Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

My Bro The ELK - Obtaining Context From Security Events

Black Hat via YouTube

Overview

Save Big on Coursera Plus. 7,000+ courses at $160 off. Limited Time Only!
Explore a powerful open-source framework for automating security event analysis and incident response in this Black Hat conference talk. Learn how to integrate ELK (ElasticSearch, Kibana, and LogStash), Bro IDS, and community threat intelligence feeds to obtain business and security context from events in your environment. Discover techniques for collecting, storing, and visualizing data, as well as automating evidence collection for quicker response times. Gain insights into logging, live packing, Logstash configuration, Kibana visualization, threat intelligence integration, and the TARDIS Framework. Follow along as the speaker demonstrates practical applications of these tools and techniques, culminating in the release of an open-source framework designed to streamline security operations and enhance threat detection capabilities.

Syllabus

Intro
Overview
About Me
Security Architecture
Logging
Live Packing
Grow
Logs
Logstash
Kibana
The Data
Critical Stack
Bro Code
Threat Intelligence
Normalization
Conditional Filtering
Log Stash
GeoIP
Translate Plugin
Log Stash Output
GeoIP Map Output
Adding Context
TARDIS Framework
Visualization
Summary
Github

Taught by

Black Hat

Reviews

Start your review of My Bro The ELK - Obtaining Context From Security Events

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.