Elastic Security: SIEM, detection rules and investigation

1. Elastic Security #

SIEM and protection.

Scope #

Elastic Security combines a SIEM (detection and investigation on logs), endpoint protection (Elastic Defend, an Elastic Agent integration) and cloud security. Everything relies on ECS data: that is what lets one rule work on Windows, Linux or a firewall.

Licence #

Good to know: With the Basic licence, rule actions are limited to the Server log and Index connectors: alerts stay visible in Kibana, but notifying an external tool requires a subscription.

2. Detection rules #

Six families.

Rule types #

sequence by source.ip, user.name with maxspan=10m
  [authentication where event.outcome == "failure"]
  [authentication where event.outcome == "success"]

FROM logs-*
| WHERE event.category == "authentication" AND event.outcome == "failure"
| STATS echecs = COUNT(*) BY source.ip
| WHERE echecs > 20

Prebuilt rules #

Elastic maintains more than a thousand rules, mapped to MITRE ATT&CK tactics and techniques. Install them from Security › Rules, enable those matching the collected data, then add exceptions for legitimate noise.

Common mistake: Enabling every rule at once: most fail for lack of data or drown the team in false positives. Enable per data source, observe for a week, then tune.

Good to know: Each rule runs at a regular interval (interval) over a slightly wider window (from) so nothing is missed between runs.

3. Investigating #

Alerts, timelines, cases.

The handling cycle #

1. Triage alerts by severity and risk score; group by host or user.
2. Investigate in a timeline: events around the alert, process tree, EQL queries.
3. Track in a case: comments, attachments, export to a ticketing tool (connector).
4. Respond: isolate a host with Elastic Defend, add an exception, close the alert.

Depending on the version: the AI Assistant and Attack Discovery (grouping alerts into attacks) depend on version and licence; they require a connector to a language model.