Video summary

Elastic SIEM Crash Course | Free Course on Elastic SIEM | SOC Analyst

Main summary

Key takeaways

Educational

Main ideas / lessons conveyed

  • Elastic Stack (ELK) as a SIEM foundation

    • The Elastic Stack—Elasticsearch, Kibana, Logstash, Beats, Elastic Agent, and Fleet—is presented as an open-source platform for real-time log searching, analysis, and visualization.
    • The video frames it as a way to build your own SIEM, not just learn terminology.
    • Examples of organizations and security teams using it include BMW, Booking.com, the US Air Force, Slack, Barclays, and Cisco.

  • What each Elastic component does (conceptual breakdown)

    • Elasticsearch: core storage/indexing/search engine for logs (fast and scalable to terabytes).
    • Kibana: UI for querying, dashboards, and investigations.
    • Logstash: “data plumbing” to clean/transform/transfer logs from sources.
    • Beats: lightweight agents installed on endpoints (Windows/macOS/Linux) for collecting logs/data.
    • Elastic Agent: a universal agent for collecting multiple log/telemetry types centrally.
    • Fleet: management/control layer that deploys policies and manages agents through Fleet Server.

  • Workflow taught throughout

    • Install and configure Elastic components.
    • Configure remote access (network settings), encryption keys, firewall ports, and user credentials.
    • Use Kibana setup tokens/codes to complete initial cluster onboarding.
    • Use Fleet to add a Fleet Server, then add agents (Windows + Linux).
    • Simulate security scenarios:
      • SSH brute force
      • RDP brute force
      • Linux file integrity monitoring
    • Investigate results in Kibana Discover by pivoting across event fields to identify:
      • authentication failures
      • attacker IPs
      • process/service names
      • rule outcomes

Methodology / step-by-step instructions included

1) Install and bring up the Elastic Stack (ELK) on Ubuntu (high level)

Prerequisites

  • Use an Ubuntu server.

Installation steps

  • Update package lists:
    • apt update
  • Install Java (required for the stack).
  • Add the Elastic Stack repository:
    • Use wget to add repository/package source.
  • Install Elasticsearch
    • Start Elasticsearch and verify it is running (launch it, then check status).
  • Install Logstash
    • Start and verify status like Elasticsearch.
  • Install Kibana
    • Start and verify status like Logstash/Elasticsearch.

2) Enable remote access for Elasticsearch and Kibana

Elasticsearch configuration (YAML)

  • Edit config under /etc/elasticsearch
  • Uncomment network.host
    • Set to 0.0.0.0 (bind to all interfaces)
  • Uncomment/enable HTTP port 9200
  • Restart Elasticsearch after changes.

Kibana remote access configuration (YAML)

  • Edit Kibana config under Kibana’s config directory (shown as /etc/...)
  • Uncomment server host
    • Set to 0.0.0.0
  • Ensure server port 5601 is enabled
  • Restart Kibana.

3) Create encryption keys for Kibana

  • Go to Kibana binary directory (shown as .../usr/share/kibana/bin).
  • Generate an encryption key.
  • Add the required keys into the Kibana keystore (three keys mentioned).
  • Restart Kibana after keystore updates.

4) Open firewall ports and verify via browser

  • Allow ports:
    • 9200 (Elasticsearch)
    • 5601 (Kibana)
  • Verify access:
    • Visit the Elasticsearch endpoint via server IP + port 9200 over HTTPS.
    • Browser prompts for username/password.

5) Reset credentials for Kibana system user and elastic user

  • Use commands to reset passwords:
    • One command generates Kibana system user password.
    • Another resets/gives the elastic user password.
  • Use these credentials when logging into Kibana.

6) Complete Kibana/Elastic onboarding with registration token + verification code

  • Generate a registration token from the Elasticsearch bin directory.
  • Paste the registration token into Kibana setup.
  • Generate a one-time verification/confirmation code from the Kibana bin directory.
  • Finish onboarding to reach the ELK control panel.

Fleet Server and Agent deployment (Fleet-based methodology)

7) Add and configure a Fleet Server

  • In Kibana:
    • Go to Management → Fleet
    • Select Add new Fleet server
  • Configure:
    • Fleet server name (example: “hex security fleet server”)
    • Fleet server IP (Ubuntu machine IP)
    • Policy
      • Must use HTTPS
      • Runs on port 8220
  • On Ubuntu:
    • Copy and run Fleet Server install commands from Kibana UI.
    • Run step-by-step; start and register agent; confirm success.
  • Verify in Kibana:
    • Fleet server status shows connected/added
    • Fleet policy appears in agent/fleet sections.

8) Add a Windows Fleet Agent

  • In Kibana: Fleet → Add agent
  • Choose:
    • Policy name (example: “hex security windows policy”)
    • Platform: Windows
  • On Windows (via RDP):
    • Run PowerShell as administrator
    • Paste commands
    • Add "insecure" at the end of the last command (per instructions) to address certificate issues.
  • Verify in Kibana:
    • Windows agent appears connected and sends data.

