I collected syslogs of security devices (WAF, IPS, IDS (suricata), anti-DDoS) by filebeat, delivered to logstash, and stacked them in elastisearch. I know that using filebeat, it automatically makes it into ecs format, All collected indexes were registered in the siem index. However, equipment ot…

You can use the inspect option to see which fields are required. go to request and look at the query. [Screenshot from 2020-10-31 08-07-42] After finding out required fields, you could rename or delete the fields using Logstash, filebeat processors , or ingest pipeline processors .

Discuss the Elastic Stack

What are the essential ecs items in elastic siem?

Elastic Security

111387 (남진 김) November 1, 2020, 4:52am 11

Thank you so much for answering the question.

1 Like

Topic		Replies	Views
How can receive log in elastic siem using logstash Elastic Security	2	326	November 4, 2022
Integrate Events into Elastic SIEM SIEM	5	1209	April 19, 2020
Configuring SIEM SIEM	3	806	August 2, 2019
Using Elastic SIEM and ML with Beats and Logstash SIEM	13	1685	September 8, 2020
Sonicwall firewall SIEM Elastic Security	15	1647	November 4, 2022

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

What are the essential ecs items in elastic siem?

Related topics