Elastic
9 posts tagged “Elastic”.
Solving real security problems using cross-project search
If you work in complex environment, the challenges facing security operations teams are probably not simple either. Asides from the finesse required to have good governance and good opsec at the same time, the features provided by our security stack don’t always match the regulatory and compliance constraints imposed upon security teams. Ultimately the fewer silos the security team has to work across, the better. Fewer silos provide a more holistic view of the threat landscape and lower cognitive demand on the analyst.
Read moreElastic workflow for Easy Intel
Here is an Elastic workflow that can be used to seamlessly ingest threat intelligence from our easy intel product into Elastic SIEM. If you haven’t heard of Elastic workflows yet, you should certainly check it out, it provides a way to automate common security tasks using simple primitives, right within Elastic SIEM. If you’re on Elastic 9.4+, you should be able to copypasta this into a workflow (keep in mind there will be data ingest costs if you are on serverless - you use this workflow and easy intel at your own risk).
Read moreUsing Elastic Observability as a status page app
Elastic synthetics is an observability solution that we use to measure all kinds of things that we do here at Threatbear. Specifically we use it to monitor whether a service that we provide is available, and it lets us know if it isn’t available (or down in geekspeak). If a system is available, by using Elastic observability, we can know how long a service has been available for as well as the qualitative aspects of the service we provide. For example we can get answers to questions such as “what is the 95th percentile of our latency in milliseconds” or “when does our staging certificate expire”.
Read moreHow to enable the Elastic Defend system extension in macOS Sequoia
If you’re trying to install Elastic Defend on macOS Sequoia, the system extension management screen in system preferences has been moved. Previously, as documented inElastic Defend Mac Troubleshootingit was in System Preferences under the “Privacy & Security” tab. In macOS Sequoia, they are now under the General tab. Step 1 - finding the extensions page If you’re on Sequoia, it is now under System Preferences under : General > Login Items & Extensions
Read moreRouterOS visibility using Elastic Security
xHaving visibility into host events gives you an insiders view to what is happening on a desktop or server. This information is the primary domain for detecting threats on endpoints, however this information isn’t always available or is not available at all for non general purpose operating systems. This article will give you a jumping off point to get logs of all kinds from RouterOS into Elastic using Elastic Agent
Read moreUsing Google Chat for Elastic Security Alerts
If you’re a fan of Google’s new spaces feature and want to have one less app to check you may be considering replacing Slack with Google Chat or Spaces. Here is how to configure an Elastic connector so that you can get alerts and notifications in Google Spaces : Add an incoming web-hook in the space that you want to receive notifications in. I recommend a dedicated space per environment so you can mute and better manage notifications
Read moreDetecting CVE-2021–41379 using EQL
Microsoft’s patch for https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379 was apparently done on a bumpy taxi ride and we now have an exploit that can do local privilege escalation with very few mitigations. If you use Elastic Agents on your fleet you can detect exploitation of this using the following EQL query. Please note that this is a work-in-progress (although due to the severity of this bug a noisy detection might be better than getting owned) :
Read moreDeploy Elastic Agent with Microsoft Intune
In my previous story I shared how any organisation can go from having zero security visibility to having a wealth of contextual information in less than a day. In this article I’m going to share a small Powershell script that can be used with any management tool to deploy Elastic Agent to a whole fleet of Windows systems. Using this tool an administrator can easily deploy Elastic Agent to 10 or 1000 systems without breaking a sweat!
Read moreFrom Zero to Visibility in record time
With Security context is critical ; to make a simple analogy there is a huge difference between your wife holding a bread-knife during the daytime is a very different situation to an intruder wielding that same knife in the dark of night. At Threatbear we help Aussie companies detect and respond to Cybersecurity threats and the workflow often goes like this : Install an Osquery fleet server ~1day Build the binaries and connect the endpoints ~1day+
Read more