OpenSearch Security Analytics
Open source SIEM plugin for OpenSearch with native Sigma rule support and free alerting.
Technical Architecture & Overview
Security Analytics is the OpenSearch project SIEM plugin. It ships more than 2,200 prepackaged Sigma rules across common log sources, matches ingested log data against them, and provides detection rule management, a correlation engine, alerts, and dashboards. Because it runs inside OpenSearch, storage, retention, and clustering follow the platform rather than a separate SIEM license.
Targeted Technical Use Cases
AWS or self-hosted OpenSearch users adding threat detection without new vendor licensing.
Evaluation & Trade-offs
Core Strengths
- +Sigma-native rule pipeline.
- +Apache-2.0 licensed with no feature paywall.
- +Included with every OpenSearch distribution, including Amazon OpenSearch Service.
Trade-Offs & Limitations
- -Sources outside the standard log types need a custom log type.
- -Detectors depend on field mappings between log data and rule fields.
Defensive Security Application
Sigma-based detection and alerting over logs already collected in OpenSearch.
Frequently Asked Questions
What is OpenSearch Security Analytics?→
Security Analytics is the OpenSearch project SIEM plugin. It ships more than 2,200 prepackaged Sigma rules across common log sources, matches ingested log data against them, and provides detection rule management, a correlation engine, alerts, and dashboards. Because it runs inside OpenSearch, storage, retention, and clustering follow the platform rather than a separate SIEM license.
What is OpenSearch Security Analytics used for?→
AWS or self-hosted OpenSearch users adding threat detection without new vendor licensing.
What are the strengths of OpenSearch Security Analytics?→
- +Sigma-native rule pipeline.
- +Apache-2.0 licensed with no feature paywall.
- +Included with every OpenSearch distribution, including Amazon OpenSearch Service.
What are the limitations of OpenSearch Security Analytics?→
- +Sources outside the standard log types need a custom log type.
- +Detectors depend on field mappings between log data and rule fields.
How is OpenSearch Security Analytics used defensively?→
Sigma-based detection and alerting over logs already collected in OpenSearch.