Currently, there are too few ways to monitor security issues in the current company. Security solutions such as NDR, IPS, and WAF exist, but since there is no SIEM, the log must be checked on the equipment one by one. Therefore, if an incident occurs, the infrastructure engineer has to be lucky enough to check the equipment's log.

I have a plan to build SIEM, write correlation rules, and link important events to opsgenie, slack, jira, etc. I have only used arcsight, but it is difficult to purchase arcsight due to current budget issues.

In addition to NDR, IPS, WAF, and other cloud logs such as AWS and GCP are also planned to be integrated to monitor, confirming that there are SIEMs such as sumologic, datadog, Splunk, and Log Rhythm.

The main targets to be monitored are IPS and IDS, and the correlation will be mainly Event Name and IP to create rules.

arcsight was very easy to create these rules, but do other logarithmic solutions provide this as well?

Elasticsearch was also used internally, so Elasticsearch first attempted to use it, but Elasticsearch was quick and useful in retrieving certain events, but it was impossible to trigger correlated rules.

Recently, x-pack has siem function, but I couldn't make the rules I wanted.

I want to trigger an alert when 2 events (B -> C) occur after 1 event (A -> B). Do most SIEMs basically provide this?

  • As you discovered, different SIEMs do things differently. What kind of an answer are you looking for? Have you looked up what each of your SIEMs you mention do? They all have demos.
    – schroeder
    May 14 '21 at 8:33
  • I want to create a correlation rule for IP from various base events like arcsight. If the following events come into Siem. If Event A, Event C is detected, I hope Event is triggered.
    – 김남진
    May 17 '21 at 0:07
  • { event: "eventA" srcip: "" dstip: "" } { event: "EventB" srcip: "" dstip: "" } { event: "EventB" srcip: "" dstip: "" }
    – 김남진
    May 17 '21 at 0:10
  • For example, if IDS events that detect a particular Exploit and events that detect Wget, I want to make it a rule to execute Wget commands due to Exploit.
    – 김남진
    May 17 '21 at 0:10
  • ELK and Opensource SIEM confirmation seem very difficult to make these correlation rules. How do correlation rules for IDS rules usually be made when using other SIEMs? I think SIEM aims to make it easier for SOC engineers to recognize by creating rules through various correlations from logs of heterogeneous equipment. If trigger on a single event that is not correlated with the above, it seems that there will be a problem where too many correlation rules occur.
    – 김남진
    May 17 '21 at 0:16

All SIEM solutions have different methods of dealing with logs when it comes to generating alerts and correlations. I can tell you about the Logrhythm (I am not affiliated, I just worked with it), they have a component in their Architecture which is called Artificial Intelligence Engine. They define their correlation methodology for different use cases via rule blocks.

If there are multiple rule blocks in one use case, all are executed as per the conditions of each rule block within the use case if it is met. Rules blocks can be configured in a sequence also


This is the simplest which only checks if the log was detected, which matches the filtering criteria set in use case.


If certain pattern of events reached a threshold this would execute. ( A source IP scanning more than 50 machines in 1 minute)

Unique Values:

If a field with in the logs has number of unique values and meets certain threshold. (10 unique usernames observed in authentication logs with in 1 minute)

Now each of the above rule blocks must match the following:

Observed : Log lines matching criteria was observed.

Not Observed Compound: This is checking for events in logs which were expected but didn't occur after a certain log line was observed before. This must be preceded with a log observed rule block.

(Example: Observed Rule Block: Service X was stopped, {check with in 5 minutes} Not Observed Compound: {Service X was restarted})

Now if the Analysis engine doesn't find "Service X was restarted" with in 5 minutes of the first log observed "Service X was stopped", it will trigger an alert.

In your case, If some one is using Logrhythm, I'd use two rule blocks for Type Log Observed with in a certain time period configured in a sequence.

Example: Log Observed (A -> B) AND {with in X time period} Log Observed {B -> C}

  • Thank you for answer. Logrhythm was considered, but Currently, language support for my country is difficult, so I cannot write. Thanks for the reply. Due to the current budget problem, I am not using SIEM, but I am trying to solve it with Sumologic.
    – 김남진
    Aug 4 '21 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.