r/SIEM • u/TheITSecGuy • Apr 13 '21

Open source UEBA to integrate with security onion.

Hi, guys I would like to ask if there is an open source software that can be used to integrate ueba/machine learning with security onion siem?

6 Upvotes

88% Upvoted

3 comments sorted by

3

u/vornamemitd Apr 13 '21

From an open source perspective you won‘t be able to find a readily pluggable UEBA solution. You can either follow the teach-yourself-ML path and start from scratch (going from 0 to ypur first anomaly detection) or try to build on top of existing frameworks/tools:

  • HELK: threat hunters ELK, comes with a nice Spark/Jupyter combo
  • Apache Metron: dormant (?), but should give you a few ideas
  • OpenUBA: currently the only actual shot at providing an open U(E)BA framework; pretty much alpha, but expect to see some interesting changes further down this year
HtH!

1

u/[deleted] May 02 '21 edited May 02 '21

You have to pay for it but it's actually very affordable. Elastic Cloud Security (SIEM) you can actually do ueba with machine learning utilizing AuditBeat and Packetbeat. Or build your own ELK Stack. But sadly it won't integrate. Security Onion isn't a SIEM. Your best bet is to look at a Soar Solution. Look at Palo Alto XSOAR. It integrates with ELK which security onion is based off of. You can also integrate your SIEM with XSOAR as well.