Build yourself an Elastic Threat Hunting and Monitoring SIEM
summary
Lab build uses Ubuntu 18.04 VM with Elasticsearch + Kibana, Logstash and Beats (packetbeat, filebeat); a GitHub build guide contains install commands and YAML configs. Packetbeat produces geo IPs and NetFlow graphs and shows ~9,000 DNS events with 11 sources and 7 destinations; host dashboard lists 4–5 enrolled machines and a spike of 200+ failed authentications suggesting brute force. EDR timeline and Fleet are present but EDR isn’t configured; VirusTotal and Talos lookups work in the UI.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker background
- 1:26Why build your own SIEM
- 3:53Elastic SIEM platform overview
- 6:40Network monitoring with Packetbeat
- 11:15Host and event log analysis
- 15:19Security alerts and endpoint activity
- 16:23Malware analysis and EDR demo
- 18:52Case management and triage
- 21:29Q&A: Search features and Splunk comparison
- 24:00Documentation and community impact
- 27:56Future learning goals and career path
- 32:27Q&A: Challenges with ELK stack deployment
- 43:39Closing remarks and Q&A wrap-up
related talks
30mSpotting Threats with Elastic SIEM
45mAdvanced Security Operations with Elastic Security
01h 05mPractical network defense at scale
29mDetection Engineering: Defending Networks with Purpose
20mSIEM with Elastic – Insights for Security, Freedom for DevOp
49mProtecting the Web at a scale using consul and Elk
27mCollect All the Data; Protect All the Things
35mHands-On ModSecurity and Logging