Security analysts need speed, precision, and the right tools to investigate and respond to threats effectively. This interactive workshop is designed to give you practical experience with Elastic Security, equipping you with the workflows and techniques used by top security teams. From data navigation and visualization to alert triage, threat detection, and case management, you'll gain the skills to streamline investigations and improve response times.
Module 1: Data Navigation & Visualization
• Explore data using Elastic Common Schema (ECS) and free text search
• Build insightful security visualizations with Lens and prebuilt dashboards
• Use security dashboards and reporting to monitor activity
Module 2: Guided Investigation with Elastic
• Investigate alerts using prebuilt security dashboards
• Perform guided threat hunting with analytics on hosts, networks, and users
Module 3: Threat Detection & Investigation
• Triage alerts with Timeline, Event Analyzer, and Session Viewer
• Apply case management workflows for efficient incident response
Module 4: Dark Radiation Investigation
• Walk through a real-world attack scenario in a day-in-the-life analyst exercise
Prerequisites
• Eyes on Glass, Analyst Experience with Elastic Security or other SIEM Solutions
• An understanding of current security operations procedures
• An understanding of currently available data sources, desired integrations (other SIEM, SOAR)
Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS, and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries