Exploring Windows Event Logs and Elastic Security for Incident Response

Tue, 31 Jan 2023 22:12:00 +0000

Elastic Security is incredibly useful for threat hunting especially with the success of tools like RockNSM and the HELK project. But what about hunting through old logs aided by detection tools that threat hunters use? How feasible is it to use Elastic Security if just want to stand it up the tool and throw some data at it? In this blog we we will explore how to take advantage of Elastic Security and the open source detection rules that are bundled in each release.

Security on wriotsec

Exploring Windows Event Logs and Elastic Security for Incident Response