution that offers event management designed to make powerful threat detection, response, and compliance support accessible without the complexities and costs of traditional SIEMs. It delivers real-time detection, operates a twenty-four/seven AI-assisted SOC center, ensures effective threat management, and allows data retention for compliance needs from one up to seven years. It is well-priced and provides significant value.

The importance of Huntress Managed SIEM offering security and compliance solutions without complexity is paramount for my organization as it fulfills the requirement for compliance to enlist logs that continuously check my infrastructure with SIEM and exposure management. Having this in place ensures I can prove I am actively monitoring, protecting, and recording security effectively while showing compliance. Most environments require log collection, monitoring, incident detection, and that is exactly what Huntress Managed SIEM does.

The time to see actionable detections after deploying Huntress Managed SIEM is quite good; it has a quick time to value. Implementing it does not require extensive expertise to run Huntress Managed SIEM within my infrastructure, which is a positive, and I can see the threat detection via logs very quickly, making the time to value really fast.

I assess the visibility provided by Huntress Managed SIEM on the same day of deployment as very easy. Once I start enrolling and using it, the logs are clear to find. The setup is simple, and the alerts are well-filtered, so I do not experience alert noise and fatigue. Being able to use that as a time to value, along with low expertise needed, is a really good point.

I would assess Huntress Managed SIEM's enhanced correlation and detection coverage in identifying potential threats earlier in the attack life cycle as quite high quality. The only negative is that niche or newer threat variants with failed alerts are not picked up as much, which is probably why I would categorize it as a con.

My experience with the behavioral analytics feature in Huntress Managed SIEM reflects that this is a con, as I feel the competitor Exabeam performs this to a greater degree.

I rate Huntress Managed SIEM an eight out of ten overall.

Our main use case is to centralize log monitoring and threat detection. We rely on Huntress Managed SIEM to collect security-related logs, investigate suspicious activity, and support threat hunting. The 24/7 managed SOC also helps with triage and investigation, which reduces the workload on our internal team.

While investigating a suspicious authentication activity, I used Huntress Managed SIEM to search the relevant logs and network logs, correlate the activity across the affected host, and look for signs of brute force or lateral movement behavior. The centralized visibility helped us quickly determine whether the activity was legitimate or suspicious and supported a faster response.

Huntress Managed SIEM helps us in threat hunting and reducing alert noise. The managed SOC continuously monitors the logs, investigates suspicious activity, and escalates meaningful incidents with context. This helps our team focus on genuine threats instead of spending time on low-value alerts.

The best features are the 24/7 managed SOC monitoring, smart filtering, centralized log visibility, threat hunting, and automated threat detection and response. I especially value smart filtering because it reduces unnecessary log noise, while the managed SOC helps with continuous investigation and escalation of genuine threats.

Smart filtering has specifically impacted my day-to-day work by reducing the amount of low-value log noise we need to review. It helps us focus on the security-relevant events, so alert triage and investigation are more efficient. This has also reduced alert fatigue and allowed us to spend more time on actual threats. The 24/7 SOC monitoring investigation provides additional context and helps us ensure that important threats are not missed.

Huntress Managed SIEM provides valuable centralized log search and long-term retention, which makes historical investigation and compliance reporting easier.

It has helped us by reducing alert noise and manual workload on our SOC team. The 24/7 SOC provides additional investigation and validation, so our analysts can focus on high-priority incidents and threat hunting. We have also seen better visibility across our alerts and faster response to genuine threats.

We have seen around a 20 to 30% reduction in manual alert triage effort, mainly because Huntress SOC filters and investigates many alerts before they reach our team. This has helped us respond faster and spend more time on higher-priority investigations. Huntress also reports an average mean time to response (MTTR) of about eight minutes, which aligns with the faster response we have experienced.

I would like to see broader third-party integration and easier troubleshooting for log sources.

I would like to see more customization in dashboards and reporting, especially for SOC-specific metrics and management summaries. This would bring more flexibility in configuring alerts and log source views.

I have been working in my current field for 2.9 years.

Huntress Managed SIEM is stable and reliable for our day-to-day SOC operations.

It has good scalability. It supports additional endpoints and log sources as the environment grows while smart filtering helps control the amount of unnecessary data being ingested. The pooled data allocation also provides flexibility when individual sources have higher data than the usual log volume.

Customer support is good.

We did not use previous solutions.

I was not offered anything.

I was not offered anything.

