Specific steps to build monitoring and siem with elk

[Depressed (Admin)]

Hi
I'm kinda new to whole siem and elk things and before i managed to setup monitoring with splunk
cracked enterprise edition and there all was simple as forwarding data from netflow ,syslog ,snmp
and defining new field then manipulate date with some functions and making dashboard
BUT
it's been a week that I'm consulting elk and wazuh to receive syslog and netflow from pfsense to initiate setup and what i found some nonsense articles that point me to make filter and rules ....(idk)
what i wanna do is to forward pfsense log and netflow ,cisco devices log and snmp ,windows server and client and linux servers suricata logs to elk (and wazuh )to make custom and predefined dashboards for monitoring
would you plz explain me step to take for setup?
TNX

[Depressed (Admin)]

or at least point me somewhere to learn more...

[dadoonet (David Pilato)]

I'd look at some of the free trainings we have:

Free on-demand Elasticsearch and Kibana training

[austinsonger]

@Depressed

Hi
I'm kinda new to whole siem and elk things and before i managed to setup monitoring with splunk
cracked enterprise edition and there all was simple as forwarding data from netflow ,syslog ,snmp
and defining new field then manipulate date with some functions and making dashboard
BUT
it's been a week that I'm consulting elk and wazuh to receive syslog and netflow from pfsense to initiate setup and what i found some nonsense articles that point me to make filter and rules ....(idk)
what i wanna do is to forward pfsense log and netflow ,cisco devices log and snmp ,windows server and client and linux servers suricata logs to elk (and wazuh )to make custom and predefined dashboards for monitoring
would you plz explain me step to take for setup?
TNX

Are you using Wazuh? Because Wazuh uses "Open Distro for Elasticsearch" so you should look for that community.

WAZUH

• Redirecting to Google Groups
• Join us on Slack | Wazuh

Open Distro for Elasticsearch

• https://discuss.opendistrocommunity.dev

I have made some blogs posts that could help you - https://songer.pro