Hunting and Stopping Threats with Elastic Security
summary
Elastic Security demonstrates a concrete investigation where Elastic Agent alerts from endpoints and firewall logs reveal a user running rundll32 from an Excel file that decodes Base64 into an EXE and repeatedly contacts cdnverify.net; correlating endpoint and firewall timelines shows data exfiltration beyond the perimeter. Detection is implemented with an indicator-match rule against a list (demo adds custom entries; the platform includes 600+ built-in detection rules), the endpoint policy can isolate a host, and snapshot-restore allows queries over years of archived (cold) data though a first cold query may take 5–10 minutes.
AI-written summary · about
chapters (9)
- 0:00Elastic Security intro
- 2:37Real-time alert detection
- 5:45Creating detection rules
- 10:42Security alert deep dive
- 15:23Isolating compromised machine
- 18:35Incident case management
- 20:22Log correlation for exfiltration
- 22:53Historical data investigation
- 26:05Conclusion
related talks
30mSpotting Threats with Elastic SIEM
45mAdvanced Security Operations with Elastic Security
41mMacOS Behavioral Detections using Apple Endpoint Security API
40mHunt and Gather: Developing Effective Threat Hunting Techniques
43mThreat hunting in the cloud
29mDetection Engineering: Defending Networks with Purpose
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce