Book Image

Threat Hunting with Elastic Stack

By : Andrew Pease
5 (1)
Book Image

Threat Hunting with Elastic Stack

5 (1)
By: Andrew Pease

Overview of this book

Threat Hunting with Elastic Stack will show you how to make the best use of Elastic Security to provide optimal protection against cyber threats. With this book, security practitioners working with Kibana will be able to put their knowledge to work and detect malicious adversary activity within their contested network. You'll take a hands-on approach to learning the implementation and methodologies that will have you up and running in no time. Starting with the foundational parts of the Elastic Stack, you'll explore analytical models and how they support security response and finally leverage Elastic technology to perform defensive cyber operations. You’ll then cover threat intelligence analytical models, threat hunting concepts and methodologies, and how to leverage them in cyber operations. After you’ve mastered the basics, you’ll apply the knowledge you've gained to build and configure your own Elastic Stack, upload data, and explore that data directly as well as by using the built-in tools in the Kibana app to hunt for nefarious activities. By the end of this book, you'll be able to build an Elastic Stack for self-training or to monitor your own network and/or assets and use Kibana to monitor and hunt for adversaries within your network.

Related Content you might be interested in

Current Title:

Small book image
Threat Hunting with Elastic Stack
Andrew Pease
Jul, 2021 | 392 pages
Small book image
Getting Started with Elastic Stack 8.0
Asjad Athick
Mar, 2022 | 474 pages
Small book image
Practical Threat Detection Engineering
Gary J Katz | Megan Roddie | Jason Deyalsingh
Jul, 2023 | 328 pages
Small book image
The Foundations of Threat Hunting
William Copeland | Jeremy Thompson | Chad Maurice
Jun, 2022 | 246 pages
Table of Contents (18 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Code in Action
Download the color images
Conventions used
Get in touch
Share Your Thoughts
1
Section 1: Introduction to Threat Hunting, Analytical Models, and Hunting Methodologies
Section 1: Introduction to Threat Hunting, Analytical Models, and Hunting Methodologies
Free Chapter
2
Chapter 1: Introduction to Cyber Threat Intelligence, Analytical Models, and Frameworks
Chapter 1: Introduction to Cyber Threat Intelligence, Analytical Models, and Frameworks
What is cyber threat intelligence?
The Intelligence Pipeline
The Lockheed Martin Cyber Kill Chain
MITRE's ATT&CK Matrices
The Diamond Model
Strategic, operational, and tactical intelligence
Summary
Questions
Further reading
3
Chapter 2: Hunting Concepts, Methodologies, and Techniques
Chapter 2: Hunting Concepts, Methodologies, and Techniques
Introducing threat hunting
The Pyramid of Pain
Profiling data
Expected data
Missing data
Data pattern of life
Indicators
The depreciation life cycle
Summary
Questions
Further reading
4
Section 2: Leveraging the Elastic Stack for Collection and Analysis
Section 2: Leveraging the Elastic Stack for Collection and Analysis
5
Chapter 3: Introduction to the Elastic Stack
Chapter 3: Introduction to the Elastic Stack
Technical requirements
Introducing Logstash
Elasticsearch, the heart of the stack
Beats and Agents
Viewing Elasticsearch data with Kibana
Elastic solutions
Summary
Questions
Further reading
6
Chapter 4: Building Your Hunting Lab – Part 1
Chapter 4: Building Your Hunting Lab – Part 1
Technical requirements
Your lab architecture
Building an Elastic machine
Summary
Questions
7
Chapter 5: Building Your Hunting Lab – Part 2
Chapter 5: Building Your Hunting Lab – Part 2
Technical requirements
Installing and configuring Elasticsearch
Installing Elastic Agent
Installing and configuring Kibana
Enabling the detection engine and Fleet
Building a victim machine
Filebeat Threat Intel module
Summary
Questions
Further reading
8
Chapter 6: Data Collection with Beats and Elastic Agent
Chapter 6: Data Collection with Beats and Elastic Agent
Technical requirements
Data flow
Configuring Winlogbeat and Packetbeat
Configuring Sysmon for endpoint collection
Configuring Elastic Agent
Deploying Elastic Agent
Summary
Questions
Further reading
9
Chapter 7: Using Kibana to Explore and Visualize Data
Chapter 7: Using Kibana to Explore and Visualize Data
Technical requirements
The Discover app
Query languages
The Visualize app
The Dashboard app
Summary
Questions
Further reading
10
Chapter 8: The Elastic Security App
Chapter 8: The Elastic Security App
Technical requirements
The Elastic Security app overview
The detection engine
Hosts
Network
Timelines
Cases
Administration
Summary
Questions
Further reading
11
Section 3: Operationalizing Threat Hunting
Section 3: Operationalizing Threat Hunting
12
Chapter 9: Using Kibana to Pivot Through Data to Find Adversaries
Chapter 9: Using Kibana to Pivot Through Data to Find Adversaries
Technical requirements
Connecting events with a timeline
Using observations to perform targeted hunts
Generating tailored detection logic
Summary
Questions
Further reading
13
Chapter 10: Leveraging Hunting to Inform Operations
Chapter 10: Leveraging Hunting to Inform Operations
Technical requirements
An overview of incident response
Using threat hunting information to assist IR
Prioritizing improvements to the security posture
Using external information to drive hunting techniques
Summary
Questions
Further reading
14
Chapter 11: Enriching Data to Make Intelligence
Chapter 11: Enriching Data to Make Intelligence
Technical requirements
Enhancing analysis with open source tools
Enriching events with third-party tools
Enrichments within Elastic
Summary
Questions
Further reading
15
Chapter 12: Sharing Information and Analysis
Chapter 12: Sharing Information and Analysis
Technical requirements
The Elastic Common Schema
Importing and exporting Kibana saved objects
Developing and contributing detection logic
Summary
Questions
Further reading
16
Assessments
Assessments
Chapter 1 – Introduction to Cyber Threat Intelligence, Analytical Models, and Frameworks
Chapter 2 – Hunting Concepts, Methodologies, and Techniques
Chapter 3 – Introduction to the Elastic Stack
Chapter 4 – Building Your Hunting Lab – Part 1
Chapter 5 – Building Your Hunting Lab – Part 2
Chapter 6 – Data Collection with Beats and the Elastic Agent
Chapter 7 – Using Kibana to Explore and Visualize Data
Chapter 8 – The Elastic Security App
Chapter 9 – Using Kibana to Pivot through Data to Find Adversaries
Chapter 10 – Leveraging Hunting to Inform Operations
Chapter 11 – Enriching Data to Make Intelligence
Chapter 12 – Sharing Information and Analysis
Why subscribe?
17
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Share Your Thoughts

