Linux and Windows events ingestion

Elastic Security
1

Hi, all.
What is the best way to ingest linux and windows system events into Elasticsearch?

We would like to use elasticsearch as siem.

thanks.

2

Hi @Cristina_Marletta_Li , I'd recommend using Elastic Agent, couple with some out of the box integrations. The 'System' integration is installed by default on both Windows and Linux, and will ingest Windows System/Application/Security events on Windows and auth/syslog messages on Linux. You can then apply additional integrations on your hosts from there. (e.g. Sysmon, Powershell, Auditd, etc)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.