elastic-security

This repository (lesson) is strictly for educational, research, and defensive purposes only. CRITICAL NOTE: This is a SAFE SIMULATION designed to teach defensive concepts. The code is not intended to be, and should never be used as, a functional offensive tool or weapon.

Self-hosted SIEM & XDR for your home network. Elastic Stack + Docker Compose + Raspberry Pi. Endpoint detection, syslog ingestion, optional local LLM.

Next.js dashboard powered by Elasticsearch and Redux for analytics. Visualize channel performance, top channels, and more with dynamic charts and data insights for setup box.

Hands-on detection engineering portfolio focused on behavior-based threat detection, EQL, and real-world attack analysis

Detection engineering lab with Wazuh, Windows/Sysmon, Elastic/KQL rules, ATT&CK mappings, and reproducible validation workflows.

Sigma detections for Windows, Linux and authentication telemetry, with an offline evaluator that proves each rule fires on its technique and stays silent on a benign baseline.

AstoraSOC is an open-source SOC and Incident Response platform for SIEM alert triage, case management, IOC intelligence, asset correlation, containment workflows, and professional reports

A complete purple team exercise covering controlled attack simulation, SIEM investigation, network forensics, detection engineering, MITRE ATT&CK mapping, IOC documentation, and supporting evidence. Includes Elastic Security and Splunk investigation workflows, Wireshark analysis, detection queries, attack artifacts, and defensive findings.

Automated Elastic Security SIEM/EDR infrastructure with TLS, Fleet orchestration, endpoint telemetry, ATT&CK-aligned detection, and Zeek integration. Website

Production-tested Elastic Security detection rules (ES|QL/KQL) with MITRE ATT&CK mappings, tuning guidance, and triage playbooks

Cross-platform detection rules library — 836 rules, 9 platforms, 152 MITRE ATT&CK techniques, ZERO single-platform gaps. Sigma · Elastic · Splunk · Sentinel · Wazuh · Carbon Black · CrowdStrike · SentinelOne · Falco

A self-built SOC detection lab: Microsoft Sentinel, Defender for Endpoint, and Elastic Security monitoring a live Active Directory attack range. Compares SIEM vs. EDR vs. AV coverage of MITRE ATT&CK techniques, with real phishing triage writeups, documented outage root-cause analysis, and one-command recovery automation.

Tutorial-guided Elastic SIEM home lab using Kali Linux, Elastic Agent, log analysis, dashboards, and a custom detection rule for nmap activity.

MITRE ATT&CK–aligned SOC lab using Elastic Security, Kibana, and Snort to detect six simulated attacker TTPs end-to-end.

All 24 major SIEM platforms researched and compared, with a real, verified Sigma-to-native-query converter for 6 of them.

Ingest GitHub Audit Logs into Elasticsearch without a GitHub Enterprise account. Real-time webhook-to-ECS transformation in Rust.

Phishing investigations and detection notes covering email analysis, IOC enrichment, Elastic Security, and MITRE ATT&CK.

SIEM security monitoring lab using Elastic Security to collect Linux logs, detect failed authentication activity, and investigate security alerts.

Operate Elastic Security as code with a safety-first CLI for security engineers.

A defensive range for MCP and AI-agent attacks: reproduce a published insecure default, then ship the detection.