Security Onion and Elastic XDR

This video will showcase a Red and Blue team approach, ultimately bringing together a Purple team concept for accessing alerting capabilities between two different SIEM solutions. Security Onion is great!!! So is Elastic!!!
Hope you enjoy it!
#Security Onion
#Elastic
"Disclaimer"
I am not sponsored or employed by Security Onion or Elastic. I just like to tinker around and showcase the cool features that these two SIEM solutions offer.

[@kimhalavakoski5189]

Awesome video comparing SO and Elastic SIEM! How was your setup with doing this video, were you using them as 2 completely separate installations and separate agents(filebeat for SO and elastic agent for Elastic) running on your hosts?

[@cyberlabz]

Exactly! I used two totally different setups to show the pros and cons between the detection capabilities of both.

[@ktroberson1]

how did you setup the elastic fleet for the elastic agent in security onion?

[@cyberlabz]

The elastic agent is used with a completely different ELK stack. I've tried installing fleet server on security onion to incorporate elastic agent before but I've had several parsing issues when logs are sent to the index. Hopefully soon security onion will integrate the elastic agent into future builds.

[@cyberlabz]

I have a video that shows how to stand up your own elastic xdr stack

[@presianbg]

With the upcoming v2.4, Elastic Agent will be integrated in Security Onion!