Currently, there are too few ways to monitor security issues in the current company. Security solutions such as NDR, IPS, and WAF exist, but since there is no SIEM, the log must be checked on the equipment one by one. Therefore, if an incident occurs, the infrastructure engineer has to be lucky enough to check the equipment's log.
I have a plan to build SIEM, write correlation rules, and link important events to opsgenie, slack, jira, etc. I have only used arcsight, but it is difficult to purchase arcsight due to current budget issues.
In addition to NDR, IPS, WAF, and other cloud logs such as AWS and GCP are also planned to be integrated to monitor, confirming that there are SIEMs such as sumologic, datadog, Splunk, and Log Rhythm.
The main targets to be monitored are IPS and IDS, and the correlation will be mainly Event Name and IP to create rules.
arcsight was very easy to create these rules, but do other logarithmic solutions provide this as well?
Elasticsearch was also used internally, so Elasticsearch first attempted to use it, but Elasticsearch was quick and useful in retrieving certain events, but it was impossible to trigger correlated rules.
Recently, x-pack has siem function, but I couldn't make the rules I wanted.
I want to trigger an alert when 2 events (B -> C) occur after 1 event (A -> B). Do most SIEMs basically provide this?