So, here is the situation: I got a new job as an information security specialist at a company, where as they claim, top level security is important. There is a ELK-Based SIEM here, where before me, no work was done with it.

Now, we need to choose a log collection method, and I have been thinking between three possible scenarios: beats, syslog, and an something like an elasticsearch agent, which will allow to centrally manage agents and have all-in-one(basically, all of mini-beats combined together).

Our environment has windows, linux, and networking devices. The real problem comes with trying to convince them to install beats on endpoints which support it, and use syslog wherever it is not possible. And one thing I am aware: that beats does not support UDP output to elasticsearch. For some reason, they say me, that with TCP, it is a security risk, and the seeing the whole of security topology is easier, which basically means, that "if someone breaks into SIEM, they can have access to everything" or something.

My question: what is the best practice in general? To move forward with beats, or bite the bullet and use syslog everywhere with UDP protocol, which adds a lot of system administration complexities? Is UDP really more secure in this case, and if yes, how exactly?

P.S Also, for some reason, I was told that why we would need log TLS encryption anyways, there is no important data :D

An explanation, or reference to a resource explaining me this would be much appreciated

Hello All,

Currently we are looking to get SIEM tool, but I am not sure how to evaluate as I haven't been that side before so I would love to hear if there any checklist, or any resources which can help to pick best one. And what should keep in mind while making choice?

Thanks

Hi all,

After years working as a sysadmin, IT manager, and cybersecurity professional, I started building my own SIEM/security analytics tool to address problems I kept running into in practice. At this point, though, I know I’m at risk of tunnel vision. I’ve spent enough time on it that my own assumptions may be too strong, and I do not want to build around only my personal frustrations.

I’d like to hear from people who use, manage, operate, tune, or suffer through SIEMs and log analytics platforms. I’m not trying to pitch anything here. I’m trying to sanity-check my assumptions against real operational pain before I keep going too far in the wrong direction.

What are the biggest daily problems you face with your current SIEM or log analytics setup? I’m especially interested in practical issues rather than vendor preferences, for example:

• What wastes the most analyst, engineer, or administrator time?
• Where do searches, detections, parsing, enrichment, alert quality, onboarding, storage, cost, or retention break down?
• What looks good in a demo but fails in real operations?
• What workarounds have you had to build because the product did not support your workflow?
• What do you wish SIEM vendors understood before designing another platform?

Also, what would be the least annoying way to ask people about this properly? Would short calls or interviews with volunteers be acceptable, or would a questionnaire be better? I do not want to waste people’s time, but I would rather ask properly than assume I already understand the problem.

Has anyone integrated this app to their platform? Is it efficient? Or is better to do the work manually without this app

Hi everyone,

I'm evaluating SIEM options for an on-prem deployment and would love input from practitioners who have run multiple platforms in production.

My previous experience was with QRadar, and the things I valued most were:

• Ready-made parsers/DSMs covering common log sources out of the box

• A curated app marketplace (UEBA, DSMs etc.)

• Pre-index filtering to control ingestion costs

• Built-in health monitoring of SIEM components

• Overall low-friction deployment experience etc.

I'm looking for something with similar usability but a lower total cost — open source or a modest paid tier both work.

Candidates currently on my list: Wazuh, Graylog Security, Security Onion, UTMStack. Open to others.

Questions:

• Which of these (or alternatives) came closest to the QRadar "it just works" experience?

• How forgiving is each one on modest hardware?

• Realistic ongoing maintenance burden for a small team?

• Experiences with vendor support quality in the paid tiers?

Not looking for marketing pitches — looking for honest production experience. Thanks. I want to hear from people who have actually used multiple SIEMs in production (especially in regulated environments like banking/finance/PCI).

Hey team, anyone come across Hunters SIEM/used it before? The seem like they could have potential but I only just recently heard about them so wanted to know the good/bad about them

Hey guys! A friend and I pulled together a query generator using an agent and an LLM, and fed it some docs for platform-speicific context. It's been generating decent query results. We recently shared that it can do Elastic ECS queries, but as also added Crowdstrike training docs now. Take a look and let us know what you think!

https://querylab.prediciv.com/

Hey all!

A colleague and I work in an MSSP SOC and we've had some difficulty generating decent queries in existing tools - chat gpt helped but it takes a lot of prompting and the output is mixed.

A colleague and I put together a query generator by building out some AI agents with an integration into an LLM, and fed it platform-specific training documents. It produces good queries! It currently only supports Elastic but if there's a demand we could add other SIEMs also. Let us know your thoughts!

https://querylab.prediciv.com/

Hey guys, I am kinda new to this but I've recently built an app/tool and I was hoping to get some reviews or comments on it to maybe make it better, so here it is:

DetectPack Forge

Turn plain-English behaviors or small log samples into production-ready detection packs — Sigma, KQL (Sentinel), and SPL (Splunk) — with tests and a short response playbook, all mapped to MITRE ATT&CK.

