Background

This article provides a walkthrough on enabling the SIEM and Log Forwarding integration between Huntress and CyberQP by creating a Generic HEC log source in Huntress and connecting it in the CyberQP admin dashboard.

Pre-requisites

• Administrative access to the Huntress management console with permission to manage SIEM log sources
• Administrative access to the CyberQP admin dashboard

Table of Contents

• Create the Log Source in Huntress
• Configure the Integration in CyberQP

Create the Log Source in Huntress

1. Sign in to the Huntress management console.
2. In the left navigation bar, click SIEM, then click Source Management. 
3. In the Log Sources window, click Add Source. 
4. Click Generic HEC. 
5. Click the add (plus) icon.
6. Select the organization.
7. Enter a name for the source.
8. Add a description (optional.
9. Click Save. 
10. Copy the Event Collector URL and the Event Collector Token. 

11. 

Configure the Integration in CyberQP

1. Sign in to the CyberQP admin dashboard.
2. In the left navigation, click Integrations. 
3. Open the SIEM and Log Forwarding Huntress integration. 
4. Paste the Event Collector URL into the collector URL field.
5. Paste the Event Collector Token into the HEC Token field. 
6. Click Submit.
7. Confirm the SIEM and Log Forwarding integration displays a green status indicator inside the Huntress integration. 

end of article