Spotting Threats with Elastic SIEM
summary
Elastic SIEM (Elasticsearch + Kibana + Elastic Agent using Beats and osquery via Fleet) is used to ingest telemetry and apply detection rules (a custom CSV blocklist rule plus 500+ built‑in rules) to detect a malware chain. The demo shows an alert when rundll32 resolves cdnverifypoint.net, a timeline tracing an Excel macro to a base64‑encoded EXE and 120 network events, correlation with firewall logs indicating likely data exfiltration, and isolation/network block of the host via the Elastic Agent. Basic detection capabilities are free, while advanced protections like ransomware and memory guards require paid features.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:45Introduction to Elastic SIEM
- 3:45SIEM Alerts
- 6:45Triggering an Alert
- 9:20Analysis of an exe Point
- 12:03Creating a New Investigation Case
- 14:25Adding Events to the Timeline
- 16:40Possible Data Exfiltration
- 19:00Executing Queries
- 23:43Conclusion
related talks
29mHunting and Stopping Threats with Elastic Security
45mAdvanced Security Operations with Elastic Security
44mBuild yourself an Elastic Threat Hunting and Monitoring SIEM
20mSIEM with Elastic – Insights for Security, Freedom for DevOp
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
40mLeveraging Suricata in the Enterprise: Shifting from Events to Insights
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
58mHunting Malware with Suricata Metadata