Be a Security Engineer With Elastic

مهدی میرسلطانی

امیرعلی بیگی

• متوسط
• مسیر آبی
• ۴ درس

درباره‌ی این دوره

این دوره به چه افرادی توصیه می‌شود؟

• علاقه‌مندان به حوزۀ امنیت سایبری و مدیریت حوادث امنیتی که می‌خواهند با ابزارهای مدرن مانند ELK Stack آشنا شوند.
• سازمان‌ها و شرکت‌هایی که به دنبال راه‌اندازی سیستم‌های SIEM هستند و به تحلیل و مدیریت لاگ‌های خود نیاز دارند.

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

• دانش پایه‌ای از شبکه و سیستم‌عامل‌ها (ویندوز و لینوکس)
• آشنایی با مفاهیم امنیت سایبری

• Introduction to Cybersecurity and SIEM Concepts
  • Understanding Cybersecurity and Cyber Defense
    • Introduction to cybersecurity
    • Importance of cyber defense
    • Basic concepts of MITRE ATT&CK framework
    • Exercise: Research and summarize a recent cyber attack and its defense strategies.
  • Introduction to SIEM and Its Purpose
    • What is SIEM?
    • Importance of SIEM in organizations
    • Key components of a SIEM solution
    • Exercise: Identify and list the key components required for a SIEM setup in your organization.
  • Basics of Log Collection
    • Data sources for log collection (Windows, Linux, network devices, firewalls)
    • Introduction to ELK stack (Elasticsearch, Logstash, Kibana)
    • Exercise: Set up a basic ELK stack on a local machine.
  • Introduction to MITRE ATT&CK and Data Sources
    • Detailed overview of MITRE ATT&CK
    • Identifying data sources relevant to MITRE ATT&CK
    • Exercise: Map organizational data sources to MITRE ATT&CK tactics and techniques.
• ELK Stack Installation and Configuration
  • Installing and Configuring ELK Stack
    • Step-by-step installation of Elasticsearch, Logstash, and Kibana
    • Basic configuration settings
    • Exercise: Install and configure ELK stack on a virtual machine.
  • Introduction to Beats and Log Collection
    • Types of Beats (Filebeat, Metricbeat, Auditbeat, Packetbeat)
    • Configuring Beats for log collection
    • Exercise: Set up Filebeat and Metricbeat to collect logs from a sample server.
  • ELK Cluster Setup
    • Importance of clustering in ELK
    • Setting up Elasticsearch cluster
    • Exercise: Configure a basic Elasticsearch cluster with multiple nodes.
  • Advanced ELK Features
    • New features in ELK 7 vs ELK 8
    • Introduction to ELK home lab setup
    • Exercise: Upgrade ELK stack from version 7 to version 8 in the home lab.
• Advanced Log Collection and Alerting
  • Advanced Beats Configuration
    • Detailed configuration of Auditbeat, Packetbeat
    • Collecting logs from Windows and Linux assets
    • Exercise: Set up Auditbeat and Packetbeat on a sample network.
  • Integrating Security Tools with ELK
    • Using Sysmon, Suricata, and Zeek with ELK
    • Configuring and visualizing security logs in Kibana
    • Exercise: Integrate Sysmon with ELK stack and create visualizations.
  • Setting Up Alerts and Dashboards in Kibana
    • Creating dashboards in Kibana
    • Configuring alerting rules
    • Exercise: Create a Kibana dashboard and set up alerting rules for specific events.
  • ELK Cluster Management and Maintenance
    • Managing and maintaining an ELK cluster
    • Best practices for ELK cluster health and performance
    • Exercise: Perform a health check on your ELK cluster and document the findings.
• Threat Analysis and Incident Response
  • Threat Detection and Analysis with ELK
    • Identifying and analyzing security threats using ELK
    • Creating and interpreting alerts
    • Exercise: Simulate a cyber attack and analyze the alerts generated.
  • Integrating ELK with Incident Response Tools
    • Using TheHive and Cortex with ELK
    • Automating incident response workflows
    • Exercise: Integrate TheHive with ELK and create an incident response workflow.
  • Advanced Threat Emulation and Detection
    • Using adversary emulators to test defenses
    • Setting up MISP for threat intelligence
    • Exercise: Set up MISP and use it to enrich ELK data.
  • Case Studies and Real-World Applications
    • Reviewing real-world case studies of ELK in cyber defense
    • Lessons learned and best practices
    • Exercise: Analyze a real-world incident using ELK and present findings.

گواهینامه‌ی دوره