A directive conversion tool that reads OSSIM XML directive file and translate it to Dsiem JSON-style config.Loose coupling also means that it's possible to use Dsiem as an OSSIM-style correlation engine with non ELK stack if needed. Loosely coupled, designed to be composable with other infrastructure platform, and doesn't try to do everything.Builtin rate and back-pressure control, set the minimum and maximum events/second (EPS) received from Logstash depending on your hardware capacity and acceptable delays in event processing.Instrumentation supported through Metricbeat and/or Elastic APM server.Support for other sources can easily be implemented as plugins. Builtin support for Arkime Wise (which supports Alienvault OTX and others) and Nessus CSV exports. Alarms enrichment with data from threat intel and vulnerability information sources.OSSIM-style correlation and directive rules, bridging easier transition from OSSIM.

Along with ELK, this made the entire SIEM platform horizontally scalable. Runs in standalone or clustered mode with NATS as messaging bus between frontend and backend nodes.

Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system.ĭsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, and produces risk-adjusted alarms.

Ossim otx