9) Add a Linux (Debian-based) Fleet Agent

  • In Kibana: Fleet → Add agent
  • Create policy (example: “Ubuntu agent / Linux-based agent machine”)
  • Choose platform: Debian
  • On the Linux agent machine:
    • Run provided commands
    • If certificate issues occur, add insecure as instructed.
  • Verify:
    • Agent status is active
    • Agent appears in dashboards.

Attack simulations and how results are investigated

10) Simulate SSH password brute-force (Linux)

Additional components needed

  • An attacker machine (example: Ubuntu; Hydra referenced)
  • A target machine with a Fleet agent
  • A password dictionary file (example created with nano, e.g., password.txt)

Steps

  • Ensure Hydra is installed:
    • apt install hydra
  • Determine target IP:
    • ifconfig
  • Run Hydra:
    • hydra -l <username> -P password.txt <target_ip> ssh
  • Observe logs on the target:
    • tail -f /var/log/auth.log
  • Hydra causes failed/invalid login attempts (captured in auth.log such as connection closed/invalid user, etc.).

Investigate in Kibana

  • Go to Analytics → Discover
  • Build filters:
    • Event outcome = failure
    • Process/daemon = SSHD
  • Examine details:
    • agent name/type
    • outcome and event fields
    • log path (matches /var/log/auth.log)
    • usernames (including the brute-force username)

11) Simulate RDP brute-force on Windows

Additional components needed

  • Hydra on attacker machine
  • password.txt dictionary file
  • Target Windows IP

Steps (attacker-side)

  • Run Hydra:
    • hydra -l administrator -P password.txt <windows_ip> RDP

Confirm via Windows telemetry

  • Check Windows Event Viewer (Sysmon):
    • Microsoft → Windows → Sysmon → Operational
  • Visualize in Kibana:
    • Use Discover filtering for Windows Sysmon operational events:
      • filter by Sysmon operational log / win log channel
    • Filter by network connectivity:
      • Event ID 3 (network connection)
    • Filter by attacker/source IP
    • Filter by rule name:
      • RDP
  • Note: the speaker mentions correcting a conceptual query separator confusion (e.g., “equals” vs correct separator).

12) Examine file integrity / detect unauthorized file changes (auditd on Linux)

Purpose

Use auditd to detect:

  • unauthorized modification
  • file creation/changes
  • permission/owner changes

Differences from Sysmon (as described)

  • auditd is widely used with many integrations/rules, making it easier to set up with strong rule-based monitoring.

Steps to configure auditd

  • Install/verify auditd:
    • apt-get update
    • auditd packages (already installed in the example)
  • Enable and start:
    • systemctl enable auditd
    • start/check daemon status (active)
  • Verify audit logs are produced (depends on audit rules).
  • Create/modify audit rules:
    • Edit /etc/audit/audit.rules with nano

Example audit rule logic

  • Watch /etc/passwd
    • Add write monitoring:
      • -w /etc/passwd -p wa (W = write, A = attribute changes)
    • Attach rule key (example key name):
      • passwd_changes (speaker wording references similar naming)
  • Watch /etc/shadow similarly with another key (e.g., shadow_changes)

Apply changes

  • Restart auditd so rules take effect.

Simulate an unauthorized change

  • Add a malicious/new user entry to /etc/passwd (demo via echo/sudo command).

Validate on the Linux host

  • View logs live:
    • tail -f /var/log/audit/audit.log
  • Or query using ausearch by key:
    • ausearch -k <key>

Investigate in Kibana

  • In Discover, filter by auditd fields:
    • use auditd.log.key to filter by the rule key
  • Or filter by dataset:
    • auditd logs dataset
  • Expand events to view modified file and related metadata.

Key Kibana usage concepts emphasized

  • Discover
    • Explore raw logs/events.
    • Filter using:
      • event outcome (e.g., failure)
      • process/service names (e.g., SSHD)
      • Windows Sysmon operational log channel
      • event IDs (e.g., Event ID 3 for network connection)
      • source IP and usernames
      • rule names (e.g., RDP)
    • Use expandable details pages (multi-page view) to pivot across fields.
  • Dashboards / Canvas / Cards / visualization libraries
    • Briefly described as ways to build and visualize reports (less detailed than Discover).

Speakers / sources featured (as stated or implied)

Speakers

  • A single presenter/instructor (name not given in subtitles; repeatedly addressed as “Hello everyone” / “let’s begin”).

Tools / products / sources mentioned

  • Elastic Stack components: Elasticsearch, Kibana, Logstash, Beats, Elastic Agent, Fleet, Fleet Server
  • Attack tooling:
    • Hydra (SSH/RDP brute force)
  • Audit/telemetry tooling:
    • auditd (Linux file integrity/auditing)
    • Sysmon (Windows telemetry)
  • Attacker OS suggestion:
    • Kali Linux (optional)
  • Commands/tools mentioned in context:
    • apt, wget, ifconfig, nano, tail -f, ausearch, systemctl, and Windows RDP/PowerShell context

External individual authors/guests

  • No specific external individual authors or guests are explicitly identified beyond brand/tool references.

Original video