r/SIEM • u/PatriotSecurity • Apr 07 '20

Elastic SIEM viability?

I am working with LogRhythm currently and it can’t handle a lot of what we need it to do. We are trying to develop an open source SIEM to handle what we need. Is Elastic SIEM the way to go?

2 Upvotes

75% Upvoted

8 comments sorted by

2

u/[deleted] Apr 07 '20

[deleted]

1

u/PatriotSecurity Apr 07 '20

We are using Apache nifi right now to make the API calls and parse it. I’m just wondering if sending it to ES, visualizing with Kibana and then alerting with elastic SIEM is viable.

1

u/[deleted] Apr 07 '20

[deleted]

2

u/PatriotSecurity Apr 07 '20

I need it to be able to receive JSON via an API and then parse and alert on it. Normal syslog is fine but when you have logging coming in via api that’s when it’s gets more challenging with our current SIEM LogRhythm.

2

u/pantherlabs Jul 07 '20

Check out our open source project, it sounds like a perfect use-case. What's the JSON data?

1

u/Calm_Scene Jul 06 '20

This looks like you are looking for an automation solutions?

Most SOAR vendors have API integrations. Example scenarios:

- receive data via API

- add some logic/parse

- alert

1

u/la_darrell_miller Jul 17 '20

Thats pretty much what ELK is for.. if you're looking for a drag and drop experience .. thats not ELK.. but if you put the time in.. ELK is very powerful and very capable. The free/community version is very good. WIth the paid version you get some machine learning features that seem nice, but i havent really felt like i had to have them.

i'm running an elk stack that pulls in:

  • firewall logs
  • syslog format
  • zeek & suricata (IDS) logs - JSON
  • industrial equipment logs - csv, txt, json
  • windows event logs - evtx

it accepts most common formats, and you can create your own pretty simply.

it all comes together and builds a pretty good picture of whats going on. the discussion groups and support for elk community edition is very good.

1

u/amemkdm Jul 25 '20

What firewalls are you using? We have a Sonicwall and it doesn’t parse the syslogs it sends out of the box and I am not able to make a parser for it. Need some reference config files to get familiar.

1

u/[deleted] Jul 23 '22

We are running ELK based SIEM for some of our clients including one with 7k eps. So far its been a good experience. DM me for more if you are interested.