SIEM, Auditbeat Queries

ckough · September 22, 2020, 5:42pm

Hi there,

I am trying out Elastic Siem 7.7 with Auditbeat 7.7 on Red Hat 7.6 and I have a few questions.

Is SIEM data available only when I set Auditbeat output to elasticsearch? I try output to logstash->elasticsearch and the stats are available in the discovery dashboard but not in SIEM dashboards.

Can I sent auditbeat outputs to both both elasticsearch and logstash? Seems I can't do that.

When I sent Auditbeat data to elasticsearch output, how do i customise the index name? I try setting "index", "setup.template.name" and "setup.template.pattern" in auditbeat.yml but it does not seem to work. Must I have an existing index tempate with the same name?

Thanks a million...
CK

system · October 20, 2020, 5:42pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Can not get network sockets info SIEM	8	713	September 22, 2020
Host.hostname field_data issue with SIEM and auditbeat SIEM	1	431	May 5, 2020
SIEM Network Page Queries all indexes SIEM	5	959	June 10, 2020
Using Elastic SIEM and ML with Beats and Logstash SIEM	13	1588	September 8, 2020
Filebeat as Datasource for Elastic SIEM Beats filebeat	1	312	July 31, 2020

SIEM, Auditbeat Queries

Related Topics