Elastic SIEM – Security Information and Event Management

Re:Elastic SIEM – Security Information and Event Management by DeepYogurt on Tuesday June 25, 2019 @06:26PM (#20279682)

So for those interested Mozilla is working on something pretty similar.

https://mozdef.readthedocs.io/en/latest/

They have a set of docker containers which I find very handy for spinning up deploy specific logging sinks or full on SIEMs.

[ Parent | on HN ]

Re:Elastic SIEM – Security Information and Event Management by PenguinCoder on Tuesday June 25, 2019 @08:26PM (#20280758)

Just heard about this today at reinforce conf. Looks pretty interesting and integrates well with cloud logs or on prem. Definitely going to look into it more.

[ Parent | on HN ]

Re:Elastic SIEM – Security Information and Event Management by DeepYogurt on Wednesday June 26, 2019 @01:19AM (#20282106)

Just a heads up; there are some rough edges. That said to get it going you can just do a pull and then a `make run`. It's got zero auth in this mode, but if it's ephemeral whatever.

[ Parent | on HN ]