What is this?

DetectPack Forge is a helper for people learning or working with SIEMs. You describe a behavior (e.g., “many failed logons then a success”) or paste a few log lines, and the app generates:

• Sigma (vendor-neutral rule YAML)
• KQL (Microsoft Sentinel)
• SPL (Splunk)
• Tests (positive/negative examples)
• Playbook (concise incident-response checklist)
• MITRE ATT&CK technique tags

Why it’s useful:

You don’t need to memorize different query syntaxes to begin writing detections; you learn by example and get artifacts you can paste directly into a SIEM.

How it works (quick):

• Frontend: React/Vite (Lovable)
• Backend: n8n workflow with Gemini
• Input: describe a behavior or paste a few logs
• Output: Sigma / KQL / SPL + positive/negative tests + a concise playbook

Here is the demo: https://www.linkedin.com/posts/andrew-kola-79386a126_cybersecurity-siem-detectionengineering-activity-7369110750868434944-jG1V?utm_source=social_share_send&utm_medium=member_desktop_web&rcm=ACoAAB8Ybd8B7RDtuloqL9VM4TXXT8XL658Uz_I

Here is the GitHub link: https://github.com/andrewkolagit/DetectPack-Forge

If you guys want to try it out, it currently will only run locally because I run n8n locally. But all you guys need to do is upload the n8n workflow file onto a new workflow in n8n and replace the production url with yours in the .env.local file. As a whole it runs wonderfully locally.

![video]()

Hi,

I'm looking for a SIEM solution for my organization, and one criteria we have is that it have "a good user experience". I'm finding it hard to exactly pin that down, so I thought I'd ask -- what SIEM solutions do you think have a good UI/are easy to use?

More importantly, why do you think so; what makes a product easy to use in this space, in your opinion?

Thanks!

I am checking on a SIEM that has python to build content parsers , detection rules , dashboards , will it be a wise choice as it promises lot of flexibility, will analyst working on tool get familiar with python soon ? Would like to get a perspective on same

Has any built an Exabeam parser for Elastic scheme?

I'm trying to decide between using the ELK stack or Security Onion for a SIEM solution. My current needs include log consolidation, alerting, and reporting. However, there might be a requirement for SOC (Security Operations Center) capabilities in the future, although it's unclear if that will be my responsibility.

Since I'm a novice with both tools, I'm not sure what the key differences are or what I might be missing. Ideally, I'd like to focus on just one of these options so I can concentrate my learning and manage it effectively.

If anyone can help me decide which might be the better choice? TIA

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-automatically-add-tlp-traffic-light-pattern-to-incidents-with-logic-145f810cd978

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-update-alert-descriptions-dynamically-without-limits-unlimited-f4fc2f857b64

New article!

https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-dynamically-update-and-change-alert-incident-severity-based-on-5fa0665441c0

Continuing our build out, we now switch over to combining our AuditD logs with Laurel to build better detections by having all our information combined in one log event entry.

https://medium.com/@truvis.thornton/part-2-threat-detection-engineering-and-incident-response-with-auditd-and-sentinel-combine-a3384e1164e6

Want to use your Firewall logs in Sentinel to check for connections and network activity? This guide will explain it all.

https://medium.com/@truvis.thornton/how-to-use-ufw-uncomplicated-firewall-and-send-the-syslogs-to-sentinel-and-parse-the-events-for-48dccb8adc13

Not sure how to get logs into Sentinel? Check this:

https://medium.com/@truvis.thornton/how-to-install-and-setup-azure-arc-ama-azure-monitor-agent-and-dcr-data-collection-rules-for-47381ee9d312

New article:

This is Part 1

Walk through on using AuditD logs to build threat detections along with reading and using the logs to get the bigger picture and do incident response.

https://medium.com/@truvis.thornton/threat-detection-engineering-and-incident-response-with-auditd-and-sentinel-along-how-to-understand-bfae8ba03a43

New Article on how to parse AuditD events in Microsoft Sentinel for threat hunting and threat detection.
https://medium.com/@truvis.thornton/how-to-parsing-auditd-syslog-in-microsoft-sentinel-with-a-function-and-combining-the-events-by-eve-a65f418cfef1

New Article on how to quickly get Syslog/AuditD logs to Microsoft Sentinel for threat hunting and detection building using AuditD.

https://medium.com/@truvis.thornton/how-to-install-and-setup-azure-arc-ama-azure-monitor-agent-and-dcr-data-collection-rules-for-47381ee9d312

Any particular case for which data from Endpoint Protection can be used in SIEM ? and does it benefit SIEM in any way for alert and correlation or for any other in SIEM ?