Elastic SIEM – Netwerk

SIEM: Onboarding WIndows Servers

This entry is part 19 of 24 in the series Threat Detection Engineering

Views: 8When integrating Windows servers into your Security Information and Event Management (SIEM) platform, selecting the right log sources is crucial for effective threat detection while maintaining optimal system performance. This comprehensive guide outlines the essential Windows event logs to collect, explains their security significance, and provides a ready-to-deploy PowerShell script for configuration.

(TryHackMe) Servidae: Log Analysis in ELK

by Bharath Narayanasamy

This entry is part 1 of 4 in the series TryHackMe

Views: 660Link to the TryHackMe Room; https://tryhackme.com/r/room/servidae Room Objectives: In this room, we will analyze the log data from a compromised workstation using the Kibana interface. Within this room’s tasks, we will explore the components of the Elastic (ELK) Stack and gain insights into the various search and filter functions available in Kibana. Our ultimate … Read more

Practical Threat Hunting using Elastic SIEM: Hunting for Stuxbot

by Bharath Narayanasamy

This entry is part 7 of 24 in the series Threat Detection Engineering

Views: 489Based on the INTRODUCTION TO THREAT HUNTING & HUNTING WITH ELASTIC module from HTB-Academy Hunting for Stuxbot The Stuxbot cybercrime group operates with a broad scope, seizing upon opportunities as they arise, without any specific targeting strategy – their motto seems to be anyone, anytime. The primary motivation behind their actions appears to be espionage … Read more

Elastic SIEM: Developing Dashboards & Visualization

by Bharath Narayanasamy

Views: 29Use case 1: Failed Logon Attempts (Disabled Users) Use case 2: Failed Logon Attempts (using Admin Accounts) Use case 3: Successful RDP Logon Related To Service Accounts Use case 4: Users Added Or Removed From A Local Group

SIEM Use cases

by Bharath Narayanasamy

Views: 21How To Build SIEM Use Cases Example SIEM Use cases Use case 1: Microsoft Build Engine Started By An Office Application A practical example using the Elastic stack as a SIEM solution to help understand how to map each of the use case points listed above. MSBuild, part of the Microsoft Build Engine, is … Read more