How can I do aggregation of incoming events on common fields to reduce the incoming EPS? Refer the AGGREGATION OF EVENTS section in " https://socprime.com/en/blog/arcsight-optimizing-eps-aggregation-and-filtration/ " for more detail. I think it could be done at logstash but can't find relevant docume…

Aggregation of incoming events on common fields for SIEM usecase

system (system) Closed May 20, 2020, 8:26am 2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Aggregate syslog with Logstash Logstash	1	449	January 14, 2019
Aggregate logs when fields are common in events Logstash	1	230	August 9, 2018
Is it possible to aggregate logs from cef input Logstash	24	1497	September 6, 2018
Aggregate fields from different event Logstash	4	835	July 6, 2017
Combine 2 events into one Logstash	2	4140	February 8, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Aggregation of incoming events on common fields for SIEM usecase

Related topics