Elastic SIEM – Netwerk

(TryHackMe) Servidae: Log Analysis in ELK

This entry is part 1 of 4 in the series TryHackMe

Views: 50Link to the TryHackMe Room; https://tryhackme.com/r/room/servidae Room Objectives: In this room, we will analyze the log data from a compromised workstation using the Kibana interface. Within this room’s tasks, we will explore the components of the Elastic (ELK) Stack and gain insights into the various search and filter functions available in Kibana. Our ultimate … Read more

Practical Threat Hunting using Elastic SIEM: Hunting for Stuxbot

by Bharath Narayanasamy

This entry is part 11 of 23 in the series Threat Detection Engineering

Views: 218Based on the INTRODUCTION TO THREAT HUNTING & HUNTING WITH ELASTIC module from HTB-Academy Hunting for Stuxbot The Stuxbot cybercrime group operates with a broad scope, seizing upon opportunities as they arise, without any specific targeting strategy – their motto seems to be anyone, anytime. The primary motivation behind their actions appears to be espionage … Read more

Elastic SIEM: Developing Dashboards & Visualization

by Bharath Narayanasamy

Views: 27Use case 1: Failed Logon Attempts (Disabled Users) Use case 2: Failed Logon Attempts (using Admin Accounts) Use case 3: Successful RDP Logon Related To Service Accounts Use case 4: Users Added Or Removed From A Local Group

SIEM Use cases

by Bharath Narayanasamy

Views: 18How To Build SIEM Use Cases Example SIEM Use cases Use case 1: Microsoft Build Engine Started By An Office Application A practical example using the Elastic stack as a SIEM solution to help understand how to map each of the use case points listed above. MSBuild, part of the Microsoft Build Engine, is … Read more