SIEM as Needed: Elasticsearch, Energy Logserver, Wazuh...
summary
Describes building a customizable SIEM environment tailored to a company’s specific needs using Elasticsearch-based tools. Covers technologies including Elasticsearch/Logstash/Kibana stack and the Energy Logserver project, plus Wazuh, showing how to meet IT security requirements while fitting nonstandard procedures and controlling project economics.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:10Project Energy Logserver origins
- 7:33Energy Logserver architecture
- 11:52Wazuh and tools integration
- 14:23SIEM data processing stages
- 18:20Wazuh in the system
- 22:58Bro network traffic analysis
- 26:36Network infrastructure monitoring
- 28:02Energy Logserver alert rules
- 33:22Agent management and mobile app
- 35:08Energy Logserver clients and partnerships
- 36:13Q&A
related talks
20mSIEM with Elastic – Insights for Security, Freedom for DevOp
33mSecurity Logging Use Cases: Building an Open-Source SIEM
50mProject DiSIEM
44mBuild yourself an Elastic Threat Hunting and Monitoring SIEM
20mSIEM There, Done That: Rising Up in the SecOps Revolution
01h 05mPractical network defense at scale
33mFree SOC? — how open source tools can come to our aid
02mThe Challenges of Legacy SIEM Models