Skip to content
This repository has been archived by the owner on Nov 1, 2023. It is now read-only.

Enhancements #29

Closed
coleJ98 opened this issue Jul 4, 2019 · 1 comment
Closed

Enhancements #29

coleJ98 opened this issue Jul 4, 2019 · 1 comment
Labels
enhancement New feature or request

Comments

@coleJ98
Copy link

coleJ98 commented Jul 4, 2019

Hi,

This is a great guide! I would like to suggest using ELK stack version 7.1.1 with OpenDistro docker image instead. This is because the xpack security plugin is now free to community users! This is a really easy switch over with great benefits (you just have to rebuild the docker images and configure basic security). Benifits such as Transport layer TLS, HTTP layer TLS and role based authentication!

Also, Sysmon10 is released! I have not played much around with the new schema but EventId 22 can now log DNS on each endpoint! Something for the future improvements
@coleJ98 coleJ98 added the enhancement New feature or request label Jul 4, 2019
@coleJ98 coleJ98 changed the title [FeatureRequest] Using ELK stack 7.1.1 Enhancements Jul 4, 2019
@duncan-ncc
Copy link
Contributor

Hello,

We have been looking at OpenDistro and Elasticsearch basic to see which fits best with LME and should have a decision shortly.

Sysmon10 is already supported by LME and the documentation was changed to reflect this in commit 1201a9d

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@coleJ98 @duncan-ncc