Here, I'm going to write about building an Enterprise OSSIM/LogStash build out. This should include, but not be limited by:
To begin, I've desired on the following Data Flow:
Client End Point -> Local Geo Collection Point -> Central Collection Point -> Split to OSSIM and LogStash
-> LogStash -> ElasticSearch (Cluster) -> LogStash Front End
-> OSSIM Cluster
My build out will begin with the Elastic Search Cluster then work backwards to the client end points. I will then Tack on the LogStash Front End, and add OSSIM to the Central Collection Point.
Since the LogStash system can push data cleanly, the collection points will be based on LogStash - Alternate would be a SysLog forwarder.