Skip to content

Commit 4d4ff40

Browse files
Update _posts/2025-03-05-OpenSearch-as-a-SIEM-Solution.md
Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: DattellConsulting <[email protected]>
1 parent 1acb9ee commit 4d4ff40

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

_posts/2025-03-05-OpenSearch-as-a-SIEM-Solution.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ OpenSearch's search capabilities also enable ad hoc log analysis and threat hunt
5858
### <u>Event correlation</u>
5959
OpenSearch can also perform cross-source event correlation. Even outside of the automated correlation engine for alerts, an analyst can manually cross-correlate by querying for related identifiers. For instance, after spotting an unusual login in authentication logs, an analyst might search the VPN logs and DNS logs for the same user or IP address around that time. This process is facilitated by the SIEM having all logs indexed in one system.
6060

61-
OpenSearchs ability to search multiple indices and correlate events from different data sources helps analysts identify the root cause of an incident. If a security incident involved data exfiltration, an analyst could correlate VPN access logs, server file access logs, and external network traffic logs to see exactly what was accessed and where it was sent.
61+
OpenSearch's ability to search multiple indexes and correlate events from different data sources helps analysts identify the root cause of an incident. If a security incident involved data exfiltration, an analyst could correlate VPN access logs, server file access logs, and external network traffic logs to see exactly what was accessed and where it was sent.
6262

6363

6464

0 commit comments

Comments
 (0)