Oct 18Elastic Certified Analyst Certification | IntroductionI recently earned my Elastic Certified Analyst certification. This accomplishment has inspired me to share a comprehensive series of blogs to guide you through the journey of preparing for and passing this certification exam successfully. …Elastic3 min readElastic3 min read
Aug 28Logstash 101: how to use Logstash to read and parse your logs!Logstash is an ETL (Extract, Transform, Load) tool that automates data movement by extracting information from diverse sources, reshaping it, and loading it into a central repository for analysis and reporting, enhancing decision-making processes. Logstash, a powerful open-source data processing and ingestion tool, plays a pivotal role in the Elastic…Elastic Stack4 min readElastic Stack4 min read
Aug 15Elastic Detection Rule 101In this blog post, we embark on a journey to demystify the process of creating your very first detection rule. Whether you’re a seasoned security professional or someone taking their first steps into the world of cybersecurity, understanding how to craft effective detection rules is an invaluable skill. …Security Operation Center6 min readSecurity Operation Center6 min read
Jul 30Unveiling the Art of Threat Hunting: Exploring Subjective vs. Contextual Anomaly DetectionDefining every type of anomaly may not be straightforward, but we can identify some common ones. The anomalies you seek will depend on the specific activity under investigation and the evidence associated with it: Subject Anomalies: These are unexpected data points directly within the evidence that describe an action.Threat Hunting3 min readThreat Hunting3 min read
Jul 29Mastering Threat Hunting: Unveiling Cybersecurity’s Proactive DefenseWelcome to Threat Hunting, where we delve into the world of proactive cybersecurity to detect and neutralize potential threats before they can cause harm. …Threat Hunting5 min readThreat Hunting5 min read
Jul 27Enhancing Cybersecurity through Collective Intelligence: Exploring the Power of MISPMISP is an Open Source Threat Intelligence and Sharing Platform that enables the seamless exchange of threat intelligence, Indicators of Compromise (IoCs), and other intelligence among trusted members. …Threat Intelligence5 min readThreat Intelligence5 min read
Jul 23TheHive 5 Incident Management System: Enhancing Cybersecurity Resilience and CollaborationTheHive is a robust and feature-rich open-source Security Incident Response Platform (SIRP) that enables organizations to effectively manage and respond to security incidents. It acts as a central command center for security teams, facilitating collaboration, and coordination during incident investigations. The platform allows users to create and track cases, manage…Cybersecurity5 min readCybersecurity5 min read
Oct 31, 2022Network Monitoring for Threat HuntingWhat’s happening in our networks? If we don’t feel we have a handle on that question, we should enhance our network monitoring capabilities; or as we like to say “No Vision, No Security”. In this post, we will briefly discuss how we configure and use Zeek with the Elastic stack…4 min read4 min read
Oct 31, 2022How to Extract/Download Elasticsearch WatchersIf you’re using Elastic Stack for Security and/or Monitoring for sure you have heard (if you didn’t use it) about the Watchers. Watcher is an Elasticsearch feature that you can use to create actions based on conditions, which are periodically evaluated using queries on your data. Watches are helpful for…2 min read2 min read
Jan 2, 2021Elastic Watcher 101!Watcher, Elastic Alerting for beginner What is a Watcher? If you are Elastic’s user, in IT operations, or in information security, or a person who is keen on learning new technologies, you would have heard about the Alerting feature or Watcher in Elastic. So what exactly is Watcher Alerting or Watcher is The two sides of the same coin…Elastic Stack5 min readElastic Stack5 min read
