title: Elastic SIEM - alerting and correlation
body: <p>I was asked to do research, how can a very basic SIEM with Elastic Stack be build.
  I managed to set up stack with Elasticsearch, Kibana and Beats, but now: How can I write correlation rules, like: If someone failed to log in 10 times in last 3 mins - ALERT. Or if there is unusual activity of scanning ports (detect nmap activity) - ALERT. How can it be done? Using only free options.</p>