Document enrichment via ingest pipeline or Indicator Match rule - which is preferable?

Elastic Security SIEM
1

Our elastic cluster is being used as a SIEM and is currently ingesting approximately 3x the data than originally scoped to ingest. It's working pretty hard.

We have recently begun ingesting a MISP for enrichment and alerting and I am trying to determine the best route to employ this MISP. Should we use it for enrichment (example: add 'TOR' field and value if a document's IP address is on a TOR exit node list) or should we instead create indicator match rules to compare the IP addresses in an index to the MISP index?

We are trying to determine which method would utilize the least amount of resources.

2

Hey!

The Indicator Match rule - is an easier way to start and have alerts based on the match from your index and MISP.

But for rule execution there some matching logic happens on the Kibana site, and if you have a huge amount of data to process, it can relate to performance.

Ingest pipeline for enrichment purposes only should consume fewer resources in theory (it's will happen on Elasticsearc side)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.