I suggest exposing some configuration items to be modified via the WebUI.
- Correlation rules
- WebUI session options
- Hosts and their properties
- Services and their properties
Any changes need to be checked for validity prior to commiting to the configuration.
Any changes done to the configuration need to be consigned to an audit log.