Windows Events Attack Samples

🐠 Beats - Lightweight shippers for Elasticsearch & Logstash

Threat Hunting with ELK Workshop (InfoSecWorld 2017)

Universal Winlogbeat configuration

[DEPRECATED] Elastic Beats Input plugin for Graylog

Collector plugin for Graylog

Burnham Forensics ELK Deployment Files

writeup about sending Logstash data to Splunk using the HTTP Event Collector

Repository for custom applications that automate the downloading, installation, and running of various Beats into Vizion.ai Elasticsearch.

Ansible role to install winlogbeat for security monitoring.

Program to send logfiles to ELK using winlogbeat.

Graylog extractor for Microsoft Teams Rooms Devices

Materials and install for my talk about getting your ETL flow under Statistical Process Control

A lightweight SIEM solution using the ELK stack, Docker, Winlogbeat, and Sysmon for efficient log collection and analysis.

Install/Configure Elastic Winlogbeat through Chef

Integrated Windows endpoint log management (Docker + ELK(ElasticSearch, Logstash, Kibana) + Winlogbeat based)

Easy installation/update of Winlogbeat via Domain Controller and WinRM.

An Ansible role to install and configure Winlogbeat

Winlogbeat installation for Windows Event Collectors (WEFCs)

Visually diagrams Elasticsearch ingest pipelines using Python and Graphviz