We've used SolarWinds for on-premises logging, but we're moving from an on-premises file share to SharePoint. What tools or services are you using to collect and review SharePoint and Entra ID activity alongside on-premises Active Directory logs in a hybrid environment with HIPAA compliance requirements?
3 Answers
We use Huntress SIEM through its EDR/ITDR package and send both our cloud and on-premises resources into it. Data is retained for a year by default, although only a smaller portion is immediately available in the portal. It’s mainly geared toward security events, so I’m less certain how deeply it covers routine SharePoint file additions, removals, and deletions.
Common options worth comparing include Rapid7 InsightIDR, Microsoft Sentinel, Wazuh, and ManageEngine Log360. The best choice will depend on how much Microsoft-native telemetry you need, your retention requirements, and whether you want a managed service or something you operate yourself.
Start with retention and audit coverage before choosing the platform. Entra sign-in and audit logs have limited default retention, while longer unified audit log retention depends on licensing. SharePoint file activity is recorded through the unified audit log, so configure exports or extended retention immediately and verify that the specific events you need—such as document access—are actually being captured. For on-premises AD, enable advanced auditing for logons, directory changes, and group membership changes. If you need to track access to remaining file shares, configure the appropriate object-level SACLs as well. Decide whether the SIEM will be the long-term system of record or merely a search interface over logs that expire upstream; that distinction matters a lot for HIPAA audits and investigations.
Does Huntress provide the active protection as well, or are you pairing it with Defender for Endpoint or another EDR product? I haven’t looked at its integrations recently.