We have seen around a 20 to 30% reduction in manual alert triage effort, mainly because Huntress SOC filters and investigates many alerts before they reach our team. This has helped us respond faster and spend more time on higher-priority investigations. Huntress also reports an average mean time to response (MTTR) of about eight minutes, which aligns with the faster response we have experienced.

I was not offered anything.

We did not evaluate alternate solutions.

I recommend starting with the most important log sources and fewer clear use cases rather than trying to onboard everything at once. Take advantage of smart filtering and 24/7 SOC so your team does not have to spend significant time on tuning alerts. I would also recommend integrating it with your existing endpoint, firewall, identity, and cloud tools to get better visibility and correlation.

The no alert tuning approach has had a positive impact on our operational efficiency. We do not have to spend significant time creating and maintaining detection rules and constantly tuning out false positives. Because of this, Huntress handles the filtering and detection to manage SOC, allowing our team to focus on investigation and threat hunting.

We have used broader log source integration to bring in endpoint, firewall, identity, and cloud-related logs into a centralized view. This makes correlation much faster because we can connect activity across different systems instead of investigating each source separately. It has reduced manual log collection and helped us identify attack patterns more quickly.

We have seen 20 to 30% reduction in manual effort, and it has also saved our time and reduced investigation workload. I would rate this product a 9 out of 10.

Huntress Managed SIEM serves as my centralized security monitoring and threat detection tool. We use it to collect and review security events, identify suspicious activity, and help the security team prioritize issues that require investigation without having to manually monitor logs all day.

One specific example of how I've used Huntress Managed SIEM for centralized security monitoring and threat detection involved unusual authentication activity from a user account. Huntress helped surface the related security events, which gave our team a clearer picture of the login activity and allowed us to investigate whether the account had been compromised. We reviewed the activity, validated the user and source, and then took the appropriate steps to secure the account. The main benefit was having the relevant events brought together so the team could investigate the issue without manually going through large amounts of data.

Another incident exemplifies how Huntress Managed SIEM fits into my security operations. Our main use is security operations, particularly centralized security monitoring, threat detection, and incident investigation. We use Huntress Managed SIEM to bring security events together, identify suspicious activities, investigate potential threats, and help the team prioritize incidents that need attention. It also helps reduce the manual effort involved in reviewing logs and gives the security team better visibility across the environment.

The best features Huntress Managed SIEM offers in my experience are the centralized security event monitoring, threat, and managed investigation capabilities. The ability to bring security data together and have suspicious activity highlighted helps reduce the amount of manual log analysis for the security team. I also appreciate the incident visibility and investigation workflow since it makes it easier to understand what happened, prioritize the issue, and take action. The managed approach is probably the biggest advantage because it adds security expertise without requiring the team to constantly monitor everything themselves.

Huntress Managed SIEM has had the biggest positive impact on my organization by reducing the amount of manual effort required from the security team. Instead of spending as much time going through large volumes of security events, the team can focus more on investigating the alerted activities that actually require attention. It also has improved visibility into security activity and made incident investigation more structured. Overall, it has helped us respond to potential issues more efficiently and given the team more confidence in our day-to-day security operations.

We have seen a noticeable reduction in the amount of time spent manually reviewing security events and investigating low-priority alerts as a result of Huntress Managed SIEM implementation. The team is able to identify and prioritize relevant security activities faster, which has improved the overall incident investigation workflow. While we do not track a single metric for every outcome, the biggest improvement has been analytical efficiency and better visibility into security events, allowing the team to spend more time on higher-value security tasks. The team has been able to save roughly one or two hours per analyst each week that would otherwise be spent reviewing and sorting through security events manually. It has also reduced the time needed to get initial context around an alert, since the relevant activity is easier to review in one place. The bigger improvement has been reducing repetitive investigation work and allowing the team to spend more time on higher-priority security issues.

Areas where Huntress Managed SIEM could improve include automated alert triage, events, threat intelligence context, endpoint visibility, detection and response workflows, log correlation, incident timeliness, integration with existing security tools, and reduced alert fatigue.

One area where Huntress Managed SIEM could improve is customization. More flexibility around dashboards, reporting, alert tuning, and detection rules would be useful for teams with more specialized security requirements. I would also appreciate the continued expansion of integrations with third-party security and infrastructure tools. Improving these areas would give security teams more control over how they organize and investigate the data while still keeping the managed experience simple.

