News for hackers. Stuff that matters.

A comment on Elastic SIEM – Security Information and Event Management.

Re:Elastic SIEM – Security Information and Event Management by strictnein on Tuesday June 25, 2019 @11:24PM (#20281624)
> SIEM detection rules ... on our roadmap

The current solution in this space, that actually works really well at scale, is ElastAlert[0]. The problem is that ElastAlert is kind of a mess to work with. Lots of documentation, but you need to get into the weeds with it to figure out how it really functions.

Once you get it going it's a great tool. Scaling it out (we run hundreds of rules pretty frequently - upwards of 15 times an hour) is just standing up more instances with their own separate rules.

[0] https://github.com/Yelp/elastalert

[ Parent | on HN ]
Re:Elastic SIEM – Security Information and Event Management by frementrep on Saturday June 29, 2019 @02:02AM (#20311013)
Heard the same about elastalert that it is difficult to manage. Any idea how much time/effort is spent per day/week/month to manage the elastalert rules and what level of expertise is required?
[ Parent | on HN ]