Installed Graylog. 7 million log entries per month. Now what?

• Graylog_3.0_Content_Pack_Active_Directory_Auditing

  2 17 0.0

Then you can go about making dashboards for high level information around the logs you are collecting. They used to have awesome ones in their marketplace but have since removed them for some reason. Here is a reference to one of them https://github.com/aydnyldrm/Graylog_3.0_Content_Pack_Active_Directory_Auditing

• Wazuh

  151 9,108 10.0 C

  Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

  

Try Wazuh. It'll filter and parse logs for you, make pretty C-level graphs, and give you pointers on where to begin threat hunting.

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• security_content

  20 1,136 9.9 Python

  Splunk Security Content

  

Depending on whether this is up your alley either look for a MSSP/MDR/Managed BlaBla provider or head on to - https://github.com/splunk/security_content - https://www.elastic.co/guide/en/security/current/prebuilt-rules.html - https://github.com/mdecrevoisier/SIGMA-detection-rules - https://github.com/Azure/Azure-Sentinel to get an idea of what to look for. MITRE ATT&CK and the related DETT&CT should serve as an additional eye opener. Ah yes - forgot the bible on log management from Anton Chuvakin in the above list.

• SIGMA-detection-rules

  2 265 6.4

  Set of SIGMA rules (>320) mapped to MITRE ATT&CK tactic and techniques

Depending on whether this is up your alley either look for a MSSP/MDR/Managed BlaBla provider or head on to - https://github.com/splunk/security_content - https://www.elastic.co/guide/en/security/current/prebuilt-rules.html - https://github.com/mdecrevoisier/SIGMA-detection-rules - https://github.com/Azure/Azure-Sentinel to get an idea of what to look for. MITRE ATT&CK and the related DETT&CT should serve as an additional eye opener. Ah yes - forgot the bible on log management from Anton Chuvakin in the above list.

• Azure-Sentinel

  37 4,271 10.0 Jupyter Notebook

  Cloud-native SIEM for intelligent security analytics for your entire enterprise.

  

Depending on whether this is up your alley either look for a MSSP/MDR/Managed BlaBla provider or head on to - https://github.com/splunk/security_content - https://www.elastic.co/guide/en/security/current/prebuilt-rules.html - https://github.com/mdecrevoisier/SIGMA-detection-rules - https://github.com/Azure/Azure-Sentinel to get an idea of what to look for. MITRE ATT&CK and the related DETT&CT should serve as an additional eye opener. Ah yes - forgot the bible on log management from Anton Chuvakin in the above list.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project