Security information and event management

Security information and event management (SIEM) and search queries to look for specific answers from the ingested logs.

ELK

• Introduction
• Elastic stack

Splunk basics

• Introduction
• Components
• Navigation
• Adding data

Splunk incident handling

• Introduction
• I am really not batman
• Reconnaissance phase
• Exploitation phase
• Installation phase
• Action on objectives
• Command and control phase
• Weaponisation phase
• Delivery phase

Challenges

• Introduction
• ItsyBitsy
• Investigating with Splunk
• Benign

Boss of the SOC v2

• Introduction
• Data dive
• Web activity investigation
• Detecting SQL and XSS web application attacks
• USB attack investigation
• Investigating FTP