While the ELK cluster is typically used for live monitoring, Winlogbeat can be tweaked to manually send "cold logs," or old, inactive Windows Event Logs (EVTX) to ELK manually. This functionality allows an analyst to take EVTX files from images of systems collected and utilize the functionality of the ELK stack for their investigations - … Continue reading Manually upload EVTX log files to ELK with Winlogbeat and PowerShell
In one of my prior posts, Monitoring CentOS Endpoints with Filebeat + ELK, I described the process of installing and configuring the Beats Data Shipper Filebeat on CentOS boxes. This process utilized custom Logstash filters, which require you to manually add these in to your Logstash pipeline and filter all Filebeat logs that way. But … Continue reading Using Default Filebeat Index Templates with Logstash
I recently learned about Distributed File Systems (DFS) and the benefits they could bring to an organization whose needs require redundant and highly available information across their systems. As part of a class project, I had to look into MooseFS, a fault-tolerant, network based DFS that can be mounted to virtual disks on client machines. … Continue reading MooseFS: Build and Installation Guide
Previously I had written a guide on Creating a Single-Node ELK Stack; covering what to do when you want create and utilize The Elastic Stack (also formally ELK) on a limited capacity, single-node basis. When assisting my roommate in creating an ELK stack of his own, I realized I had not yet described the process … Continue reading Creating a Multi-Node ELK Stack
In some of my previous posts regarding ELK, we have touched upon numerous ways of sending data from Windows endpoints - however not from much else. In the real world, thankfully, not everything runs off Microsoft's Operating System. Not to hit Microsoft in any way, but for anyone who has experienced systems administration in regards … Continue reading Monitoring CentOS Endpoints with Filebeat + ELK
The Elastic Stack (ELK) is an amazing index-searching tool, utilizing services such as Elasticsearch, Logstash, and Kibana to index and store logs and Beats Data Shippers such as Winlogbeat to ship them there. However, ELK can be just as scary, storing data from a plethora of different machines across one or more networks ripe for … Continue reading ELK + Beats: Securing Communication with Logstash by using SSL
As I conclude my senior year in college, one of the final cyber courses I'm taking began to tough upon the importance of Network Management Systems. These systems can be of importance for both Cybersecurity and Digital Forensic professionals; allowing the user to monitor a network with logs/alerts previously configured by an organization's IT department … Continue reading PandoraFMS: Build and Installation Guide
Burnham Forensics 