How to discard specific event from storing or correlation in SIEM to save resources

Elastic Security SIEM
1

Hi,

In SIEM systems events can be discard or filter to safe diskspace and avoid overloading SIEM from noisy events. This way SIEM resources can be managed at optimum levels.

For example windows event 5156 from all agents to be filtered or from specific agent.

How to achieve this from Elastic SIEM UI or some other manageable way ?

2

You can control what event is processed by Elastic by using Ingest pipelines | Elasticsearch Guide [7.12] | Elastic

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.