Another improvement would be more granular control over alert prioritization and notification settings. It would be helpful to have more flexibility in defining what gets escalated based on our specific environment and risk profile. More detailed reporting and customizable dashboards would also make it easier to communicate trends and incident activity to different stakeholders. Continued expansion of integrations would be beneficial as well, especially for teams managing a broader security stack.

I have been using Huntress Managed SIEM for one to two years.

Huntress Managed SIEM has been stable in our day-to-day operations. We have not experienced significant reliability issues, and the service has been consistent for our security monitoring and investigation workflows. From an operational standpoint, it has been dependable enough that the team can use it as a part of our regular security monitoring without having to worry about frequent service interruptions or maintenance issues.

Huntress Managed SIEM has scaled well with our environment. As we have added more users, systems, and log sources, we were able to expand the monitoring without a major increase in administrative effort. The managed approach is particularly helpful in this regard because the security team does not have to spend a lot of time maintaining the underlying SIEM infrastructure. Huntress Managed SIEM scales well for organizations that want to grow their security monitoring without adding the same level of operational complexity.

The customer support for Huntress Managed SIEM has been good overall. When we have had questions or run into an issue, the support team has been responsive and helpful in getting us pointed in the right direction. They also provide useful guidance during troubleshooting rather than simply directing us to documentation. For a managed security platform, having responsive support is important, and our experience has been positive.

We previously used Microsoft Sentinel before adopting Huntress Managed SIEM. We switched to Huntress Managed SIEM because we were looking for a solution that required less ongoing administration and manual alert tuning. Sentinel provided strong capabilities, but managing detections, reviewing alerts, and maintaining the environment required more time from the security team. Huntress Managed SIEM offered a more managed approach, which helped reduce the operational overhead while still giving us the security visibility and detection capabilities we needed.

We started seeing useful and actionable security detections fairly quickly after deploying Huntress Managed SIEM. Once the relevant data sources were connected and the initial configuration was in place, the platform began providing security events that the team could investigate and prioritize. There was some initial tuning required to make the alerts more relevant to our environment, but overall, the time from deployment to getting useful detections was relatively short.

Visibility on the same day was good, especially once the initial data sources were connected. We were able to start seeing security events and get an initial view of activity in the environment without having to wait for a long deployment period. The visibility became more useful as additional sources were onboarded and the alerting was tuned to the environment. Overall, having actionable security information available on the first day made the deployment process feel fairly straightforward from an operational perspective.

We do not have any business relationship with the vendor other than being a customer.

We have seen a positive return on investment from Huntress Managed SIEM, mainly through time saving and reduced operational overhead. The biggest benefit has been reducing the amount of manual log review, alert triage, and routine investigation work required from the security team. Based on our day-to-day experience, we estimate roughly one to two hours per analyst per week saved on these activities. The value is not just the time saved; it also allows the team to spend more of its capacity on higher-priority security investigations and other proactive security work.

The straightforward pricing structure of Huntress Managed SIEM makes budgeting easier because we have a clearer idea of what the service will cost without having to account for too many unpredictable variables. It also makes financial planning and comparing the cost against security solutions simpler. From an operational standpoint, having more predictable costs helps us plan future security investments and reduces surprises during the budgeting cycle.

Our experience with pricing and licensing for Huntress Managed SIEM has been fairly straightforward. The setup cost was reasonable compared with the operational effort it would take to manage a similar SIEM environment internally. We also found the licensing structure relatively easy to understand, which made it simpler to estimate the overall cost and plan the budget. The main advantage for us was having predictable pricing without a lot of unexpected costs during the setup and environment.

We did evaluate other options before choosing Huntress Managed SIEM, including Microsoft Sentinel, Splunk, and other managed SIEM offerings. We compared them mainly on detection capabilities, ease of deployment, ongoing administration, integrations, and overall cost. Huntress Managed SIEM stood out because it offered a more managed approach with less operational overhead while still providing the visibility and security monitoring capabilities we were looking for.

Overall, Huntress Managed SIEM has been a positive addition to our security operations workflow. The combination of managed monitoring, useful detection capabilities, and reduced administrative effort makes it easier for the team to stay focused on security priorities. There are still areas where more customization and integrations would be helpful, but the product has provided a good balance between security visibility and operational simplicity. For teams that do not want the entire overhead of managing a traditional SIEM entirely on their own, I think it is worth considering.

I would recommend Huntress Managed SIEM to organizations that want strong security monitoring without taking on the administrative burden of managing a traditional SIEM on their own. Before securing it, I would make sure to review your current log sources, integrations, compliance requirements, and expected growth. It is also worth looking at how the managed approach fits with your existing security team and processes. Overall, if reducing operational overhead while maintaining good visibility and detection capabilities is a priority, Huntress Managed SIEM is worth considering. I would rate this solution an eight out of ten.

