# SIEM use case creation with Graylog

**URL:** <https://community.graylog.org/t/siem-use-case-creation-with-graylog/1175>\
**Category:** Graylog Add-ons\
**Created:** [May 18, 2017, 5:54am UTC](https://community.graylog.org/t/siem-use-case-creation-with-graylog/1175 "2017-05-18T05:54:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sathishdsgithub](https://avatars.discourse-cdn.com/v4/letter/s/dfb087/32.png) [@sathishdsgithub](https://community.graylog.org/u/sathishdsgithub)\
**Post date:** [May 18, 2017, 5:54am UTC](https://community.graylog.org/t/siem-use-case-creation-with-graylog/1175/1 "2017-05-18T05:54:21Z")

</div>

Hello all,

I would like to know the possibilities of creating SIEM use-cases with Gray log. I have specified some of the use-case names as shown below. We have created some alerts using the Aggregator plugin. However, there are some limitations using the aggregator plugin, we are able to create a query based on the source parameter.

Suppose if I want to create a use-case for “multiple sources trying to scan the single destination host on random ports” which is not possible with Aggregator plugin. Please let us know is there any plugins or options available for creating different SIEM use cases

TCP ACK Scan  
TCP ACK PUSH Scan  
TCP SYN SCAN  
TCP Connect Scan (Plain Vanilla)  
Ping Sweep  
Large DNS response  
Port Scan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 1, 2017, 5:54am UTC](https://community.graylog.org/t/siem-use-case-creation-with-graylog/1175/2 "2017-06-01T05:54:25Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.