Integrating SO into Elastic Cloud SIEM.

[totallynotafed]

Hey,
We are looking at running a POC for a cloud Elastic SIEM. I'm wondering if anyone knows a way that we can query SO directly from the Elastic SIEM or dump all the SO data right into the cloud SIEM.
Any advice would be appreciated.

Thanks.

[dougburks]

You may be able to make that work, but we don't really support it. It's much easier to just use the Elastic components that are already built into Security Onion. We do have cloud images as well:
https://docs.securityonion.net/en/2.3/cloud-ami.html
https://docs.securityonion.net/en/2.3/cloud-azure.html