For commercial SIEMs, correlation rules and threat signatures are available from some communities (CERTs and others) or from some commercial offers. What about ELK based SIEMs? Where can I find off-the_shelf correlation rules for a "standard" information system (either community or commercial ones)? How do they compare?

Alternativey if a correlation engine is required on top of ELK, same question for open source correlation engines like CorReactive, Esper or Drools?

Our context is a multi-location software development company, 10k people. In our Information System, we have firewalls, VPN, proxies, AD, email, PKI, application servers, infrastructure services, windows and Linux servers and workstations


In particular, MineMeld Open-source Threat Intelligence processing framework by Palo Alto Networks is supported by the ELK based OpenSource SIEM solution SIEMONSTER - I have not yet tested them.

  • We have abandoned the SIEMonster solution due to the lack of sales contact. Many messages and phone calls without answers. And we have abandonned also ELK for lack of off-the-shelf viable SIEM solution – lalebarde Jul 18 '18 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.