You have now seen a clear overview of the most important terminologies in threat hunting. So, let's build our threat-hunting platform. In the following sections, we will learn how to build a threat-hunting system by using open-source projects. In our hands-on guide, we will use one of the most promising solutions available—the ELK Stack. It includes three open-source projects, and is one of the most downloaded log management platforms nowadays.
The ELK Stack is widely used in many fields, including:
- Business intelligence
- Web analytics
- Information security
- Compliance
The ELK Stack is composed of the following components:
- Elasticsearch: To search and analyze data
- Logstash: To collect and transform data
- Kibana: To visualize data
The following diagram illustrates the major components in the ELK Stack:
So, according to the main architecture...
