Elasticsearch Security - Asking for Data

edvrfn · April 25, 2021, 12:16pm

I am sending logs from my firewall/home-router(UDM) to rsyslog and copying the logs in Logstash directory. I can see the data in discover and can create visualizations/Dashboard from that data. But the security section in Kibana does not seem to use that data and still asking to add data. How can i use my firewall logs in Security section.

Jason_Slater · April 25, 2021, 2:51pm

See this page for the minimum set of fields needed in your data for it to "work" with the vario0us tabs of the SIEM app:

and within Stack Management > Advanced Settings, make sure your indices are included under Security Solution > Elasticsearch indices

system · May 23, 2021, 2:52pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to ingest firewall log data to elastic security Elastic Security	3	780	February 28, 2023
Elastic siem receive another Security Device log SIEM	2	405	October 19, 2020
Logstash on windows sends data directly to the security onion SOC, not elasticsearch on windows? Elasticsearch	1	186	May 25, 2023
Firewall Logs Logstash	2	1259	May 25, 2016
After applied the tutorial "Getting start with Elasticsearch security" Logstash receive Syslog data but Kibana can’t show it Logstash elastic-stack-security	4	364	December 28, 2020

Elasticsearch Security - Asking for Data

Related Topics