What does your security team need from Front's logs?
For most security teams, Front is close to a blind spot. An admin can see audit logs in Front's settings and export them as CSV, but there is no way to get login activity, admin changes or data access into the tools your security team actually works in.
We are changing that. The first release lets you connect your SIEM in Front's settings and receive security events as they happen, starting with authentication: logins, MFA challenges, session and IP context. From there we expand coverage to admin role and permission changes, SSO configuration changes, user provisioning, API key lifecycle, data exports and external shares.
Before we lock the first release, we want your answers:
- Which SIEM or log platform would you point Front at? Splunk, Microsoft Sentinel, something else?
- Which events would you love to see on day one for Front to stop being a gap in your security review?
- Who at your company would own this connection day to day: you, your IT team, or your security team?
- Do you have business or back-office rules that are triggered by events in your SIEM?
Answer in the thread. If your security team has a written requirements list from a vendor review, do let us know!