Lab: Detect a brute-force attack with Elastic Security

What you will learn in this TP

• Produce ECS events
• Write a threshold rule
• Write an EQL rule
• Triage and investigate

Introduction #

What you will learn in this section

• Produce ECS events
• Write a threshold rule
• Write an EQL rule
• Triage and investigate

Context. An exposed server suffers login attempts. You write the rules detecting the burst of failures and the successful login that follows.

Prerequisites: the start-local lab from the previous lab, jq  ·  Estimated time: 40 min

Licence: this lab also works with the free Basic licence: threshold and EQL rules, alerts, timelines and cases are included. Only machine learning rules and notifications to external tools (Slack, Jira…) require a subscription or the trial.

Hands-on #

Guided steps, with their solution.

1. 1. Authentication events

   Why? Elastic Security rules rely on ECS: event.category, event.outcome, source.ip, user.name.

2. 2. A threshold rule

   Create a rule alerting above 10 failures from the same IP address.

3. 3. An EQL rule

   Why? A burst of failures followed by a success for the same account is far more serious than a burst alone: the EQL sequence expresses it directly.

4. 4. The alerts

   Wait one minute, then list the alerts produced.

5. 5. Triage and investigate

   In Security › Alerts, open the critical alert, examine the sequence in a timeline, add it to a case, then set the alert to "Acknowledged".

Difficulty level : ●●●○○ (3/5)