In this blog post, we will explore how a powerful language model by OpenAI can automate the and bridge the gap between human language questions and SIEM query language.
Transforming search sentences to query Elastic SIEM with OpenAI API
Category: Elasticsearch
Detecting the sudden appearance of events with ee-outliers and Elasticsearch
Recently, for our open-sourced ee-outliers framework, we released a new outlier model capable of detecting the sudden appearance of one or multiple field values of an Elasticsearch event. For example, this model could spot new TLDs that are suddenly being contacted (DNS/SSL) and communicating with C2 domains. It could also detect an executable that suddenly … Continue reading Detecting the sudden appearance of events with ee-outliers and Elasticsearch
Optimizing Elasticsearch for security log collection – part 1: reducing the number of shards
Nowadays, logs collection for security monitoring is about indexing, searching and datalakes; this is why at NVISO we use Elasticsearch for our threat hunting activities. Collecting, aggregating and searching data at a very high speed is challenging in big environment, especially when the flow is bigger than expected. At NVISO, we are constantly seeking for … Continue reading Optimizing Elasticsearch for security log collection – part 1: reducing the number of shards