Build a Powerful Home SIEM Lab Without Hassle! (Step by Step Guide)

Подписаться 160 тыс.

Просмотров 151 тыс.

50% 1

Welcome to your one-stop guide for building a Free valuable Home SIEM Lab quickly and efficiently! This tutorial will help aspiring SOC analysts get practical experience without having the job yet.
Get Ahead in Your Cybersecurity Career: Practical experience is key in the cybersecurity field. This video provides you with actionable skills and knowledge.🚀
📒 Show Notes 📒
Simple Home Siem Lab Blog: / a-simple-elastic-siem-lab
So You Want to Be A SOC Analyst Blog post:
blog.ecapuano.com/p/so-you-wa...
GET SOC ANALYST EXPERIENCE RU-vid VIDEO:
• Master SOC Analyst Ski...
Virtual Box Download
www.virtualbox.org/wiki/Downl...
Kali VM Download
www.kali.org/get-kali/#kali-p...
🚨 RESUME BULLETS: 🚨
Elastic Stack SIEM Configuration and Management: Successfully set up and configured Elastic Stack SIEM in a home lab environment. Demonstrated proficiency in deploying a Kali Linux VM, configuring Elastic Agents for log collection, and forwarding data to the SIEM for effective security event monitoring.
Security Event Simulation and Analysis: Acquired hands-on experience in generating and analyzing security events using Nmap on Kali Linux. Proficient in querying Elastic SIEM to identify and investigate security incidents, enhancing skills in network security monitoring and threat detection.
Visualization and Alerting in SIEM: Developed a custom dashboard in Elastic SIEM to visualize security events, demonstrating skills in data interpretation and pattern recognition. Successfully created and tested alert rules for detecting specific security events, showing competency in proactive incident response and alert management.
⏰ Markers
0:00 Preview
Simply Cyber's mission is to help purpose driven professionals make and and take a cybersecurity career further, faster.
📱 Social Media
Let's Connect: linktr.ee/SimplyCyber
🔥 The Best Free Cyber Resources
simplycyber.io/
📷 🎙 💡 MY STUDIO SETUP
kit.co/GeraldAuger/simply-cyb...
🙌🏼 Donate
Like the channel and got value? Please consider supporting the channel
www.buymeacoffee.com/SimplyCyber
😎 Merch 😎
👉🏼 Simply Cyber Branded Gear: www.simplycyber.io/store
Disclaimer: All content reflects the thoughts and opinions of Gerald Auger and the speakers themselves, and are not affiliated with the employer of those individuals unless explicitly stated.

Наука

Опубликовано:

11 янв 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 120

@Zikanshi-AG 6 месяцев назад

This is awesome. I initially thought building a SIEM was actually never possible as an entry level SOC analyst. Thank you

@levelupgoddess9289 3 месяца назад

I seriously need to start building my labs so I can get some “experience” under my belt. I need a tech job like yesterday.

@BJMolette Месяц назад

have you tried it?

@havoc_plays1935 25 дней назад

Me too

@socrayhte 4 месяца назад

As a newbie in the SOC pathway, This is amazingly so simple to follow. A capital THANK YOU to you!

@nerminzlatanovic4959 6 месяцев назад

This is amazing! I’m going to add this to my Home Lab. I am already using Elastic in my SOC Analyst course with HTB. Thank you Dr. Auger for creating this video and sharing it!

@johnvardy9559 4 месяца назад

How is going?

@valyntyno 6 месяцев назад

Probably the most concise, easy-to-follow home SOC lab setup I have seen so far. Kudos to Gerry Auger and to Abdullahi Ali for trying to make these highly marketable cybersecurity skills available to as many people as possible 🙏🏼

@SimplyCyber 6 месяцев назад

that was the goal so NAILED IT! thx for the comment.

@IoXxSekto36 6 месяцев назад

Loved the video definitely gonna do it when I get home and play with this one to. Thanks.

@jasonp3484 6 месяцев назад

Great video with actual walk through visual instruction. The speed was great too, just knowledge and no fluff. Thank you. Subscribed

@SimplyCyber 6 месяцев назад

The fluff videos kind of annoy me when I’m trying to get info so I’m not into it, despite the almighty algorithm

@TheReconstructionist-ok1yh 9 дней назад

I’m saving this vid for later but I just wanted to say thank you for putting my mind at ease with the intro. I was so overwhelmed just looking for a video that didn’t confuse me and told me exactly what I would be doing and how it would help me in building my cyber resume 👌🏿.

