samueladam

This is the way I build cybersecurity opertions centers and ingest data for mining.

Every log structure is analyzed by hand. Every log structure data behaviour is verified with statistics by hand. Every log data is normalized by hand. Every parser is done by hand. Every log is documented and gets unit tests.

What has not gone through this process ends up in the "automatic extraction" bucket waiting to get human love.

April's fool or not, you may laugh at me. My L3 security analysts don't.

Yes, I extracted it from that post.

I wanted to save the reference. The context might be sometimes added by our peers like pc86.

See you next week at the EMEA confs!

I build SOCs where Splunk can be the SIEM and it is being very nice to work with.

It integrates an editor where you can convert query results to such visualizations. You could also integrate your custom viz made with JS libs (D3).

Entreprise Security is a Splunk paid app that provides a nice environment for SOC analysts.

Yes,you should give it a try, maybe through a docker image that will get you going quickly.

Splunk 8 has a dark theme.