Alert Triage With Elastic

As a Security Operations Center (SOC) analyst, you aim to investigate alerts and escalate incidents with clear evidence to support your findings. In this guided-challenge room, you'll use Kibana (part of the Elastic Stack) to perform alert triage and initial investigations, analyzing suspicious activity on an IIS and Windows server. You’ll explore potential indicators of compromise (IoCs) and collect evidence by correlating events across multiple log sources to gain a deeper understanding of the attack.

Objectives

• Use Kibana to analyze common security logs
• Learn how to identify key indicators of compromise
• Correlate events across multiple log sources
• Uncover the breach through a series of SOC alerts

Prerequisites

• Check out Investigating with Elk 101 to build a foundation for working with the Elastic Stack
• Complete Logs Fundamentals to understand log structure and formatting
• Cover Windows Logging for SOC for an overview of important event IDs
• Go over Sysmon for event IDs to detect attacker activity

Machine Access

Click the Start Machine button below. Please give Elastic five minutes to start and access the dashboard with this link:

• https://LAB_WEB_URL.p.thmlabs.com/

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine