Summary

In this chapter, we dove into moving data from endpoint devices to the SIEM solution we created in previous chapters – to the ELK stack. We discovered that the process of moving such data has an enormous level of variable configurations and we learned that independent research will likely be required by anyone who wishes to set up such an environment. We created bare-bones use cases to show how the data flows and discover how to set up the data shipping agents so that they work with the ELK stack.

We also took some time to explore the different types of data shippers, namely Beats. Here, instead of there being a single agent, many smaller agents can each be installed individually with greater efficiency, allowing the security team to only harness what is needed most. We compared this to the much easier-to-install but robust Elastic Agent, which contains more overhead to cover more potential security areas but will also be more dependent on a device’s resources...