A SOC could have multiple security operations centres which will need to glue different services
together, including services that produce Alerts – and part of that will be adding each alert to Elasticsearch programitcally. For example, via a REST API.
This is necessary to action, create or modify alerts that aren’t log-based or come from
alternate sources.
Description
A SOC could have multiple security operations centres which will need to glue different services together, including services that produce Alerts – and part of that will be adding each alert to Elasticsearch programitcally. For example, via a REST API.
This is necessary to action, create or modify alerts that aren’t log-based or come from alternate sources.