• Login
    View Item 
    •   Repository Home
    • Electronic Theses and Dissertations
    • Published ETD Collection
    • View Item
    •   Repository Home
    • Electronic Theses and Dissertations
    • Published ETD Collection
    • View Item
    JavaScript is disabled for your browser. Some features of this site may not work without it.

    Developing an Adaptive Threat Hunting Solution: The Elasticsearch Stack

    Thumbnail
    View/Open
    DELGADO-THESIS-2018.pdf (3.909Mb)
    Date
    2018-05
    Author
    Delgado, Pablo
    Metadata
    Show full item record
    Abstract
    Organizations of all sizes are fighting the same security battles while attackers keep changing the threat landscape by developing new tools and targeting victim endpoints; however, their attack kill chain along with motives have not changed, as their attacks initialize the same way and their end goal is usually data exfiltration of Intellectual property, or credit card information. This thesis proposes and evaluates The Elasticsearch Stack solution (ELK), an enterprise-grade logging repository and search engine to provide active threat hunting in a Windows enterprise environment. The initial phases of this thesis focus on the data quality, unsupervised machine learning, and newly developed attack frameworks such as MITRE’s (ATT&CK) as prerequisites to developing the proposed solution. Lastly, by using publicly known Attack Kill Chain methodologies such as Mandiant’s, several attack use cases were developed and tested against the ELK stack to ensure that logging was adequate to cover most attack vectors.
    URI
    http://hdl.handle.net/10657/3108
    Collections
    • Published ETD Collection

    DSpace software copyright © 2002-2016  DuraSpace
    Contact Us | Send Feedback
    TDL
    Theme by 
    Atmire NV
     

     

    Browse

    All of DSpaceCommunities & CollectionsBy Issue DateAuthorsDepartmentsTitlesSubjectsThis CollectionBy Issue DateAuthorsDepartmentsTitlesSubjects

    My Account

    Login

    DSpace software copyright © 2002-2016  DuraSpace
    Contact Us | Send Feedback
    TDL
    Theme by 
    Atmire NV