Aggregation of elastic stack instruments for collecting, storing and processing of security information and events

The paper suggests an approach to construction of the system for collecting, storing and processing of data and security events on the basis of aggregation of instruments provided by Elastic Stack. Basing on the analysis of the monitoring and incident management tasks for computer security and comparative analysis of existing technologies and architectural solutions the technical requirements for such systems are identified, and on their basis the architecture of the proposed solution is formed. The paper describes the developed system for data collecting, storing and analyzing for various components of information security systems. Results of experiments with the developed prototype are presented.