Huntress Managed SIEM serves as our central log collection and search platform. For a typical example, we ingest FortiGate traffic and correlate it with Windows login events and Linux SSH logs. If a suspicious external IP hits SSH repeatedly, we can see that alongside firewall logs in one place.

Storage and retention are getting tight because Huntress Managed SIEM ingests a lot from FortiGate, reaching 40 to 50 gigabytes per day, and we are watching capacity closely.

We align Huntress Managed SIEM's compliance reports with our organization's existing security frameworks by mapping the SIEM logs, alerts, and monitoring to our security requirements and policies, using Windows auth logs, Linux system logs, and FortiGate firewall logs to support audits and compliance checks. We review reports to spot gaps and provide evidence, ideally aligning with frameworks including ISO 27001 and NIST. Centralized logging helps significantly, but better automated compliance reporting and customizable report templates would make that process even more efficient.

Huntress Managed SIEM has positively impacted our organization by providing central visibility, faster investigation, and eliminating the need to jump between tools, which has made incident checks smoother, even though capacity management remains necessary.

While we have not calculated the exact time saved since using Huntress Managed SIEM, investigations are definitely faster because logs from FortiGate, Windows, and Linux are available centrally, saving manual effort and accelerating the process of spotting suspicious patterns.

Huntress Managed SIEM has improved our organization's capability to manage hybrid infrastructures by giving centralized visibility across different environments. We can collect and correlate logs from FortiGate firewalls, Windows servers, and Linux systems in one place, making it easier to monitor activity, investigate incidents, and spot suspicious behavior without switching between multiple tools. This definitely helps our operational efficiency and visibility, though managing storage and retention across environments remains a challenge.

We saw actionable detections after deploying Huntress Managed SIEM within that same early phase, where correlations including failed logins and suspicious connections became easier to spot, giving us a solid start in active detection.

The best features Huntress Managed SIEM offers are having central visibility, which makes it easier to investigate issues across the firewall, Windows, and Linux together.

Having that central visibility helps with investigations and day-to-day operations by saving time during a suspicious login incident. Instead of jumping between the FortiGate GUI and the Windows server, I can pivot in Huntress Managed SIEM and pull the firewall event and the correlated Windows failed logins in one timeline view. That is much faster than checking their separate consoles.

The alerting and the dashboard in Huntress Managed SIEM help spot patterns early, including repeated failed logins from the same source or unusual after-hours access, which helps us catch issues before they spread.

On day one of using Huntress Managed SIEM, we got central visibility into our infrastructure, being able to collect and monitor FortiGate, Windows, and Linux logs from a single platform, though the visibility depended on correct log source configuration and integration. Overall, the initial visibility was good and gave us a useful starting point for security monitoring and incident investigation.

It is very important to us that Huntress Managed SIEM offers security and compliance solutions without complexity, as we need strong security monitoring and compliance without adding too much operational complexity. Managing multiple log sources including FortiGate, Windows, and Linux, having centralized visibility, a simple dashboard, and predefined alerts lets us focus on threats and incidents instead of managing Huntress Managed SIEM itself, which saves time and reduces manual effort. Simplicity combined with reliable security features is key.

We are still exploring Huntress Managed SIEM's no-alert-tuning feature, which could save time for the operations team and let analysts focus on real security events, but we also value the flexibility to customize alerts based on our environment, especially with the different log sources we handle, including FortiGate, Windows, and Linux.

Huntress Managed SIEM's enhanced correlation and detection coverage helps us identify potential threats earlier. For instance, linking firewall events with Windows logins and Linux SSH activity, where repeated failed logins followed by unusual access stand out more clearly. That cross-log visibility reduces investigation time and moves us closer to proactive threat detection rather than just reacting to an incident.

We have used Huntress Managed SIEM's broader log source integrations feature to facilitate faster ingestion and correlation across our infrastructure, integrating FortiGate logs, Windows event logs, and Linux system logs, which organizes ingestion. For example, we can correlate a suspicious firewall connection with failed Windows logins or unusual Linux SSH activity, speeding up investigations, reducing manual effort, and giving us better visibility across the infrastructure.

Huntress Managed SIEM could be improved with better storage scaling options and flexible retention settings, so high ingest will not push us into capacity worries.

