Strengthen Your SIEM: Using Logstash to Connect ArcSight to the Elastic Stack

Samir Bennacer, Octodet

CTO

Octodet

Nicholas Lim

Consulting Architect

Elastic

As many of our users know, the Elastic Stack helps provide real-time insights into your data at massive scale.

With the release of Logstash 5.1, you can easily connect any device that supports the CEF data format as a codec to the Elastic Stack via files, kafka or syslog. This session will provide a step-by-step guide of how to extend and complement your existing ArcSight deployment with the Elastic Stack. Topics covered will include how to ingest CEF logs to the Elastic Stack using Logstash, visualising dashboards in Kibana, proactively monitoring security data in Elasticsearch using X-Pack alerting features and applying machine learning to identify potential suspicious signatures.