# Enrich SIEM Data **URL:** \ **Category:** SIEM\ **Created:** [November 17, 2020, 6:49pm UTC](https://discuss.elastic.co/t/enrich-siem-data/255749 "2020-11-17T18:49:00Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![randomguy](https://avatars.discourse-cdn.com/v4/letter/r/ba8739/32.png) [@randomguy](https://discuss.elastic.co/u/randomguy)\ **Post date:** [November 22, 2020, 8:10am UTC](https://discuss.elastic.co/t/enrich-siem-data/255749/2 "2020-11-22T08:10:55Z")
Hi, I'm not an ELK expert so maybe others have better solution. I also tried to find ways to deal with Threat Intel but none of them are easy and user friendly. 1. Logstash: You can use Logstash and memcached to enrich data. [Enriching ElasticSearch With Threat Data - Part 1 - MISP - Security Distractions](https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-1-misp/) [Enriching ElasticSearch With Threat Data - Part 2 - Memcached and Python - Security Distractions](https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-2-memcached-and-python/) [Enriching ElasticSearch With Threat Data - Part 3 - Logstash - Security Distractions](https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-3-logstash/) Or you can use another method: [Dsiem - Security event correlation engine for ELK stack (hakin9.org)](https://hakin9.org/dsiem-security-event-correlation-engine-for-elk-stack/) 1. Preprocessor: Store the Threat intel inside ELK and enrich the data with enrich processor. I can't find any good article about it. [Enrich processor | Elasticsearch Reference [7.10] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/enrich-processor.html) My original post: [Threat Intel and SIEM - Elastic Security / SIEM - Discuss the Elastic Stack](https://discuss.elastic.co/t/threat-intel-and-siem/255404/3) --- _[View the full topic](https://discuss.elastic.co/t/enrich-siem-data/255749)._