Handling the OpenSearch memory pressure and making scaling easier would definitely improve the experience with Huntress Managed SIEM, especially when data volumes spike.

The major improvement needed for Huntress Managed SIEM is storage scaling, especially with our heavy ingest from FortiGate, plus some help managing OpenSearch memory spikes. If retention and capacity were easier to manage, the overall experience would improve significantly.

I have been using Huntress Managed SIEM for a few months and have been testing it in our VMware setup through K3s and Podman to collect FortiGate, Windows, and Linux logs.

Overall, Huntress Managed SIEM is stable for our current workload and supports central monitoring. Regarding scalability, it can handle growing log sources and monitoring needs, but with high ingest, such as from FortiGate, storage capacity, retention, and memory management become important constraints. We would like easier scaling and more flexible storage options to handle future growth smoothly.

Our experience with customer support for Huntress Managed SIEM has been generally positive and helpful when we needed configuration help or troubleshooting. Fast response times matter to us, especially with the production environment, and we would appreciate continued improvement in response times and proactive guidance.

We previously used a different solution, relying more on separate tools and consoles to review firewall, Windows, and Linux logs. We wanted a more centralized solution to simplify log monitoring, correlation, and security investigations, which is why we moved toward Huntress Managed SIEM. It gives us better visibility in one place and helps reduce the manual effort involved in investigating security events.

Huntress Managed SIEM is deployed on-premises for us on a VMware VM with K3s containers, with the manager backend, log storage, and database as pods, so we keep control of our infrastructure, logs, and security settings.

We have seen a return on investment primarily in operational benefits, particularly in investigation time. Earlier, we had to check firewall, Windows, and Linux logs separately, but now we do that centrally, saving manual effort and speeding up spotting suspicious activity. We have not formally measured hours saved or cost reductions, so the ROI is mainly improved visibility and faster investigations with the same team.

Huntress Managed SIEM's flat and straightforward pricing has a beneficial effect on our organization's budgeting and financial planning, as it helps us plan security costs with fewer surprises, making budgeting and financial planning easier. It is also simpler to justify an investment to management, but as our log volume and infrastructure grow, we will still need to review pricing to make sure it stays cost-effective.

Our experience with pricing, setup cost, and licensing for Huntress Managed SIEM has been straightforward. The flat pricing makes budgeting easier to plan, and the initial setup involved integrating our log sources, configuring monitoring, and setting up alerts without major licensing complications. That said, as our log volume and infrastructure grow, it is important to keep checking the overall cost and licensing requirements to make sure it remains affordable.

Before choosing Huntress Managed SIEM, we evaluated other options, including separate log monitoring tools and open-source SIEM options such as Wazuh and the ELK stack, with our main goal being centralized collection and correlation without too much manual work. Huntress stood out as an option that could simplify monitoring and investigation.

I would rate Huntress Managed SIEM an 8 out of 10, mainly for the visibility and correlation benefits, with storage pressure keeping it from being higher. I gave it an 8 out of 10 because the visibility and correlation are strong and help speed up investigations, but the storage and retention pressure from heavy log ingestion holds us back. If retention were easier to scale, that score would probably be higher.

Regarding Huntress Managed SIEM's AI capabilities, I think its governance and security features are crucial. The AI features can be useful, especially for spotting suspicious patterns, but I want clear data privacy controls, transparency about how the AI processes and uses log data, role-based access, and audit logs. Explainable alerts help analysts understand why something was flagged, which builds trust in the AI features.

The accuracy and reliability of Huntress Managed SIEM's output seem useful for spotting suspicious activity, but as with any SIEM, false positives can happen, especially with unusual but legitimate logins. We have not formally measured the false positive rate or confirmed missed alerts, and improving alert accuracy, reducing unnecessary notifications, and providing better context in alerts would help analysts quickly distinguish real threats from normal activity.

My advice to others looking into using Huntress Managed SIEM is to understand your security requirements and expected log volume first, and start by integrating key sources including firewall and Windows switches and configuring alerts according to your needs.

I use Huntress Managed SIEM to correlate events from different sources, identify suspicious activity, triage alerts, and support incident response.

One example is investigating a suspected compromised user account. I used Huntress Managed SIEM to review authentication and endpoint logs, correlate multiple failed and successful login events, check the source IP and activity timeline, and determine whether the behavior was suspicious. This helped us quickly validate the alert and escalate it for further investigation when needed.