@leemueller262 6 месяцев назад

Fantastic! I know how I’ll be spending my weekend ❤

@limit_limitless9875 6 месяцев назад

As someone who was forced to change career paths and decided to go with IT you are a saint. I'll be sure to check out more videos. Thank you.

@SimplyCyber 6 месяцев назад

Thx. Really great compliment. 💙

@carol-lo 6 месяцев назад

Thanks so much! Dr Auger! Very nice and concise video!

@sync_arts 5 месяцев назад

It's near impossible that ELK and no-hassle fit in one sentence, thanks to you

@xCheddarB0b42x 6 месяцев назад

Employers are looking for candidates with hands-on experience. With home lab projects like this, you can build this experience at home outside of any enterprise environment. These activities are _more important_ than certifications or even degrees to Hiring Managers. People at three large companies each told me that. So get crackin

@seann9501 День назад

Great advice; thank you

@nsfam6516 6 месяцев назад

This is exactly what i needed!

@Noir_Nouveau 6 месяцев назад

YOU ARE HIM Dr. G! Thanks!

@phonogtaphologist 18 часов назад

A fun little way to test elastic defend agents, is run “atomic read team invoke” this can automatically run mitre attacks and you can check coverage and generate a bunch of alerts by running all tests. Image your vm before you run this though because it can mess things up when you run all the tests

@KennithJay 6 месяцев назад

Loved It. Excellent

@treyanmarioh 4 месяца назад

I am happy you exist.

@ever6 5 дней назад

wOW awesome channel I'm new here and just subscribed and recently finished my bootcamp and have to finish my resume before the jog hunt I'm in a 12 weeks mentor program now with cnl and this channel about projects will be great to add on my resume. I'm switching from 20yrs in motion apture animation in videogames/vfx film to a new career too many layoffs in games but plenty in cyber. I'll post update here when I finish this project hopefully before this weekend,. Darrel C

@NicholasSouris 6 месяцев назад

First tutorial video I didn't have to fast forward thu

@RB-sv7ru 6 месяцев назад

Great video, love your content and the cyber threat briefing every morning. If anyone goes to integrate and none of them appear try signing out and back in and it works.

@SimplyCyber 6 месяцев назад

Thank you for kind words and thx for tip on lab for others

@IFBBPRO917 4 месяца назад

This is my favorite RU-vid channel!

@SimplyCyber 4 месяца назад

YASSSS!!!! Thank you for making my day! 💙

@Iamjustja 6 месяцев назад

Great content.

@sumitm_11 День назад

Thank you

@davidp5280 6 месяцев назад

Good morning everyone! Nothing better than sharing and learning! Love it, love it, LOVE IT!!!❤🎉

@nijatrzayev9962 6 месяцев назад

You are doing great Gerald, Thanks for these invaluable resources.

@MD-mo9wb 5 дней назад

Saved to my SOC Analyst playlist to review later. I'm new so this went waaaay too fast lol. Edit: Literally playing this back on .75 lol

@christopherayres164 6 месяцев назад

Well done, now how deep does this rabbit hole go? Just remember to keep following that white rabbit neo!

@kumarsiddappa6118 3 месяца назад

not able to see nmap details , do we need to setup anything on ES to read

@TheSilentLearner786 6 месяцев назад

Sir expecting more siem lab tutorials❤

@tyrojames9937 6 месяцев назад

COOL!

@2kslimey 3 месяца назад

is elastic lab actually used in a professional setting or just for testing and building home labs?

@johnnytyler Месяц назад

Patience and persistence are required. Careful, adherence to the instructions on the blogpost (link provided in the description). GA's overview is a high level, fast paced overview and Elastic's website layout has changed. Pay specific attention to the steps of adding the integration, installing the agent, and allowing the agent to be enrolled in Fleet. Very important to allow time for the agent to report the processes from the host to the Elastic Cloud. The results are not as fast as would seem in the video. Don't rush and keep trying! Thanks SC!

@annmae644 3 месяца назад

question on installing, when installing Kali, am i installing Vmware or virtualbox? i already have oracle vm virtualbox?

