Is there a way to add additional data sources to the SIEM dashboard? I have an index, syslog-, that collects data from our network switches & firewalls. It does use the ECS conventions. The dashboard seems to only use auditbeat-, filebeat-, packetbeat-, winlogbeat-*.
Data is currently collected via a Logstash UDP input plugin and then parsed & enriched before being sent to ES. I know filebeat can do syslog, but I haven't played with creating my own module or using processors/filters.