Hello, I am completely new to this topic and I have realised that it takes a lot of work to use Graylog sensibly. I am at that point:
I have an input stream via which my logs arrive.
I have done a few searches to find incorrect logins.
However, Graylog is much more powerful and I’m wondering if I really need to rebuild everything or if I can use what I’ve already built.
Example:
I would like to have a dashboard in which I can see how many faulty logins there were / are on the systems via ssh. Whether or not brute force attacks are taking place etc.
I know that everyone probably has something like this. But do you have to build it all yourself or can you use existing templates?