Chapter 1: Introduction to Cyber Threat Intelligence, Analytical Models, and Frameworks

Generally speaking, there are a few "shiny penny" terms in modern IT terminology – blockchain, artificial intelligence, and the dreaded single pane of glass are some classic examples. Cyber Threat Intelligence (CTI) and threat hunting are no different. While all of these terminologies are tremendously valuable, they are commonly used for figurative hand-waving by marketing and sales teams to procure a meeting with a C-suite. With that in mind, let's discuss what CTI and threat hunting are in practicality, versus as umbrella terms for all things security.

Through the rest of this book, we'll refer back to the theories and concepts that we will cover here. This chapter will focus a lot on critical thinking, reasoning processes, and analytical models; understanding these is paramount because threat hunting is not linear. It involves constant adaption with a live adversary on the other side of the keyboard. As hard as you are working to detect them, they are working just as hard to evade detection. As we'll discover as we progress through the book, knowledge is important, but being able to adapt to a rapidly changing scenario is crucial to success.

In this chapter, we'll go through the following topics:

  • What is cyber threat intelligence?
  • The Intelligence Pipeline
  • The Lockheed Martin Cyber Kill Chain
  • Mitre's ATT&CK Matrix
  • The Diamond Model
Previous Section
End of Section 1
Next Section