Digital Forensics and Incident Response - Second Edition

Analyzing logs with Skadi

Incidents often involve multiple systems across an enterprise network. Correlating this activity is often very difficult without analyzing the event logs from multiple systems. This is where the previously discussed SIEM appliances are really helpful. Another option, if the SIEM is not preconfigured to ingest and analyze event logs, is the Skadi platform. This open source platform, available from GitHub at https://github.com/orlikoski/Skadi, is a group of applications and forensics installed on an Ubuntu 16.04 LTS server base image.

The primary tool that this chapter will focus on is the Elastic Stack that is included as part of the Skadi platform. The other major feature that Skadi offers is the ability to ingest ...