Require SIEM (ELK) to alert when Risk 5 application is detected.

[Kandarp_Desai]

Hi Guys,

We are using ELK tool as a SIEM to raise incidents. We want to create an incident whenever there is a Risk 5 Application detected ( like bittorrent ). How do we go about doing this ? We do not see any field for Risk in the traffic logs.

[reaper · Accepted solution]

you can create a log forwaarding profile with a filter set to (risk_of_app eq 5) with a syslog action

[Kandarp_Desai]

Thanks I'll try it Tom.