Hi, all.
What is the best way to ingest linux and windows system events into Elasticsearch?
We would like to use elasticsearch as siem.
thanks.
Hi, all.
What is the best way to ingest linux and windows system events into Elasticsearch?
We would like to use elasticsearch as siem.
thanks.
Hi @Cristina_Marletta_Li , I'd recommend using Elastic Agent, couple with some out of the box integrations. The 'System' integration is installed by default on both Windows and Linux, and will ingest Windows System/Application/Security events on Windows and auth/syslog messages on Linux. You can then apply additional integrations on your hosts from there. (e.g. Sysmon, Powershell, Auditd, etc)
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.