SIEM: HEC - NinjaOne RMM

TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: HTTP Event Collector (HEC)
ENVIRONMENT: NinjaRMM
SUMMARY: Configuration Guide for NinjaRMM. With this guide you can use Huntress to ingest webhooks directly from Ninja RMM, bypassing the need to use Splunk or another 3rd party HEC.

• Vendor Information
• Configuration Checklist
• Additional Information

Vendor Information

Configuration Checklist

1. In your Huntress Console, navigate to the SIEM -> Source Management page, then the Categories tab.
2. Scroll to the RMM section and select View Details on the NinjaOne RMM source.
   
3. Select the green Add button.
   
4. Select an organization, then enter a name and description for the new NinjaOne source.
   
5. Select Save.
6. Record the HTTP Event Collector URL and Token for use in the following steps.
   

The Collector URL for Huntress for NinjaOne sources is https://hec.huntress.io/services/collector/raw

7. Access the webhook endpoint from within your NinjaOne tenant while logged in as a system administrator. This will not work from the public API documentation linked above, the api must be scoped to your tenant for authorization to work.
8. Navigate to the PUT /v2/webhook within your Ninja One tenant domain.
9. Add your specific token from step 6 above to this starter payload, replacing only <COPIED TOKEN> with your token (don't alter "Splunk" or any other characters in the auth header field, see Important Notes below for an example). 
   (*) Additional information on activity types can be found in the NinjaOne API documentation.
10. Paste the example payload into your tenant NinjaOne API Documentation for Webhooks by clicking "Try it Out".
11. Click “Execute”. The webhook will be successfully created from a 204 response

1. Important Notes:

   • Log into NinjaOne as a System Administrator.
   • Use the "https://hec.huntress.io/services/collector/raw" endpoint URL
   • Step 5 and 6 in the NinjaOne blog post above are vital to turning on the required Notification Channel (i.e. webhook). If you don't get a code 204 during that step a webhook won't be added. Read the "In Conclusion" section in the NinjaOne blog post to verify a webhook was setup. Please do not change the name of the webhook inside "Notification channels".
   • Example header auth field for the starter payload:
     "headers": [
       {
        "name": "Authorization",
        "value": "Splunk 12345678910"
       }
      ]

Additional Information

With a single NinjaOne RMM integration, a single Huntress organization can be mapped to a single NinjaOne organization, or the entire NinjaOne account. Users will need to decide whether to set up individual organization-to-organization integrations, or to use a single account-wide NinjaOne integration to a single Huntress organization.

Each configured NinjaOne RMM source in the Huntress console counts as one Managed SIEM Data Source if it has sent data in the last 30 days. A single account-wide NinjaOne integration configured as one NinjaOne RMM source in Huntress is therefore one Data Source, while separate NinjaOne RMM sources configured per organization (org-to-org) are each a separate Data Source.

For more info on Data Source billing, check out our Managed SIEM Billing and Retention guide.

In early FY26 we'll be enhancing the integration to support account-to-account integrations.