I have experience with a couple of commercial SIEM solutions running on Security Operation Centers. I've been reading about companies using Splunk as SIEM. I'm a big fan of open source solutions and I found that the ELK Stack can do the same thing.
I'm trying to set up a ELK Stack to learn more about the technology and possibilities. I have some doubts about integrating syslog-ng with ELK. Is that really necessary?
I assume that the input to the ELK platform will be all syslogs and system events. All correlation, rules and processing happens within the ELK environment. Am I correct?
In terms of syslog, syslog-ng can record events to a DB instead of text files. Is DB a better way to integrate with Elasticsearch?
Thank you for your time and any help is welcome.