Windows logging, Sysmon, and ELK

Join us in the Black Hills InfoSec Discord server here:   / discord   to keep the security conversation going! Reach out to Black Hills Infosec if you need pentesting, threat hunting, ACTIVE SOC, incident response, or blue team services -- https://www.blackhillsinfosec.com/ 00:00 - Preshow Announcements 04:36 - Problem Statement and Executive Problem Statement 09:00 - Short Sysmon review, 13:02 - introduction to ELK, data type and its affect on elasticsearch, answering viewer questions 20:51 - Why Elk? Touching on different types of logs, how logstash deals with and imports logs into elasticsearch, Kibana, how to best use these programs 27:12 - Demonstration of HELK 48:34 - Touching base on Sigma, future plans for ELK, Q&A and closing thoughts Description: In this webcast, we cover how to get Windows events out of Windows into something more useful. And yes, there will be more griping about how bad Windows logging is. After our great sigh of disappointment, we will move on to how awesome Sysmon is. Then, we discuss how to get Sysmon into your ELK stack. We cover HELK (which is pretty awesome) and Winlogbeat. Which, for the record, is cool but possibly the worst named security tool of all time. I mean, it is like a reallllly bad rap name or something. Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-... Black Hills Infosec Socials Twitter:   / bhinfosecurity   Mastodon: https://infosec.exchange/@blackhillsi... LinkedIn:   / antisyphon-training   Discord:   / discord   Black Hills Infosec Shirts & Hoodies https://spearphish-general-store.mysh... Black Hills Infosec Services Active SOC: https://www.blackhillsinfosec.com/ser... Penetration Testing: https://www.blackhillsinfosec.com/ser... Incident Response: https://www.blackhillsinfosec.com/ser... Backdoors & Breaches - Incident Response Card Game Backdoors & Breaches: https://www.backdoorsandbreaches.com/ Play B&B Online: https://play.backdoorsandbreaches.com/ Antisyphon Training Pay What You Can: https://www.antisyphontraining.com/pa... Live Training: https://www.antisyphontraining.com/co... On Demand Training: https://www.antisyphontraining.com/on... Educational Infosec Content Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/ Wild West Hackin' Fest YouTube:    / wildwesthackinfest   Active Countermeasures YouTube:    / activecountermeasures   Antisyphon Training YouTube:    / antisyphontraining   Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com #bhis #infosec