Another use case is centralized alert monitoring and incident investigation. I also use Huntress Managed SIEM to correlate events across different sources, review activity timeline, and identify patterns that may not be obvious from a single log. It helps make day-to-day alert triage more organized and efficient.

The best features for me are centralized log visibility, smart filtering, and the twenty-four seven managed SOC support.

Another feature I appreciate is the centralized visibility and investigation capability. Having relevant logs in one place, combined with threat hunting and managed detection, makes it easier to investigate incidents and understand the activity timeline without spending too much time on manual log filtering.

Huntress Managed SIEM has helped us improve alert visibility and investigation efficiency. Centralized logs and managed detection have reduced the amount of manual log analysis, helped us prioritize important alerts faster, and made incident investigation more structured. Overall, it has allowed the team to spend more time on genuine security issues instead of routine monitoring.

It has reduced the time we spend on initial alert triage and investigation. The managed SOC and filtering help us focus on the more relevant alerts, and we have seen fewer false positives reaching our analysts. Overall, investigations are quicker, and the team can spend more time on higher-priority incidents.

The main improvement area is deeper customization. It would be helpful to have more flexibility for creating custom detection rules, dashboards, and alert workflows based on specific organizational requirements. I would also like to see more integrations and advanced investigation capabilities over time.

Another area would be improving the reporting and customization options. More detailed reports, better visibility into investigation timelines, and easier customization of alerts would make Huntress Managed SIEM even more useful for day-to-day SOC operations.

I would like to see more advanced dashboard customization, additional third-party integrations, and more granular control over alert rules and workflows. Better reporting and automation options would also make it more useful for SOC environments.

I have been using Huntress Managed SIEM for two point three years.

In my experience, Huntress Managed SIEM scales well as the environment grows. Adding more endpoints and log sources has been straightforward, and the managed architecture reduces the infrastructure and maintenance efforts on our side. The centralized log collection and smart filtering also help keep data volume and alert noise manageable as workload increases.

The support experience has been very positive. The SOC team is responsive and helpful when we need clarification on an alert or investigation. I especially appreciate that we can get direct analyst support during incidents, rather than relying on documentation or automated responses. Overall, their support has made incident investigation and escalation easier for our team.

The customer support has been very good overall. The team is responsive, knowledgeable, and helpful when we need assistance with alerts, configuration, or investigations. Having access to the managed SOC also gives us confidence that we have expert support available when needed.

We started seeing actionable detections within the first few days of deployment. Once the key log sources were connected and configured, Huntress Managed SIEM began providing useful alerts with relevant context, so there was very little delay before the platform became useful for day-to-day SOC monitoring.

On the same day of deployment, the visibility was good for the main connected log sources. We could see relevant logs and alerts fairly quickly, although complete visibility depended on configuring and onboarding all required data sources. Overall, it gave us a useful starting point for monitoring from day one.

I have seen a positive return on investment, mainly through time savings and reduced manual effort. Alert triage and initial investigations are faster, and the managed SOC support reduces the time analysts spend on routine monitoring. I do not have a precise figure for direct cost savings or headcount reduction, but the operational efficiency has been noticeable.

I would start with the most important log sources, define the key use cases, and then expand gradually. Also, make sure you understand what data you need for compliance and investigations before onboarding all sources.

Overall, I had a positive experience with Huntress Managed SIEM. The combination of twenty-four seven SOC monitoring, smart filtering, centralized visibility, and reduced tuning effort makes it easier for the team to focus on meaningful security incidents rather than managing the SIEM itself. I rate Huntress Managed SIEM nine out of ten.

My main use case for Huntress Managed SIEM is to have one central place for our alerts from various systems to come in.

I can give you a specific example of how I use Huntress Managed SIEM for centralizing alerts: we have our Unifi system connected to it, so when networks go down, we get alerting around it and also keep a log of things that happen. We also have our EDR with the managed AV alerts going into there as well. This gives us a log of when any kind of incidents would occur, allowing us to provide reporting if we need to.

The best features Huntress Managed SIEM offers are that the integrations are pretty easy between various software, and for ones that don't have a native integration, there are API calls that you could use. We appreciate that a lot. We're also using other Huntress services, which are connected in there as well.

Those easy integrations and API calls make ticketing much easier with the integrations, and with everything coming into one place, it's an easier dashboard to read and interpret so we can get the data we need from it.

Huntress Managed SIEM has positively impacted my organization; prior to coming on board with Huntress, we didn't have a place for a SIEM at all. Having that allowed us to offer it out to clients and to have that centralized location where we can easily manage a lot of the alerts that come in.

Since implementing Huntress Managed SIEM, I would say it saved time just because of where the alerts come from; it's one spot that we can go through and locate things. It creates better tickets than just doing an email alert.

Huntress Managed SIEM can be improved with more integrations; that would always be great. The custom ones that you can create are good, but having more native ones would be even better.

Regarding Huntress Managed SIEM's AI capabilities, I think its governance and security are pretty good. I think Huntress Managed SIEM's AI capabilities are still in its early stages, so it probably will need some improvement over time, but I think that's something that will get better as it's around longer and improved.

My experience with the behavioral analytics feature in Huntress Managed SIEM is that I think it's pretty effective at surfacing suspicious activity.

I've been using Huntress Managed SIEM for over the last six months.

I find Huntress Managed SIEM to be stable.

Huntress Managed SIEM's scalability seems to be pretty good.

The customer support for Huntress Managed SIEM is top-notch.

I didn't previously use a different solution; we looked at a few different ones and ended up landing on Huntress and have been happy with it.

I feel it took a pretty quick time to see actionable detections after deploying Huntress Managed SIEM; I feel it's faster than the email alerts.

The visibility provided by Huntress Managed SIEM on the same day of deployment felt like it took a couple of days in order for it to actually really start to show.

I don't know if there's been a total return on investment, but there has been some time that has been saved, and I'd probably gauge it in the realm of around three hours a month.

My experience with pricing, setup cost, and licensing is that everything was pretty easy to do; I have a rep that I worked with, and they were able to get me set up with the trial first and then go from there, test it out internally, and then we were able to start rolling out for clients.

Before choosing Huntress Managed SIEM, we did evaluate other options; we looked at Splunk as the big one.

It's super important for my organization that Huntress Managed SIEM offers security and compliance solutions without complexity; the more complex that it is to set up, the less likely there will be more adoption. The easier it is, while still being secure and compliant, the better.

We are not using the feature in Huntress Managed SIEM that requires no alert tuning.

My advice for others looking into using Huntress Managed SIEM is to get in with the trial, start playing with it, and make sure you get all your connections and see how it works.

I give Huntress Managed SIEM an overall rating of eight out of ten.

Huntress Managed SIEM monitors logs generated from different sources such as firewalls and servers.

Huntress Managed SIEM has helped my organization by providing faster remediation when investigating incidents.

It improves my organization's capabilities to manage hybrid environments, as my company has a hybrid infrastructure setup, making it useful when my users are out of the office and allowing me to collect their logs.

Huntress Managed SIEM has improved the way my organization functions, as I can view more detailed activity performed by users.

The best features in Huntress Managed SIEM enable me to view more detailed logs generated from the server or firewall, giving me a central management view that makes it easier to track and check information.

The ability to offer security and compliance without complexity is evident in Huntress Managed SIEM, as it helps because the logs presented to me are useful when conducting investigations.

Huntress Managed SIEM's correlation and detection coverage does a good job identifying potential threats early in the attack lifecycle, and I find it very useful.

I have used the broader log source integration feature, configuring several log sources including the firewall, CrowdStrike, and Microsoft Defender.

The search function in the log explorer has room for improvement, as I need to type something to search logs, and this feature could be significantly enhanced.

I have been working with Huntress Managed SIEM for over a year.

I rate the stability of Huntress Managed SIEM as nine.

Approximately 100 users utilize Huntress Managed SIEM.

My clients consist of all different types of businesses, including small, medium, and enterprise organizations.

Huntress Managed SIEM is definitely a scalable solution.

I rate its scalability as nine.

I rate the technical support for Huntress Managed SIEM a solid 10.

I see approximately 50% return on investment with Huntress Managed SIEM.

When comparing Huntress Managed SIEM with other SIEM software, the pricing is much cheaper.

On pricing, it is much cheaper than CrowdStrike.

Huntress Managed SIEM's flat and straightforward pricing allows for better budgeting and financial planning, as it helps significantly because of the pricing method, making it easier compared to other products that might pose challenges for budget planning.

I have looked into CrowdStrike as another vendor.

Huntress Managed SIEM is very easy to maintain.

I do not spend much time on the maintenance.

I recommend this product to other users because it is much more affordable compared to other products such as Microsoft Sentinel or CrowdStrike.

Overall, I rate this solution as nine.

With the latest threats and zero-day attacks, I can utilize Huntress Managed SIEM to detect them. Huntress Managed SIEM was able to detect zero-days and alert our team before they could be exploited.

