Security analytics with Elastic
Marco Mancini · The Oberta in Open Access (Universitat Oberta de Catalunya) · 2019
The objectives of this project are: Analyse the current state of the art for the Elastic stack project in regard to its use for security analysis.Building a laboratory with both a functioning Elastic stack and live endpoints. To demonstrate current capabilities within different scenarios. The following scenarios will be covered to demonstrate which logs and functionalities of the Elastic stack can be useful for them: Ubuntu machine being infected by crypto miner. Ubuntu Server running apache being compromised through an exploit. Finally, I hope to produce an evaluation of the old and new modules of the Elastic stack when applied to an incident response context. Which include the SIEM, Machine Learning, watchers, dashboards, Timelion and Graph.