Skip to content

Security Operations Centers Working Group documentation

Best practices

Security Operations Centers Working Group documentation

Introduction
What is a SOC?
Should I deploy a SOC?
Reference design
Threat Intelligence
Threat Intelligence
- MISP
  MISP
Data sources
Data sources
- Zeek
  Zeek
Messaging, Transport and Enrichment
Messaging, Transport and Enrichment
- Introduction
Enrichment Sources
Enrichment Sources
- Introduction
Storage
Storage
- Elasticsearch
  Elasticsearch
Visualisation
Visualisation
- Introduction
Alerting + Incident Response
Alerting + Incident Response
- Introduction
Other topics and materials
Other topics and materials
- Integrations
  Integrations
  - Introduction
  - MISP to Zeek
- Networking
  Networking
  - Introduction
  - Network layout and mirroring at CERN
- Glossary
- Resources

Best practices for Elasticsearch

There are several parameters that have to be taken into account while designing the layout of the elasticsearch service. Some hints are given in this section.