@climbing_for_dollars 3 месяца назад

Thank you for this tutorial ❤

@Dkidd076 6 месяцев назад

#TeamSimplyCyber!

@emmanueldark993 5 месяцев назад

Is anyone else having trouble setting that "Easy Lab" setup? On the "Install Elastic Agent" step I keep getting a stall and it states "Confirm agent enrollment" "Listening for agent" and there's an infinite scrolling wheel. I asked Chatgpt and it states my settings are probably misconfigured. If anyone has any suggestions or know the fix I will greatly appreciate it.

@romanxxxx 6 месяцев назад

Hell yes gerry guy, i’m doing this soon

@RowanHawkins 6 месяцев назад

Don't do anything soon. if you want to do something put a date on it. Soon to some software devs is 2.5 years of soon.

@cybernaut644 6 месяцев назад

Thank you, Dr. Auger! Not sure if it was just me, but event.action: "nmap_scan" didn't fire any alerts. I replaced with process.name: "nmap" which triggered alerts and sent an email.

@abhinavkohli4293 Месяц назад

i am still not getting an email even thought its showing on the dashboards

@tommyshowgun 6 месяцев назад

Thank you.

@SimplyCyber 6 месяцев назад

You're welcome!

@markkennedy5449 10 дней назад

What’s the option for OS system???

@ishajatania6980 4 месяца назад

My fleet agent is not getting connected and the status is showing "listening" but not getting confirmed..What might be the problem please help me

@user-vp1ig6xl7r 6 месяцев назад

#TeamSC

@jonathanvasquez393 4 месяца назад

the only issue i had i could not find custom query in my options :/

@mypassportpicsux 6 месяцев назад

There goes my weekend. 😂Let’s go!! #TeamSC

@SKeee3 4 месяца назад

I followed every step to a T yet when I set up an email alert for "sudo -sv localhost" and ran the command line I get no email? Any tips on this?

@SimplyCyber 4 месяца назад

I also had an issue getting the email to fire. Suggest using a web book and validating the alert is firing to try and isolate the issue

@LearningDFIR Месяц назад

Great video! Late comment but, how long does the free version can be used?

@SimplyCyber Месяц назад

It’s been a minute but I think 7 or 14 days. I can’t recall but enough you can make it happen in a weekend

@jworrell89 6 месяцев назад

What do you use to highlight and make the arrow?.

@SimplyCyber 6 месяцев назад

Zoom it by by systernals. It’s in Microsoft website. It’s awesome

@letsgoheat23 6 месяцев назад

Having trouble doing with a Mac. I know it has to do with the linux distribution. 89

@Ben-bf4gn 6 месяцев назад

I'm wondering if its possible to build this lab on prem (vs using the cloud)?

@SimplyCyber 6 месяцев назад

It is, but you need more hardware and configuration. Check out graylog or ELK stacks.

@javierruiz2870 2 месяца назад

The process.args: nmap logs are not showing up on ES. I did everything just like the video up to that point. I've been stuck with this issue for several days now...

@Denniessix Месяц назад

Thank you@@Kaiomonchi

@franklinmccullough85 6 месяцев назад

I'm having trouble getting the rule for Nmap. I can get process.args:, but nap doesn't show up for me. Please advise.

@ssuriya427 5 месяцев назад

same here

@JordanTTG21 2 месяца назад

Am I the only one not getting alerts? I set up the alerts and everything exactly as the video states and I have yet to get an alert or email from performing a Nmap scan

@lmartin2422 14 дней назад

me too. did anything change for you? if so, how did you do it?

@jamilpotts8558 6 часов назад

Anyone know of a completely free SIEM we could use in lieu of a trial version of Elastic? Just wondering.

@kamalalleyne2197 6 месяцев назад

how did you get the email to fire off at 9:13? In the video it looks like it was cut off and i didn't get to see exactly what you did.

@SimplyCyber 6 месяцев назад

Thx for asking. I didn’t get the email and couldn’t troubleshoot it for the video. I thought I left a comment in there saying the email didn’t arrive but I guess it didn’t make the final vid. I would set it up w web hooks if I’m being practical since it’s more flexible and you would see it in practice (fire off a slack msg for example)

@RowanHawkins 6 месяцев назад

Slack is awsome for this because its so easy to set up a slack instance and then view the alerts on say your phone.

