Browse categories
English
$
USD
Connect to your AI
I will onboard any log source into elastic siem with ingest pipelines and ecs
Elastic SIEM engineer: detection rules, log pipelines, dashboards
I'm a SOC and detection engineer working every day in a 24/7 multi-client SOC (retail and fintech on AWS). I deploy and administer Elastic Security and Wazuh, from a single node to a multi-node cluste...
About this Gig
Logs arriving in Elastic as one unreadable message field? Or a source with no integration at all?
I onboard log sources into Elastic for a 24/7 SOC: Windows, Linux, firewalls, AWS, Microsoft 365, Cloudflare and web servers. I parse them properly so your dashboards and detection rules actually work.
What I do:
- Elastic Agent and Fleet integrations, Beats or Logstash
- Custom ingest pipelines: grok, dissect, JSON, date and GeoIP
- Mapping to the Elastic Common Schema (ECS)
- Index templates and lifecycle (ILM)
- Data quality checks: missing fields, mapping conflicts, silent sources
- Custom Python collectors for APIs with no integration, run as a hardened service
Sources I have onboarded: Windows event logs, Linux, firewalls, AWS CloudTrail, GuardDuty and VPC Flow Logs, Microsoft 365 and Entra ID, Cloudflare, nginx, EDR tools.
Message me with the source, a sample log line (sensitive data removed) and your Elastic version.
Destination Platform:
Other
Tools & Platforms:
Other
FAQ
What access do you need?
For an audit, a Kibana user with read access to rules and alerts is enough. To deploy rules, a role that can manage detection rules. I never need superuser access.
Which rule types do you write?
KQL query, EQL sequences for multi-step correlation, threshold, new terms, ES|QL and indicator match rules. Machine learning rules need a paid Elastic subscription.
Can you write rules for a specific threat?
Yes. Send me the technique, threat report or attack scenario and the logs you collect. I tell you first whether your data can detect it.
How do you measure the false positive reduction?
I compare alert counts per rule over the same period before and after tuning, and list every change I made, so you can verify the result yourself.
Do you also work with Wazuh?
Yes: custom Wazuh rules and decoders. Message me with your use case and I'll send a custom offer.
