Event Correlation Using ELK

Elastic Stack Elasticsearch
1

Hello,

I have installed and configured all the ELK stack and i am also able to capture all the logs.

Now i need to correlate the logs coming from different sources ex. Firewall, switches, Syslog and Operating sytems In order to identify which component is under attack or need attention.

Is there any plugin, component or configuration available that can help me to correlate the events.

for example : port scan identify, ping floods, syn floods etc.

any help would be appreciated.

Thanks
Anshu

2

Sounds like a tease for Elastic's SIEM

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.