@j.williams3 4 месяца назад

I couldn't get past the Elastic install point

@abdielramos8403 6 месяцев назад

This is good for people that are starting with Cybersecurity or prior "experience"/background is necessary?

@SimplyCyber 6 месяцев назад

No experience is needed to setup, but prior knowledge is needed to know what you’re looking at and what it means in the siem. Mostly networking and operating system prior knowledge

@abdielramos8403 2 месяца назад

I'm back and ready to spend time to learn and earn experience. Currently starting my major in cybersecurity and want to earn experience at the same time to build my resume.

@johnvardy9559 4 месяца назад

Do Something with wazuh

@milanmills2824 Месяц назад

Maybe it worked before but doesn’t work anymore. Doesn’t installs

@studioyoguishaya6484 28 дней назад

everything went well but I didn't get any alert even in the dashboard and in my e-mail

@SimplyCyber 27 дней назад

🤔 hmmm

@madhurhase8333 5 месяцев назад

Perfectly Curated

@razulconde8765 6 месяцев назад

Remarkable Man, Thanks, but slow down a bit. Are you in a rush or something else?

@freshkicks23023 20 дней назад

why does elastic look completely different and not work the same. plz help

@SimplyCyber 20 дней назад

Im not sure. technology can have front end changes made after the video is recorded. potentially that?

@kayodeolanrewaju5459 29 дней назад

it gave me an error curl: (18) HTTP/2 stream 1 was not closed cleanly before end of the underlying stream tar (child): elastic-agent-8.14.2-linux-x86_64.tar.gz: Cannot open: No such file or directory tar (child): Error is not recoverable: exiting now tar: Child returned status 2 tar: Error is not recoverable: exiting now bash: cd: elastic-agent-8.14.2-linux-x86_64: No such file or directory what do i do??

@SimplyCyber 29 дней назад

Ping me on the discord server. I’m not sure what step you’re on or what you’re doing that results in this error and yt comments is tough to communicate for troubleshooting

@kayodeolanrewaju5459 29 дней назад

@@SimplyCyber alright, I'm trying something now but I'll ping you if this doesn't work out as well

@SirDodge 5 месяцев назад

Who's actually been able to get this SIEM to work? I haven't. After a successful agent install and nmap scans, nothing is being reported to the Logs about the scans.

@eshajadoun5743 5 месяцев назад

Even i am having trouble seeing the logs. But if you go to discover you will find timestamps of the data, and that means the thing is working

@SirDodge 5 месяцев назад

@@eshajadoun5743 I'm glad to see that I'm not the only person who was having trouble and it wasn't just a newbie mistake but Yeah, I've just been messing around with it and setup a Kali VM and Windows VM as well as a honeypot and I've been seeing data being ingested over the last couple of days.

@giangphamngocchau8516 2 месяца назад

same here. Have you been able to figure out the solution? Thanks in advance

@SirDodge 2 месяца назад

@@giangphamngocchau8516 Hi, I never finished "this" lab but I did pay for the course and the course is worth it.

@trblmkr5139 6 месяцев назад

siiiixkkkkkk

@rdsii64 3 месяца назад

This is very interesting, but you really talk fast.

@peek2much3 6 месяцев назад

Nah! Sorry “Doc” lol, anyone in 2024 thinking it’s a good idea sticking with ES is an idiot or is selling licenses. They screwed the pooch dude going that route. Folks, you can do this and more with 100% FOSS. Plenty of OSS SIEMs and log management the whole stack, etc. The list is huge. Why would you use ES for this in a lab? Beats me.

@SimplyCyber 6 месяцев назад

The ease of setup lowers the barrier to entry for learning. Maybe not a great solution for enterprise or long term (i'm not sure what evaluation you are basing your assessment on), but for a student lab and learning quickly, i think its a good fit.

@bobblanchard9480 6 месяцев назад

I find Wazuh ideal for this scenario, and it can be completely on-premise. Fantastic documentation too!

@Zewwy_ca 6 месяцев назад

Enterprise is far more complex with understanding data classification and policies to allow the use to send this type of data to the provider (in this case ES). Sure for a homelab and getting an idea of how a SIEM is suppose to work is an accurate point, but using this "as a point on your resume" is a bit of a stretch.