Search
Elastic Stack (ELK) for SOC Log Investigations
4 min read

Elastic Stack (ELK) for SOC Log Investigations

Raúl Vázquez González's Picture
Raúl Vázquez González in elk elastic elastic-search elastic-stack tryhackme

Elastic Stack (ELK) for SOC Log Investigations

Essential ELK techniques for investigating and querying logs

In the world of cybersecurity, mastering log analysis is crucial for identifying malicious activity and ensuring system integrity. One of the most powerful tools for this task is the Elastic Stack (ELK), a set of open-source products that helps professionals search, analyze, and visualize log data in real time. In this article, we’ll walk through the tasks from the TryHackMe Elastic Stack: The Basics room, focusing on Tasks 4 and 5. These tasks are designed to teach essential techniques for investigating and querying logs, skills that are indispensable for any SOC analyst.

Task 4: Discover Tab

Question 1:
 Select the index vpn_connections and filter from 31st December 2021 to 2nd February 2022. How many hits are returned?

Process:

  • I navigated to the Discover tab and selected the index vpn_connections.
  • Then applied the date filter from 31st December 2021 to 2nd February 2022.

1_i0-Aj0mlbar9Mqb3_LePBg.png

Answer: 2861

Question 2:
 Which IP address has the maximum number of connections?

Process:

  • I checked the top 5 values of the Source IP address filter to determine which one had the most connections.

1_jYfS4SM6LFegUOS3KixsXg.png

Answer: 238.163.231.224

Question 3:
 Which user is responsible for the overall maximum traffic?

Process:

  • I checked the top 5 values of the UserName filter to identify the user with the highest volume of traffic.

1_z_8nB2Apnzo-hAD-4hC-Ag.png

Answer: James

Question 4:
 Apply filter on UserName “Emanda”; which SourceIP has max hits?

Process:

  • First I filtered the logs for the user “Emanda”.

1_pUV5hz92lNNC7v1P3wVpQA.png

  • Then, in the results, I checked the top 5 values of the Source IP filter.

1_gdaXmfL3zkcgiBvsNHAn2Q.png

Answer: 107.14.1.247

Question 5:
 On 11th January, which IP caused the spike observed in the time chart?

Process:

  • I filtered the results for 11th January using the time chart to identify the IP responsible for the traffic spike.

1_zPSqrNbYEfX4jUfpsrRz1A.png

  • Then, in the results, I checked the top 5 values of the Source IP filter.

1_E80CIJ0VSm_H8VXzquj5AA.png

Answer: 172.201.60.191

Question 6:
 How many connections were observed from IP 238.163.231.224, excluding the state of New York?

Process:

  • I first filtered by Source IP 238.163.231.224.

1_ssAIH-N_ISH2kUzicYfNOw.png

  • Then, in the results, I removed results including New York using the source_state field.

1_4JVd9Nxr8W9zPrRBIVCzYg.png

1_WO3vVMBZk7tk2ISoo9frgw.png

Answer: 48

Question 7:
 Create a table with the fields IP, UserName, Source_Country and save.

Process:

  • I used the table creation feature to include the desired fields.

1_nPmSM5dBWTYMxLcFBGOQsA.png

1_93erns8WgqVIYRZqq3N6wA.png

1_TjnAj2J98nwczTmGbiqGsw.png

1_MycY0fPooMatCqdc1Q1Jgw.png

1_0f0FL32ompvW4VWmd_dTWQ.png

Answer: No specific answer provided (this is an exercise in creating a table structure).

Task 5: KQL Overview

Question 1:
 Create a search query to filter the logs where Source_Country is United States and show logs from User James or Albert. How many records were returned?

Process:

  • I used KQL (Kibana Query Language) to search for logs:
Source_Country: "United States" AND UserName: "James" OR UserName: "Albert".

1_JCeuZ-Rmb_rQFV2wL5pbjg.png

AND & OR are case insensitive in KQL

Answer: 161

Question 2:
 As UserJohny Brown was terminated on 1st January 2022, create a search query to determine how many VPN connections were observed after his termination.

Process:

  • I did a query for logs where UserName = “Johnny Brown and the timestamp was after 1st January 2022.
UserName:"Johnny Brown" AND @timestamp > "2022-01-01T00:00:00"

1_jndf7JW-JLTcNMtUHf2NHg.png

Answer: 1

Conclusion

The Elastic Stack (ELK) is an invaluable tool for Security Operations Center (SOC) professionals, offering powerful capabilities for log analysis and investigation. By working through these TryHackMe tasks, we’ve covered fundamental skills like filtering log data, creating queries with Kibana Query Language (KQL), and identifying key metrics that can point to malicious activity. Mastering these skills not only enhances your ability to respond to security incidents but also builds a solid foundation for advanced log analysis techniques.

You may also like

Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
11 min read

Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night

Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration

Raúl Vázquez González's Picture
Raúl Vázquez González in ransomware threat-hunting splunk tryhackme aws
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
10 min read

Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance

A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence

Raúl Vázquez González's Picture
Raúl Vázquez González in soc-analyst splunk threat-hunting tryhackme
Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop
8 min read

Inside a Web Shell Attack: TryHackMe First Shift CTF — Task 5: Portal Drop

A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence

Raúl Vázquez González's Picture
Raúl Vázquez González in soc-analyst incident-response threat-hunting xdr tryhackme

Latest Posts

Building a Tier 1 SOC Dashboard in Splunk
9 min read

Building a Tier 1 SOC Dashboard in Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
7 min read

Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González

Explore Tags

active-directory allowlist aws azure-security blue-team bluetooth books brim btlo certification certifications chmod cloud-security compliance cyber-security-awareness cyberchef cybercrime cybersecurity cybersecurity-lab dashboards data-filtering data-protection ddos detection-engineering dfir dfir tryhackme digital-forensics elastic elastic-search elastic-stack elk ez-tools file-permissions firewall homelab incident-response infosec intrusion-detection kerberos linux-hardening linux-security log-analysis malware-analysis mitm mitre mitre-attck network-analysis network-forensics network-security networking networkminer nmap opencti osint packet-analysis pcap-analysis phishing powershell programming python ransomware regex security-audit siem snort soc soc-analyst soc-lab spl splunk sql sysmon threat-detection threat-hunting threat-intelligence tryhackme ufw virustotal volatility web-security windows-forensics wireshark xdr