Advanced Security Operations with Elastic Security
summary
Shows a live demo on a Windows Server 2019 VM in GCP using packetbeat and winlogbeat plus Sysmon telemetry and the Elastic endpoint (Endgame) to detect a real malware sample that launches wscript and PowerShell and exfiltrates over DNS. Out‑of‑the‑box content includes about 130 detection rules and 23 machine learning jobs; a saved query becomes a custom rule, scheduled alerts (every five minutes) and Slack/ServiceNow actions are wired up, case timelines are created, and the detections reproduce and lead to actionable responses.
AI-written summary · about
chapters (5)
- 0:00Start
- 12:37run file integrity monitoring inside of kubernetes pods
- 31:26pick a default timeline
- 33:35alerting framework in cabana
- 42:26grabbing all the detection rules
related talks
30mSpotting Threats with Elastic SIEM
29mHunting and Stopping Threats with Elastic Security
29mDetection Engineering: Defending Networks with Purpose
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
44mBuild yourself an Elastic Threat Hunting and Monitoring SIEM
50mAutomating security monitoring
02mSecurity Operations & Threat Intelligence
35mHands-On ModSecurity and Logging