For commercial SIEMs, correlation rules and threat signatures are available from some communities (CERTs and others) or from some commercial offers. What about ELK based SIEMs? Where can I find off-the_shelf correlation rules for a "standard" information system (either community or commercial ones)? How do they compare?
Alternativey if a correlation engine is required on top of ELK, same question for open source correlation engines like CorReactive, Esper or Drools?
Our context is a multi-location software development company, 10k people. In our Information System, we have firewalls, VPN, proxies, AD, email, PKI, application servers, infrastructure services, windows and Linux servers and workstations