topic Re: Require SIEM (ELK) to alert when Risk 5 application is detected. in General Topics

Require SIEM (ELK) to alert when Risk 5 application is detected.

Kandarp_Desai — Thu, 24 Feb 2022 14:42:26 GMT

Hi Guys,

We are using ELK tool as a SIEM to raise incidents. We want to create an incident whenever there is a Risk 5 Application detected ( like bittorrent ). How do we go about doing this ? We do not see any field for Risk in the traffic logs.

Re: Require SIEM (ELK) to alert when Risk 5 application is detected.

reaper — Thu, 24 Feb 2022 15:30:16 GMT

you can create a log forwaarding profile with a filter set to (risk_of_app eq 5) with a syslog action

Re: Require SIEM (ELK) to alert when Risk 5 application is detected.

Kandarp_Desai — Thu, 24 Feb 2022 17:21:01 GMT

Thanks I'll try it Tom.