Hello, I am trying to create a indicator match rule in ELK 7.10 where i have to give the indicator index pattern. Is there any default indicator index in ELK 7.10 or do i need to create a new indicator index with IOC logs from external source? Thanks & regards

ELK 7.10 - Indicator index patterns: Value lists

Frank_Hassanabad (Frank Hassanabad) February 15, 2021, 4:05pm 2

Currently there is a lot of different ways to set it up. In short, yes, you do need to create and setup an indicator index pattern. We do have file beat which can help out with regards to MISP feeds and modules. There's some caveats such as duplication you have to be careful of as outlined here:

Topic		Replies	Views
Issue with rules creation SIEM detection-rules	15	1725	May 5, 2022
Indicator match rule not matched and Mapped with filebeat-* (MISP Module) SIEM	2	552	April 2, 2021
Indicator matching rule recommendation Elastic Security	3	433	August 3, 2021
Indicator Match Detection Rule Not Matched and Mapped to Intel Feeds SIEM detection-rules	17	2311	April 1, 2021
Threat Intel and SIEM SIEM	3	4150	December 15, 2020

ELK 7.10 - Indicator index patterns: Value lists

Related topics