SIEM with Telegraf

To build a SIEM-like system using Telegraf, you'd want to focus on plugins that can collect security-relevant data from various sources. Here are the key Telegraf plugins that would be most useful:

Log Collection & Parsing:

• tail - Monitor log files (system logs, application logs, web server logs)
• syslog - Collect syslog messages from network devices and systems
• logparser - Parse and extract metrics from log entries using grok patterns
• win_eventlog - Collect Windows Event Logs (security, system, application events)

Network Security Monitoring:

• netstat - Monitor network connections and listening ports
• nfcapd - Collect NetFlow data for network traffic analysis
• snmp - Monitor network devices and collect security-relevant SNMP data
• dns_query - Monitor DNS resolution times and responses

System Security Metrics:

• processes - Monitor running processes for anomaly detection
• users - Track logged-in users and sessions
• filestat - Monitor file modifications, permissions, and access times
• linux_sysctl_fs - Monitor file system security parameters

Authentication & Access:

• fail2ban - Collect metrics from fail2ban for tracking blocked IPs
• apache/nginx - Web server metrics including access patterns and error rates
• postgresql/mysql - Database connection and query metrics for detecting suspicious activity

File Integrity & Monitoring:

• filecount - Monitor directories for file changes
• directory_monitor - Track directory modifications
• exec - Run custom scripts to collect security-specific metrics (like AIDE, OSSEC outputs)

Cloud & Container Security:

• docker - Monitor container metrics and events
• kubernetes - Collect K8s security events and metrics
• cloudwatch - AWS security and access metrics

The key is to send all this data to a time-series database like InfluxDB, then use Grafana for visualization and alerting. You'd also want to implement correlation rules and alerting logic either in Kapacitor (InfluxDB's processing engine) or external tools like ElastAlert for more complex SIEM-like functionality.

This setup won't have all of Splunk's advanced correlation and machine learning capabilities out of the box, but it provides a solid foundation for security monitoring and alerting.