These customized dashboards help in managing our applications, monitoring our applications, and also help in keeping track of our crown jewels.

There are automated reports which can be configured on the platform and shared with stakeholders based on what devices they are managing.

Huntress Managed SIEM has helped in both angles, improving efficiency in SOC operations where the mean time to detect is drastically reduced.

Regarding Huntress Managed SIEM's AI capabilities, I find it fairly accurate at the moment. There are certain false positives, but I believe it would improve over time.

The effect of Huntress Managed SIEM's flat and straightforward pricing is quite useful because I can keep track of budget and also plan for future involvements.

It is quite important for my organization that Huntress Managed SIEM offers security and compliance solutions without complexity; it helps in saving time for both our SOC team and also our audit and compliance team.

I am using Huntress Managed SIEM's feature that requires no alert tuning; it helps in certain areas where it automatically fine-tunes the alerts based on thresholds, but it is not always effective and manual intervention is at times required.

I have used the broader log source integrations feature of Huntress Managed SIEM, and it helps in deep diving into each device type, so I can integrate more log sources and log types within a certain log source.

My advice to others looking into using Huntress Managed SIEM is that it is definitely something which you need to try, and I recommend conducting a proof of concept before you buy. My overall rating for this review is seven out of ten.

Huntress Managed SIEM is used for security and event management, specifically for firewalls and remote desktop gateway servers.

Huntress Managed SIEM brings SIEM to the SMB level so small companies can use an enterprise SIEM solution while filtering out a lot of noise, which is a great feature of the product.

Huntress Managed SIEM offers security and compliance solutions without complexity. This is why we use it for firewalls and remote desktop gateways to avoid needing other solutions to save all the logs from the firewall. If there is an incident, we can search all those logs, and we have a great solution within Huntress Managed SIEM, which not only collects logs but also includes the human-led SOC that watches over it and identifies issues.

Huntress Managed SIEM requires no alert tuning. They use a standard set of filtering and are constantly tweaking it, so all the noise is already gone. This impacts data storage but also ensures that when searching, you get only the things you really want to see, which is very helpful.

Huntress Managed SIEM helps identify potential threats early in the attack lifecycle through enhanced correlation and detection coverage. This is why we installed it on remote desktop servers since failed login attempts get logged in the Windows log file, but we are not searching them actively. The SOC notices them from the SIEM events and can identify issues if there are any, which is very helpful.

Behavioral analytics in Huntress Managed SIEM effectively does two things for us. It gives us peace of mind that we are logging all events, and the SOC will find issues, providing them with more telemetry data to identify problems that may involve more than one machine.

After implementing Huntress Managed SIEM, we see the value immediately because we start collecting the logs we need for compliance right away, resulting in immediate value from that perspective.

Huntress Managed SIEM has areas for improvement regarding more log sources. They are working on connecting more sources to the right format for events, such as a Fortinet firewall, but we use other firewalls as well, so that could use some development.

The deployment of Huntress Managed SIEM is somewhat complex compared to ITDR and EDR, as those are just click, click, click, and next, next, finish, while SIEM requires some form of configuration. Additionally, a Huntress agent is needed within the same network as the firewall to collect those logs, so it would be a great addition if they could make it possible to log events directly from a Fortinet FortiGate firewall to Huntress Managed SIEM.

Huntress Managed SIEM has been used for about a year to a year and a half. We started using ITDR and EDR from the beginning, and then SIEM was released.

For stability, I rate Huntress Managed SIEM a nine.

For scalability, I rate Huntress Managed SIEM a nine.

I would rate the technical support of Huntress Managed SIEM a nine.

Huntress Managed SIEM collects events and provides visibility within a few days of deployment, not necessarily on the first day, but visibility of the logs is established within a few days.

Regarding pricing, I think Huntress Managed SIEM is not expensive, so I would rate it around an eight or nine.

We are looking into the broader log source integration feature of Huntress Managed SIEM, but we have not used it yet. We currently use it for firewall and remote desktop gateway, but not for other things.

Other MSPs should enable SIEM for all firewalls they manage. I already enable SIEM for all firewalls that we manage and then try to sell it to customers afterwards. From my perspective as an Operations Director, it is essential to ensure everything is logged and that we remain compliant. If there is an issue, we at least have something to search to understand what happened, which is invaluable. Rather than just selling it as a product, it should be genuinely used for operational purposes, especially since the pricing is very affordable. I would rate this review a nine overall.