# Add additional data source to SIEM dashboard

**URL:** <https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712>\
**Category:** SIEM\
**Created:** [September 16, 2019, 6:47pm UTC](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712 "2019-09-16T18:47:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Justin\_Doles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_doles/32/40730_2.png) [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\
**Post date:** [September 16, 2019, 6:47pm UTC](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712/1 "2019-09-16T18:47:32Z")

</div>

Is there a way to add additional data sources to the SIEM dashboard? I have an index, syslog-_, that collects data from our network switches & firewalls. It does use the ECS conventions. The dashboard seems to only use auditbeat-_, filebeat-_, packetbeat-_, winlogbeat-\*.

Data is currently collected via a Logstash UDP input plugin and then parsed & enriched before being sent to ES. I know filebeat can do syslog, but I haven't played with creating my own module or using processors/filters.

---

<div class="post-metadata">

**Author:** ![stephmilovic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephmilovic/32/146835_2.png) [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)\
**Post date:** [September 16, 2019, 9:32pm UTC](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712/2 "2019-09-16T21:32:15Z")

</div>

Yes! The way to add additional index patterns to the SIEM dashboard is by going to Management from the sidebar, then "Advanced Settings" under Kibana. From there, scroll to the SIEM section where you will find the "Default index" input. This is where you can add your index pattern.

---

<div class="post-metadata">

**Author:** ![Justin\_Doles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_doles/32/40730_2.png) [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\
**Post date:** [September 17, 2019, 12:34pm UTC](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712/3 "2019-09-17T12:34:43Z")

</div>

Thanks! That appears to be what I needed.

---

<div class="post-metadata">

**Author:** ![Camilo\_Diaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/camilo_diaz/32/46512_2.png) [@Camilo\_Diaz](https://discuss.elastic.co/u/Camilo_Diaz)\
**Post date:** [September 18, 2019, 8:46am UTC](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712/4 "2019-09-18T08:46:35Z")

</div>

Brilliant! Exactly what I was looking.

Just wanted to add that, on 'Visualize' you can choose the index you get the data from.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2019, 8:46am UTC](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712/5 "2019-10-16T08:46:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.