SIEM with Elastic – Insights for Security, Freedom for DevOp
summary
German Edge Cloud runs a SIEM built on Elastic Cloud Enterprise with per-team Elasticsearch deployments that scale automatically and a central security deployment using cross-cluster search to apply and manage rules. Logging uses Elastic Agent and Fleet and Ansible automates onboarding. Current rollout covers more than 400 hosts across almost a dozen deployments with 120+ active detection rules; no confirmed breaches found, one notable alert traced to a customer AWS data transfer.
AI-written summary · about
chapters (16)
- 0:00Introduction to SIEM with Elastic
- 1:08Business impact of IT security
- 2:31Typical IT security challenges
- 3:56Why SIEM is essential
- 4:59Challenges at German Edge Cloud
- 6:27Elastic Cloud Enterprise foundation
- 7:31DevOps and security deployments
- 9:19Benefits for DevOps teams
- 10:24Current status and learnings
- 11:48Real-world security insights
- 12:31DevOps teams using Elastic more
- 13:14How to start a SIEM project
- 16:01Key considerations for SIEM
- 17:27Choosing the right SIEM system
- 18:29Balancing centralization and freedom
- 18:52Q&A session
related talks
30mSpotting Threats with Elastic SIEM
40mSIEM as Needed: Elasticsearch, Energy Logserver, Wazuh...
33mSecurity Logging Use Cases: Building an Open-Source SIEM
01h 05mPractical network defense at scale
45mAdvanced Security Operations with Elastic Security
50mProject DiSIEM
24mAnalytics-based investigation & automated response
44mBuild yourself an Elastic Threat Hunting and Monitoring SIEM