Hello, Trying to implement an IP Watch List in SIEM and wondering if there was any guidance/best practices in doing so. I currently have an index where new malicious IP objects are logged on a regular basis, let's say these objects contain a field named malicious.srcip I'd like to detect when log…

IP Watch List Functionality

ankitsynX (Ankit Kumar) March 20, 2020, 7:25pm 5

Hi Alex,

Thanks for idea, while I'm fairly new to elastic still exploring different ways to do it. Makes sense to do it on a lightweight shipper instead.
would try this out!

Ankit

Topic		Replies	Views
Threat Intel and SIEM SIEM	3	4375	December 15, 2020
Another Feature Request for SIEM SIEM	6	799	August 5, 2020
I need advice on this new use case - IOC Elasticsearch	4	1459	September 25, 2017
How to apply Third Party or Custom Threat intel feeds with SIEM App? SIEM	3	589	May 20, 2020
Enrich SIEM Data SIEM	2	1194	December 20, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

IP Watch List Functionality

Related topics