From the course: Complete Guide to Open Source Security

Unlock the full course today

Join today to access over 24,800 courses taught by industry experts.

Monitoring alerts with the ELK Stack

Monitoring alerts with the ELK Stack

From the course: Complete Guide to Open Source Security

Start my 1-month free trial Buy for my team

Monitoring alerts with the ELK Stack

“

- [Instructor] One of the more powerful monitoring capabilities in ELK Stack is alerts. From the homepage, we can select Security, Alerts and at the top right we can manage Rules. If we haven't loaded the predefined rules yet, we'll be asked whether we want to import them, which we will. And we'll install them all. We now have over 800 prebuilt rules installed, each of which can be enabled or disabled using the switch at the right of the alert. Let's search for SSH. And we'll take a look at the rule Potential SSH Password Guessing. In the right-hand pane, we're provided with a description of the alert and also its coding within the MITRE ATT&CK framework. In the right hand pane, we can see the query. In this case, we can see that the query is looking for a time span of three seconds and that it's looking for 10 attempts. Also note that this is focused on Linux hosts. We'd have to write a different query to check for brute force attacks against a Windows SSH system. In the lower…

Contents