Managed SIEM Best Practices Guide

Adoption Path: First 30 Days

Day 1: Review Documentation and Plan

• Reviewing this article and documentation on individual sources you intend to ingest data from will ensure there are no surprises during on-boarding and in the future (quick start: syslog, OS logs, API, and HEC). 
• For each syslog source you'll want to plan out which machine will host the Huntress Agent required for SIEM to ingest data, ideally using a machine on the same LAN that's always powered on. 
• Confirm SIEM is enabled for your account and for each org that you want to use Huntress SIEM on.

Day 2-3: Plan and Deploy

• Complete your environment map (agent-based sources vs. collector-based sources)
• Deploy Huntress Agent(s) if you're collecting OS Logs or syslogs, then run through the linked setup guide.
• Confirm the collector shows as Connected in SIEM > Collectors. 
• Configure the integration for any HEC or API based sources you wish to ingest.
• It may take up to 24 hours for a new source to show data in your Huntress portal, depending on how verbose the log source is.

Day 4-7: Validate Data Ingestion

• Validate that all expected log sources appear in SIEM > Log Sources with a Connected status
• Validate that all syslog sources are being correctly identified in SIEM > Source Management. Tip: click the Filters button on the far right towards the top, then select "syslog" to show all syslog sources that the Huntress parser was unable to identify. If you see any unidentified syslog sources, follow this guide on Troubleshooting Syslog Sources. 
• Consider setting up a Non-Reporting SIEM Source escalation to get notified when a source stops sending data to Huntress.

Week 2: Run the 10 Core Searches

Have the team practice the most common searches and save the ones they use most.

Week 3: Create Saved or Scheduled Queries

Turn the highest-value searches into Saved Queries or Scheduled Queries for your team.

Week 4: Review and Tune

Review what was useful, reduce noise, and add additional sources.

Investigation Workflow

If you find something suspicious, here's a suggested flow to follow:

1. Start with the alert or search result.
2. Identify the user, device, IP, source, and timestamp.
3. Search around the event window.
4. Check related identity activity.
5. Check endpoint or network activity.
6. Look for privilege changes, MFA changes, or persistence.
7. Document what happened.
8. Escalate or remediate as needed.

"What Good Looks Like"

• Your most important identity, endpoint, cloud, and email sources are connected.
• Your team has 5–10 saved searches they use regularly.
• Your team has a small number of high-confidence Custom Queries (Saved or Scheduled).
• Noisy alerts are reviewed and tuned.
• Admin activity is reviewed weekly or a Scheduled Query is made to monitor.
• MFA and privileged role changes are monitored.
• Cloud storage access is visible.
• Your team knows how to search without needing to start from scratch.

Common Mistakes to Avoid

• Treating SIEM like a one-time setup instead of an ongoing workflow.
• Connecting only one or two log sources and expecting full visibility.
• Turning every search into an alert.
• Creating noisy Saved or Scheduled Queries that nobody reviews.
• Ignoring identity logs.
• Forgetting to review admin and MFA changes.
• Not saving useful queries for future investigations.
• Not reviewing documentation before on-boarding a new source (quick start: syslog, OS logs, API, and HEC). 
• Not checking whether log sources are still ingesting (Understanding Log Source Status).
• Not waiting 24 hours between setting up a new source and checking for new data.

Top Searches Every Team Should Know

1. Failed Login Activity

• Use this to identify repeated failed login attempts that may indicate password spraying, brute force attempts, or mis-configured services. 
• Suggested Starter Query pages: Azure AD / Entra, Google Workspace, Windows Event Logs.
• Look for: Repeated failures from the same user, IP, country, or application.

2. Successful Login After Multiple Failures

• Use this to find cases where an attacker may have successfully guessed or obtained valid credentials.
• Suggested Starter Query pages: Azure AD / Entra, Google Workspace, Windows Event Logs.
• Look for: A successful login shortly after many failed attempts.

3. Logins From Unusual Locations

• Use this to detect sign-ins from countries, regions, or IP ranges that do not match normal user behavior. 
• Suggested Starter Query pages: Azure AD / Entra, Google Workspace.
• Look for: New geographies, impossible travel, VPN/proxy activity, or unfamiliar ASN/provider.

4. New Admin or Privileged Role Assignment

• Use this to monitor privilege escalation or unauthorized admin changes.
• Suggested Starter Query pages: Azure AD / Entra, Google Workspace, Windows Event Logs.
• Look for: New global admins, domain admins, Okta admins, Google Workspace admins, or role changes.

5. New User Created

• Use this to catch suspicious account creation, especially outside business hours.
• Suggested Starter Query pages: varies by source
• Look for: New users created by unusual admins, service accounts, or during odd hours.

6. MFA Changes or Disabled MFA

• Use this to detect identity weakening activity.
• Suggested Starter Query pages: Azure AD / Entra, Google Workspace.
• Look for: MFA disabled, new MFA method added, phone number changed, or authentication method reset.

7. Mailbox Forwarding or Inbox Rule Changes

• Use this to identify business email compromise behavior.

• Suggested Starter Query pages: Azure AD / Entra, Google Workspace. 

• Look for: Forwarding to external addresses, hidden inbox rules, auto-delete rules, or suspicious keyword-based rules.

8. Event Log Cleared or Audit Tampering

• Use this to detect attempts to erase evidence or reduce visibility during an intrusion.
• Suggested Starter Query pages: Windows Event Logs.
• Look for: Windows event logs being cleared, audit policy changes, logging disabled, or security tooling suddenly going quiet.

9. New Service or Scheduled Task

• Use this to audit software that is being installed.
• Suggested Starter Query pages: Windows Event Logs.
• Look for: New Windows services, scheduled tasks, new remote management tools, or suspicious binaries/scripts configured to run automatically.

Saved Queries and Scheduled Queries

Searches help you investigate. Saved Queries help you run queries repeatedly to monitor based on your business needs and infrastructure. Scheduled Queries monitor and alert on set intervals.

Suggested Queries to Explore:

• Everything in Top Searches Every Team Should Know section above
• Identity Provider (Cisco Duo, Okta, etc) suspicious authentication activity
• Cloud Provider public access or permission changes
• RMM activity from unknown users or locations

Scheduled Queries are alerts for your team’s own workflows and do not route to the Huntress SOC.

Recommended Review Cadence

Daily

• Review high-priority alerts from Huntress in your email and/or PSA systems
  • Huntress SOC will send Incident Reports if suspicious activity is seen.
  • Huntress Portal will send you an Escalation if you've setup Non-Reporting SIEM Source or Windows Audit Policy.
  • Scheduled Queries will send you an email if there are results (or if you chose to get notifications on empty results).

Weekly

• Review new admin accounts and role changes
• Review MFA changes
• Check new log sources and ingestion health
• Review saved queries and update stale ones

Monthly

• Confirm critical log sources are still connected
• Review noisy Saved or Scheduled Queries
• Add new sources as your environment changes

• Export or summarize key findings for leadership or compliance