Security Incident and Event Management (SIEM) with ELK Stack

Description

I deployed an AWS OpenSearch domain and configured Logstash to ingest CloudTrail logs from S3. In Kibana I created index patterns and custom dashboards to visualize security events. I enabled prebuilt detection rules to catch suspicious activity and set up real‑time alerts to notify the team of potential threats. This scalable SIEM solution boosted visibility and sped up incident response.

Utilities Used

• AWS OpenSearch Service
• Amazon S3
• AWS CloudTrail
• AWS EC2
• AWS IAM roles and security groups
• Logstash
• Kibana

Project Walk-through

Set up CloudTrail to S3


Create OpenSearch domain


Launch EC2 and install Logstash


Define index patterns in Kibana



Enable detection rules


Configure real‑time alerts