# \#siem
**URL:** https://taggartinstitute.org/tag/siem/36.md
[Latest](https://taggartinstitute.org/latest.md) · [Categories](https://taggartinstitute.org/categories.md) · [Tags](https://taggartinstitute.org/tags.md)
---
## [Wazuh 5.0 is looking great](https://taggartinstitute.org/t/wazuh-5-0-is-looking-great/758)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 1\
**Last updated:** [August 6, 2026, 4:27am UTC](https://taggartinstitute.org/t/wazuh-5-0-is-looking-great/758 "2026-08-06T04:27:54Z")
I’ve been poking at alternatives for Elastic for a number of use cases, including including in The Homelab Almanac. While it’s still in beta (some sources say August release), version 5.0 of Wazuh is a complete rebuild. …
---
## [I've had it with Elastic](https://taggartinstitute.org/t/ive-had-it-with-elastic/750)
**Author:** [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Replies:** 0\
**Last updated:** [July 9, 2026, 10:04pm UTC](https://taggartinstitute.org/t/ive-had-it-with-elastic/750 "2026-07-09T22:04:43Z")
After four days of fighting with trying to automate setup of Fleet, I think I might toss it out of the Almanac entirely. We’ll see. But I was informed that the documentation is now slop-heavy, and that tracks. Exhibit A…
---
## [Questions about IOC ingestion and at-scale comparison engine for enterprise SIEM using MISP](https://taggartinstitute.org/t/questions-about-ioc-ingestion-and-at-scale-comparison-engine-for-enterprise-siem-using-misp/204)
**Author:** [@HGB](https://taggartinstitute.org/u/HGB)\
**Replies:** 2\
**Last updated:** [March 4, 2026, 2:41pm UTC](https://taggartinstitute.org/t/questions-about-ioc-ingestion-and-at-scale-comparison-engine-for-enterprise-siem-using-misp/204 "2026-03-04T14:41:52Z")
I see a ton of companies just selling IOC feeds and there are quite a few free ones, but I rarely see anyone talking about how to actually use those feeds. Sure there are some that you can just feed into your firewall an…