elastic-security

This repository (lesson) is strictly for educational, research, and defensive purposes only. CRITICAL NOTE: This is a SAFE SIMULATION designed to teach defensive concepts. The code is not intended to be, and should never be used as, a functional offensive tool or weapon.

Self-hosted SIEM & XDR for your home network. Elastic Stack + Docker Compose + Raspberry Pi. Endpoint detection, syslog ingestion, optional local LLM.

Next.js dashboard powered by Elasticsearch and Redux for analytics. Visualize channel performance, top channels, and more with dynamic charts and data insights for setup box.

Hands-on detection engineering portfolio focused on behavior-based threat detection, EQL, and real-world attack analysis

Интерактивный Detection Codex: одна техника ATT&CK — три ракурса. Чем атакуют, какой след это оставляет в логах, как это выявить

AstoraSOC is an open-source SOC and Incident Response platform for SIEM alert triage, case management, IOC intelligence, asset correlation, containment workflows, and professional reports

Production-tested Elastic Security detection rules (ES|QL/KQL) with MITRE ATT&CK mappings, tuning guidance, and triage playbooks

Cross-platform detection rules library — 836 rules, 9 platforms, 152 MITRE ATT&CK techniques, ZERO single-platform gaps. Sigma · Elastic · Splunk · Sentinel · Wazuh · Carbon Black · CrowdStrike · SentinelOne · Falco

Tutorial-guided Elastic SIEM home lab using Kali Linux, Elastic Agent, log analysis, dashboards, and a custom detection rule for nmap activity.

All 24 major SIEM platforms researched and compared, with a real, verified Sigma-to-native-query converter for 6 of them.

MITRE ATT&CK–aligned SOC lab using Elastic Security, Kibana, and Snort to detect six simulated attacker TTPs end-to-end.

Ingest GitHub Audit Logs into Elasticsearch without a GitHub Enterprise account. Real-time webhook-to-ECS transformation in Rust.

Phishing investigations and detection notes covering email analysis, IOC enrichment, Elastic Security, and MITRE ATT&CK.

A defensive range for MCP and AI-agent attacks: reproduce a published insecure default, then ship the detection.

Customer-facing demo: real-time SQL injection detection with Elastic Security. Vulnerable PHP login app → Elastic Agent → ES|QL detection rule → High alert in ~60s.

A self-built SOC detection lab: Microsoft Sentinel, Defender for Endpoint, and Elastic Security monitoring a live Active Directory attack range. Compares SIEM vs. EDR vs. AV coverage of MITRE ATT&CK techniques, with real phishing triage writeups, documented outage root-cause analysis, and one-command recovery automation.

SIEM investigations, log analysis, and threat detection case studies using Splunk.

Detection-as-Code portfolio: version-controlled Sigma rules mapped to MITRE ATT&CK, validated in a home lab with Atomic Red Team, and shipped through CI/CD.