My requirement is to create SIEM reports for each one of our clients separately. Unfortunately we use one syslog datasource for a large portion of our clientbase, so the ESM isn't able to efficiently differentiate between device sources.
I looked into the ESM REST API for a solution but I need some clarification. Is there any way to query the ESM to give events based only on a custom "Host" parameter? Would querying the ESM API degrade performance, especially since we are receving a vast amount of events/logs per each device?
Is it safe to say that querying the ESM console itself would undergo the same performance issues as the REST API?
Thanks,
Alex
