59 lines
1.8 KiB
Plaintext
59 lines
1.8 KiB
Plaintext
[role="xpack"]
|
|
[[xpack-siem]]
|
|
= SIEM
|
|
|
|
[partintro]
|
|
--
|
|
|
|
The SIEM app in Kibana provides an interactive workspace for security teams to
|
|
triage events and perform initial investigations. It enables analysis of
|
|
host-related and network-related security events as part of alert investigations
|
|
or interactive threat hunting.
|
|
|
|
|
|
[role="screenshot"]
|
|
image::siem/images/overview-ui.png[SIEM Overview in Kibana]
|
|
|
|
|
|
[float]
|
|
== Add data
|
|
|
|
Kibana provides step-by-step instructions to help you add data. The
|
|
{security-guide}[Security Guide] is a good source for more
|
|
detailed information and instructions.
|
|
|
|
[float]
|
|
=== {Beats}
|
|
|
|
https://www.elastic.co/products/beats/auditbeat[{auditbeat}],
|
|
https://www.elastic.co/products/beats/filebeat[{filebeat}],
|
|
https://www.elastic.co/products/beats/winlogbeat[{winlogbeat}], and
|
|
https://www.elastic.co/products/beats/packetbeat[{packetbeat}]
|
|
send security events and other data to Elasticsearch.
|
|
|
|
The default index patterns for SIEM events are `auditbeat-*`, `winlogbeat-*`,
|
|
`filebeat-*`, `packetbeat-*`, `endgame-*`, and `apm-*-transaction*`. You can
|
|
change the default index patterns in
|
|
*Kibana > Management > Advanced Settings > siem:defaultIndex*.
|
|
|
|
[float]
|
|
=== Elastic Endpoint Sensor Management Platform
|
|
|
|
The Elastic Endpoint Sensor Management Platform (SMP) ships host and network events directly to the SIEM application, and is fully ECS compliant.
|
|
|
|
[float]
|
|
=== Elastic Common Schema (ECS) for normalizing data
|
|
|
|
The {ecs-ref}[Elastic Common Schema (ECS)] defines a common set of fields to be
|
|
used for storing event data in Elasticsearch. ECS helps users normalize their
|
|
event data to better analyze, visualize, and correlate the data represented in
|
|
their events.
|
|
|
|
SIEM can ingest and normalize events from ECS-compatible data sources.
|
|
|
|
--
|
|
|
|
|
|
include::siem-ui.asciidoc[]
|
|
include::machine-learning.asciidoc[]
|