WatchGuard Firebox Firewall Data in Graylog. The Illuminate content pack parses Fireware syslog, maps events to GIM, and surfaces IPS, GAV, and APT detections as network detections. Setup takes three steps. graylog.org/post/watchgu...
#Graylog #WatchGuard #SIEM

If you're running Suricata, you already have the data. The question is whether it's usable. Graylog's Suricata IDS/IPS Content Pack parses EVE JSON, normalizes it to GIM, and gives you a ready to use dashboard for alerts and more.
graylog.org/post/suricat...
#Graylog #Suricata #SIEM #NetworkSecurity