Event Correlation on ELK

Elastic Security SIEM
1

Hello,
I installed ELK as a SIEM and It works nicely. There is only one problem is that correlation of different events and it does not come default within ELK. According to my researches, Logstash filters work for this job but there is no decent document for it. My question is that: Is there a simple way for this job like an engine or plug-in? If it is not, how can I find a documentation about correlation on ELK? (with Logstash or another way) Also, logs can come from differebt sources like firewall and server.

P.S. My structure: BEAT -> Logstash -> Elastic -> Kibana

2

Yes, for now you can look at using Logstash with, say, the memcache plugin to implement some correlations. See this blog post for some examples. In the future, we intend to have "correlation rules" (executed post-ingestion) that will be able to detect sequences of related events.

Can you give one-two examples of correlations so we get a sense of what you are looking for? Thanks!

2 Likes
3

Thank you for your answer. I am going to read this blog. Unfortunately, I do not have clear cases but when I get it, I will write here.

Best regards,

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.