How To Setup ELK | Elastic Agents & Sysmon for Cybersecurity

[@medericburlet6097]

I deployed and installed ELK for my company recently! Would love to see more content on log monitoring and detection!

[@dilpreetkohli6630]

hey, do you have more resources for the same? I wanna learn this before I land for my job

[@natestoutrt]

This is exactly what I'm doing next week after classes end. Thanks!

[@funnyclips769]

Your energy was awesome throughout the video !!!!! Had great time

[@woaq4486]

Following this guide to install as well as others for config and detection development helped me land a job as a detections engineer. Great content as always!

[@javirebeld]

You have been dropping so much content recently, thanks man 🔥🔥

[@jjann54321]

Thanks John, great content as always! Maybe doing a demo on spinning up a SecurityOnion VM would be helpful for many of your "Blue Team" viewers.

[@edwardlenovo3240]

was going to say...Security Onion, preconfigured ELK SIEM, makes life way easier.

[@zytoe3910]

Yes please do this

[@berkderooij2046]

5:11 Bless you!

[@Diamond_Chocobo]

i finished the Lab!! Thanks Super fun! in the discover section of Kabana,... thank you for showing us that filter section,... it reminds me of the filter section in Wireshark in order to reduce the number of network packets in the PCAP file,... in this case your using a filter to reduce the number of documents in order to make it easier to scan for what your looking for. i learned many things so far! like you cant add policies to an agent,... but you can add agents to a policy! GOOD STUFF!!

[@Zevilon05]

Since some of this relates, I would love to see you do a full video on Security Onion. It there isn’t much coverage on it.

[@AndreaKim312]

BHIS/Antisyphon/WWHF are AWESOME!!! I'M A HUGE FAN.

[@bangbinbash]

Aahh! Was literally just doing this on my own a week ago, perfect timing!

[@Raima888s]

Thanks for the video. Helping our Siem group understand these tools in security onion.

[@onemoreguyonline7878]

It's fun to see the setup of a platform that I've used before.

[@ReligionAndMaterialismDebunked]

That sneeze zoom. Hahahaha. Creative! :3 🎉😂💀😅🔥🤡🤝😁🔥🔥😎

[@tametov]

This content is brilliant.

[@Xmpzl19]

more content on log monitoring and detection plz

[@darkfro08]

Love the shirt. I rock the same one at the office.

[@djones0105]

Thank you, John! Very informative.

[@RoughGanome]

The ELK stack is awesome. But Splunk is king 👑. Great content! Keep up the great work.

[@FaLkraydz]

Is it realistic to start a business with the ELK Stack? Maybe use snort as well? Use 100% open source solution at least for the first couple years and then cut over?

[@BabyPowder013]

You are awesome!

[@rodetzky9833]

Love your videos!!!

[@toptechtowing6340]

Omgggg I want that shirt !!!

[@freem4nn129]

Love the shirt John :D

[@cybr774]

Wazuh is almost the same right? I heard that it uses the ELK stack

[@bradfoster4198]

Thanks John! Question : this seems to all hinge upon sysmon which is not installed by default in Windows. Is the idea here than an org would rollout sysmon widespread as a logging agent for company workstations?

[@jjones503]

Is there a way to self host elastic or something similar, $95 a month is a bit steep.

[@elisehackmann-tf6xg]

Please make more videos about Elastic! like setting rules for alerts or how to integrate with EDR, IPS or Firewall or Antivirus. Would really be nice

[@bluxombie]

That would be nice. Rules and alerts are pretty simple. Hopefully he will do something like that for you all. If you're looking at pulling firewall etc. I recommend looking at using filebeat or set up agent and deploy that on your host. That'll give you out of the box parsing and kibana dashboards from the get go for that or syslog, or f5, or whatever module you enable. There's pros and cons to both, and while I prefer to use beats for certain reasons, agent can be great. Especially when you have a lot of hosts and want to use fleet to manage everything. While beats are more flexible to the user, fleet agent makes more sense in large environments. We can use integrations of the left menu as well, add and manage right there in kibana if you don't like going in the terminal. Pretty much exactly how he added is how you add any integration. Some of course require certain information such as the the email integration. Are there any areas that are of particular problems you need help with?

[@JoshuaDiamente]

Hi John, thanks for your videos. Quick question: In terms of security and spying, is it better to dual boot a Kali distro or run it in a VM? I'm almost certain windows can spy on the VM through virtual box software but I'm wondering if a dual boot would be any more secure considering I'm running an AMD system and realistically there would be a backdoor some where. Would love to hear your thoughts. Thanks in advance!

[@rishabhshrivastava1870]

I have deployed a website using devsecops methodology, I want to use elk for the last stage i.e monitoring. What are the steps to integrate?

[@DeadlyDragon_]

John I wish to introduce you to Wazuh, which is backed by opensearch and kibana and has an agent that runs on each host. Saves you from having to do this all yourself!

[@muhamadfachri6122]

How can John get the 150 day trial?

[@rahulramteke3338]

Can you do a full course here on YT on Kali Purple?

[@sifedinebibi4467]

Could you kindly provide us with a video for SIEM Splunk Enterprise? We appreciate all the efforts you have made thus far. Thank you.

[@MurtazaSalman-v2k]

Do a video on Security Onion

[@Lampe2020]

5:10 That wasn't worth the warning. I thought a loud beep would happen but that sneeze was not loud at all. I sneeze much louder, kinda like my stepgrandfather did.

[@guitargrin]

I too like typing CD over and over😂

[@bluesquare23]

I use kibana at work. It's okay. I kinda like just raw log reading better. But the elk stack has its place.

[@codingdude8782]

bless you

[@bhaveshkathore3746]

How can I get syslog ?? Please comments

[@AlfredNobel-u1u]

[Y/n] already means yes by default!

[@maximilian5859]

Honestly I don’t know why Logstash is still a thing. Even elastic pushes the Agent so much and with all the integrations it is possible to send most of the logs directly without Logstash. It could be useful when a lot of data needs to be parsed and you won’t pay the CPU usage in the cloud

[@garbagetrash2938]

I could’ve used this a month ago 😭😭😭😭 I just set my home instance up.

[@DANNOS1993]

-n is for network

[@Stopinvadingmyhardware]

Seeing Bash commands on Windows still bothers me

[@wintermute111]

You know that [Y/n] Yes is default option and hitting enter will assume Y? (it's quite common in Linux)

[@tyrojames9937]

👍🏾

[@bluesquare23]

Takes John Hammond 14 minutes to do this. Took me many hours :(

[@charlescabage730]

Video spree

[@WaseemLaghari]

5:11 say Alhamdulillah

[@ReligionAndMaterialismDebunked]

Early :3

[@Pik92]

why is your windows user called adhd ...

[@isaaclakra382]

elastic cloud after 14 days trial ......WE have to DELETE this lab after 14 days...

[@JosueHernandez-nj9bc]

Cloud is never free host it locally or use linode for the cheap

[@JHORAMCANOYNARSICO]

way pulos

[@malachie4tabernacle523]

you talk too fast. can you slow down for us to follow you