# PoC - Use ELK to aggregate multiple LogInsight Systems into one SOC **URL:** \ **Category:** SIEM\ **Created:** [August 24, 2019, 9:10am UTC](https://discuss.elastic.co/t/poc-use-elk-to-aggregate-multiple-loginsight-systems-into-one-soc/196615 "2019-08-24T09:10:47Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [August 24, 2019, 9:10am UTC](https://discuss.elastic.co/t/poc-use-elk-to-aggregate-multiple-loginsight-systems-into-one-soc/196615/1 "2019-08-24T09:10:47Z")
I've personally in the last 3-4 years been using Grafana+ELK for Log&Metric monitoring in running a large application platform, but have now changed internally to a position in Security & Operation Automation and are here trying to push for ELK usage across the board of hosting multi tenant hybrid IT Operations of OnPrem VMware-HyperV, Azure, GCP, AWS, Kubernetes hosts+services as a replacement/enhancement of various monitoring platforms like SCOM, Nagios, CheckMK, As a start I'm told to run a PoC for using ELK to possible aggregate SOC data across multiple LogInsight Systems of each their different area of interests (production islands) to feature search&analysis across all the LogRythm Systems. We do also run a Graylog SIEM for selected customers, which further in time possible could be moved to an ELK based system. Would appreciate any hints to assist in building a successfully PoC, TIA ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [August 30, 2019, 9:49am UTC](https://discuss.elastic.co/t/poc-use-elk-to-aggregate-multiple-loginsight-systems-into-one-soc/196615/2 "2019-08-30T09:49:49Z")
Hi, sorry for the late reply. In general, I think your experience in using ELK for operations is going to apply well for setting up ELK as a SIEM as well. A key requirement for using Elastic SIEM is to have the data formatted in [ECS](https://www.elastic.co/guide/en/ecs/current/index.html). This will make the current Elastic SIEM UI work and, in the near future, you will be able to take advantage of the built-in detection rules and dashboards that we will be providing. This means that if you are importing data from non-Beats sources, you need to figure out how to transform it in ECS. You would typically do that with Ingest Node or Logstash pipelines. To setup a quick PoC for Elastic SIEM, see the [this guide](https://www.elastic.co/guide/en/siem/guide/current/install-siem.html). Let us know if you have any specific questions on that. ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [September 3, 2019, 11:45am UTC](https://discuss.elastic.co/t/poc-use-elk-to-aggregate-multiple-loginsight-systems-into-one-soc/196615/3 "2019-09-03T11:45:16Z")
Thanks, will look into this guide, anything more specific hints available on how to map LogInsight data into ECS, please let me know, TIA. PS! What's Andrew Shanks' position w/Elastic these days? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 1, 2019, 11:45am UTC](https://discuss.elastic.co/t/poc-use-elk-to-aggregate-multiple-loginsight-systems-into-one-soc/196615/4 "2019-10-01T11:45:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.