Threat Hunting with Elastic Stack by Andrew Pease

Author:Andrew Pease
Language: eng
Format: epub
Publisher: Packt Publishing Pvt Ltd
Published: 2021-07-21T00:00:00+00:00

Data flow

Before we get started with data collection, it would be good to have a basic visualization to highlight the data flow for the Elastic Endpoint Agent, Beats, Elasticsearch, Kibana, and Fleet.

In the following diagram, you can see these flows:

The Elastic Endpoint Agent sends logs to Elasticsearch.

The Beats (we're using Winlogbeat and Packetbeat, but all Beats do this by default) send their logs to Elasticsearch.

Elasticsearch data is rendered by Kibana.

Kibana uses Fleet to send command-and-control instructions to the Elastic Endpoint Agent:

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.