Be a Security Engineer with Elastic

مهدی میرسلطانی

امیر علی‌بیگی

• متوسط
• مسیر آبی
• ۴ درس

دربارۀ این دوره

مخاطبان

• علاقه‌مندان به حوزۀ امنیت سایبری و مدیریت حوادث امنیتی که می‌خواهند با ابزارهای مدرن مانند ELK Stack آشنا شوند.
• سازمان‌ها و شرکت‌هایی که به دنبال راه‌اندازی سیستم‌های SIEM هستند و به تحلیل و مدیریت لاگ‌های خود نیاز دارند.

پیش‌نیازها

• دانش پایه‌ای از شبکه و سیستم‌عامل‌ها (ویندوز و لینوکس)
• آشنایی با مفاهیم امنیت سایبری

• Introduction to Cybersecurity and SIEM Concepts
  • Understanding Cybersecurity and Cyber Defense
    • Introduction to cybersecurity
    • Importance of cyber defense
    • Basic concepts of MITRE ATT&CK framework
    • Exercise: Research and summarize a recent cyber attack and its defense strategies.
  • Introduction to SIEM and Its Purpose
    • What is SIEM?
    • Importance of SIEM in organizations
    • Key components of a SIEM solution
    • Exercise: Identify and list the key components required for a SIEM setup in your organization.
  • Basics of Log Collection
    • Data sources for log collection (Windows, Linux, network devices, firewalls)
    • Introduction to ELK stack (Elasticsearch, Logstash, Kibana)
    • Exercise: Set up a basic ELK stack on a local machine.
  • Introduction to MITRE ATT&CK and Data Sources
    • Detailed overview of MITRE ATT&CK
    • Identifying data sources relevant to MITRE ATT&CK
    • Exercise: Map organizational data sources to MITRE ATT&CK tactics and techniques.
• ELK Stack Installation and Configuration
  • Installing and Configuring ELK Stack
    • Step-by-step installation of Elasticsearch, Logstash, and Kibana
    • Basic configuration settings
    • Exercise: Install and configure ELK stack on a virtual machine.
  • Introduction to Beats and Log Collection
    • Types of Beats (Filebeat, Metricbeat, Auditbeat, Packetbeat)
    • Configuring Beats for log collection
    • Exercise: Set up Filebeat and Metricbeat to collect logs from a sample server.
  • ELK Cluster Setup
    • Importance of clustering in ELK
    • Setting up Elasticsearch cluster
    • Exercise: Configure a basic Elasticsearch cluster with multiple nodes.
  • Advanced ELK Features
    • New features in ELK 7 vs ELK 8
    • Introduction to ELK home lab setup
    • Exercise: Upgrade ELK stack from version 7 to version 8 in the home lab.
• Advanced Log Collection and Alerting
  • Advanced Beats Configuration
    • Detailed configuration of Auditbeat, Packetbeat
    • Collecting logs from Windows and Linux assets
    • Exercise: Set up Auditbeat and Packetbeat on a sample network.
  • Integrating Security Tools with ELK
    • Using Sysmon, Suricata, and Zeek with ELK
    • Configuring and visualizing security logs in Kibana
    • Exercise: Integrate Sysmon with ELK stack and create visualizations.
  • Setting Up Alerts and Dashboards in Kibana
    • Creating dashboards in Kibana
    • Configuring alerting rules
    • Exercise: Create a Kibana dashboard and set up alerting rules for specific events.
  • ELK Cluster Management and Maintenance
    • Managing and maintaining an ELK cluster
    • Best practices for ELK cluster health and performance
    • Exercise: Perform a health check on your ELK cluster and document the findings.
• Advanced Threat Detection and Incident Response with ELK and Elastic XDR
  • Advanced Threat Detection Concepts
    • Enhancing threat detection with ELK and XDR
    • 1.2 Understanding Elastic XDR as an extension to traditional SIEMs
    • Identifying key differences between ELK-based threat detection and XDR capabilities
    • Exercise: Compare detection methods for lateral movement using ELK and Elastic XDR.
  • Configuring ELK and Elastic XDR for Threat Detection
    • Integrating Elastic XDR with ELK: Combining log data and endpoint telemetry
    • Creating custom detection rules in Kibana and Elastic XDR
    • Exercise: Design and implement a detection rule for identifying anomalous login behaviors.
  • Threat Hunting with ELK and Elastic XDR
    • Developing advanced query techniques in Kibana and XDR for threat hunting
    • Using Elastic Common Schema for standardizing log data analysis
    • Investigating security incidents with combined ELK and Elastic XDR timelines
    • Exercise: Conduct a hands-on threat-hunting session using real-world logs and simulated attack data.
  • Incident Analysis and Case Studies
    • Performing incident analysis with ELK and XDR visualizations
    • Mapping findings to MITRE ATT&CK tactics and techniques for detailed analysis
    • Reviewing real-world case studies where ELK and Elastic XDR were used together
    • Exercise: Analyze a multi-stage attack using combined data from ELK and Elastic XDR, and prepare a detailed report.

گواهینامه‌ی دوره