SIEM and MDR
Garrison polls your SIEM for alerts, groups related alerts into cases (same rule, source and asset within 15 minutes), enriches them and drafts a summary for an analyst. Garry can also query the SIEM directly when you ask, and hunts run against it.
| SIEM | Status |
|---|---|
| LevelBlue USM Anywhere (formerly AT&T Cybersecurity) | Available, tested in production |
| Elastic Security (Elastic Cloud or self-managed) | Available, tested in production |
| Splunk, Microsoft Sentinel, IBM QRadar, LogRhythm | Planned |
Connect
Section titled “Connect”Open Connections → SIEMs and click Connect a SIEM. The wizard has four steps:
-
Choose the SIEM.
-
Credentials: a name for the connection in Garrison, and the SIEM’s details (below).
-
Test: Garrison signs in and reads recent alerts. Nothing is saved until the test passes.
-
Configure what to bring in:
Setting Default Severity floor Low and above Ignore alerts below this severity Skip building-block alerts On Low-level alerts that only feed other rules Skip suppressed alerts On Alerts the SIEM already marked suppressed or acknowledged Poll every 15 minutes Each poll overlaps the last by 5 minutes so late alerts are not missed
Credentials are encrypted on the appliance and never shown again. Garrison only reads from the SIEM.
LevelBlue USM Anywhere
Section titled “LevelBlue USM Anywhere”| Field | Where to find it |
|---|---|
| Instance URL | Your USM Anywhere address, for example https://yourcompany.alienvault.cloud |
| Client ID and Client secret | In USM Anywhere, create an API client (Settings → API Clients). Read access is enough |
Elastic Security
Section titled “Elastic Security”| Field | Where to find it |
|---|---|
| Elasticsearch URL | For example https://elastic.example.internal:9200, or your Elastic Cloud endpoint |
| API key | Base64-encoded API key with read access to the alert indices (.alerts-security*) |
| Kibana URL | Optional, for the state of detection rules |
| Verify TLS certificate | Turn off only for a lab cluster with a self-signed certificate |
After connecting
Section titled “After connecting”
Each connection shows its health, the last poll, how many alerts it has seen and turned into cases, and a Polling switch. Poll now pulls at once; Check tests the sign-in. If a SIEM fails repeatedly, Garrison opens a connector health case so it is not silently missed.
New cases appear under Cases. The SIEM’s own state is not changed: closing a case in Garrison does not close the alarm in the SIEM.