We love to hear your ideas for improving Sentinel.

 
190 Ideas
183 Comments
805 Votes
  • Planned

    12

    Time scheduling for Sentinel connectors

    Connected systems like databases or others have maintenance times during the night or weekend, when they are shut down. Installed connectors (for DB2 for instance) then ...

    Comments (1) | by: Ted E. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    12

    Add ability to WECS to read from newer "Vista-style" Event Logs

    Sentinel lacks an ability that many of your leading competitors offer to grab events from the newer "Windows Vista" style Event Logs on all new Windows operating systems ...

    Comments (4) | by: Ted E. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    10

    Cyber Ark Collector

    I would like to request a collector for Cyber Ark. I have seen this asked by multiple customers.

    Comments (1) | by: James H. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    10

    Postgres collector

    Have the ability to collect, store, and read postgres logs via Sentinel. Working with the military, we have a requirement to store audit and database logs in 1 location. ...

    Comments (4) | by: Shawn G. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    10

    Support for Oracle Service names instead of SID

    A company may standardize on using service names because when using Oracle RAC. The Sentinel Data Synchronization to Oracle feature is only possible by using the SID of ...

    Comments (2) | by: John G. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    8

    Sentinel Windows Agent Should Handle Rotating Application Logs

    Currently, the file connector has the capability to process rotating logs but that requires the ability to set up shares for Sentinel to access those logs remotely or ...

    Comments (2) | by: Eric L. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    8

    Support both IPv4 and IPv6 for IP2Location

    IP2Location offers IPv4 and IPv6 as separate databases (e.g. DB5 & DB5IPV6) so the feed should be capable of processes both CSV's into Map without the need for complex ...

    Comments (1) | by: Ben W. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    8

    User behavior analytics(UBA)

    All leading SIEM products provide UBA; its a must feature for any modern-day SIEM. Unavailability of UBA is one of the major reason, competitors take edge in POC demos ...

    Comments (1) | by: Muhammad S. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    7

    CheckPoint LEA Connector missing critical pieces of information

    I've spotted some flaws on CheckPoint collector. I'm giving one example from blade "URL Filtering" in CheckPoint These fields are : appi_name, matched_category, ...

    Comments (2) | by: Pat S. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    7

    VMWare vCenter logs

    vCenter makes most of it's logging available in the Windows Event log for software-based installations, and via Syslog for appliance (VCSA) installations, at least from ...

    Comments (1) | by: Brandon L. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    7

    Mechanism to customize, per event type, fields of interest that ...

    Sentinel needs a means to get common-interest fields to automatically show-up when “More” is selected on an individual event or “Show more details” is ...

    Comments (0) | by: Ted E. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    6

    Support for eStreamer via Cisco nCore client

    Cisco is in the process of releasing a client for collecting via eStreamer that is supported and maintained by them rather than asking their consumers to write custom ...

    Comments (2) | by: Brandon L. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    6

    Airwatch Collector

    AirWatch is probably one of if not "the" top MDM solutions on the market today. With no Sentinel Collector, that's a significant blindspot of device and user activity in ...

    Comments (0) | by: Ted E. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    6

    F5 parser Event Name in clear text ...

    Hi, This Collector has been added to support High Speed logging. The collector uses log message ID numbers as Event Name. This is not clear text and clear to understand. ...

    Comments (0) | by: Timo S. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    6

    Normalize severity against a standard severity scale rather than ...

    Different vendors attribute different severities to certain types of events based on their own internal way of looking at the data. When Sentinel sets the severity, it ...

    Comments (2) | by: Brandon L. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    6

    Carbon Black Enterprise Response collector

    Carbon Black Enterprise Response is well know in this space. With no Sentinel Collector, that's a significant blindspot of device and user activity in our network.

    Comments (2) | by: Richard M. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Votes

    6

    Customer needs the ability to process EVTX files from netapp

    Sentinel should be capable of ingesting evtx files from netapp

    Comments (3) | by: James H. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    6

    Raw bulk syslog event forwarding

    Allow forwarding of raw syslog events at volume to additional locations with the ability to spoof the source ip on UDP sessions

    Comments (0) | by: cameron s. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    5

    Forcepoint's web gateways AP-Web collector

    Forcepoint's web gateways AP-Web is well know in this space. With no Sentinel Collector, that's a significant blindspot of device and user activity in our network.

    Comments (1) | by: Richard M. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations
  • Planned

    5

    Extend Feed Frequency Options

    At the moment the minimum Feed frequency is Weekly. Considering IP2Location only updates their databases once a month, this weekly minimum is a waste of resources to ...

    Comments (1) | by: Ben W. | over a year ago | Last activity over a year ago | Status changed over a year ago | Integrations