ELK for Security Analysis by Chris Sanders

我很高兴地宣布 ELK 安全分析在线课程的发布！您将找到要遵循的课程说明。如果您想抓住坏人并找到邪恶，您必须掌握您的数据。但是，你怎么能这样做呢？这就是 ELK栈的用武之地。

ELK 是 Elasticsearch、Logstash 和 Kibana，它们共同提供了一个用于收集、存储和调查网络安全数据的框架。在本课程中，您将学习如何使用这个强大的三重奏来执行安全分析。这不仅仅是一门 ELK 课程，它还是一门关于如何专门为事件响应人员、网络安全监控分析师和其他安全蓝队人员使用 ELK 的课程。

您将学习以下基础知识：

Elasticsearch：如何存储和索引数据。处理 JSON 文档。
Logstash：如何收集和操作结构化和非结构化数据。
Kibana：搜索数据和构建有用的可视化和仪表板的技术。
Beats：使用代理将数据从端点和服务器传送到您的 ELK 系统。
我还将向您展示如何构建从摄取到搜索的完整数据管道。这意味着您将可以观看有关处理安全特定数据类型的分步指南，例如：

HTTP代理服务器记录
基于文件的日志（UNIX，身份验证和应用程序日志）
的Windows事件及SYSMON数据
NetFlow数据
IDS警报
与任何CSV文件，你手处理
解析非结构化日志，无论怎么怪是
当您从此走开当然，您应该具备构建完整的 IDS 警报控制台、调查平台或安全分析实验室所需的技能。

10 Hours | $497.00 | MP4 | 1152×720 | 518 kb/s | aac, 48000 Hz, 2 channels | 2 GB

I’m excited to announce the release of the ELK for Security Analysis online course! You’ll find the description of the course to follow. Registration is open now (with early bird pricing), and the course officially opens next month.

—

You must master your data If you want to catch bad guys and find evil. But, how can you do that? That’s where the ELK stack comes in.

ELK is Elasticsearch, Logstash, and Kibana and together they provide a framework for collecting, storing, and investigating network security data. In this course, you’ll learn how to use this powerful trio to perform security analysis. This isn’t just an ELK course, it’s a course on how to use ELK specifically for incident responders, network security monitoring analysts, and other security blue teamers.

You’ll learn the basics of:

Elasticsearch: How data is stored and indexed. Working with JSON documents.
Logstash: How to collect and manipulate structured and unstructured data.
Kibana: Techniques for searching data and building useful visualizations and dashboards.
Beats: Use the agent to ship data from endpoints and servers to your ELK systems.
I’ll also show you how to build complete data pipelines from ingest to search. This means you’ll get to watch step-by-step guides for dealing with security specific data types like:

HTTP Proxy Logs
File-Based Logs (Unix, auth, and application logs)
Windows Events & Sysmon Data
NetFlow Data
IDS Alerts
Dealing with any CSV file you’re handed
Parsing unstructured logs, no matter how weird they are
When you walk away from this course, you should be equipped with the skills you need to build a complete IDS alert console, investigation platform, or security analysis lab.