DEAR gents,
I am trying to compila my first EQL search on ingested syslog events from IDS for port scan to destination IP to raise a hit.
I am using prebuilt rule for it also complining own one but no hitted event.
I am wondering if Elasticsearch is having something like job inspector facilitating debugging to see what is going on inside and why my search doesnt extract any events from indices (similarly as Splunk job inspector)
Any help would be highly welcomed.
KR
Andy