Mastering Machine Learning for Penetration Testing

Threat hunting with the ELK Stack

You have now seen a clear overview of the most important terminologies in threat hunting. So, let's build our threat-hunting platform. In the following sections, we will learn how to build a threat-hunting system by using open-source projects. In our hands-on guide, we will use one of the most promising solutions available—the ELK Stack. It includes three open-source projects, and is one of the most downloaded log management platforms nowadays.

The ELK Stack is widely used in many fields, including:

• Business intelligence
• Web analytics
• Information security
• Compliance

The ELK Stack is composed of the following components:

• Elasticsearch: To search and analyze data
• Logstash: To collect and transform data