Hi everyone.
My name is Michael Edie,
and welcome to this Security Architecture and
Engineering Tools course featuring Winlogbeat,
the open source tool developed and maintained by Elastic.
As security professionals,
we must be able to detect adversarial activity on our networks.
In a Windows environment,
we can hunt for indicators of compromise using the native
security and PowerShell event logs or even third‑party logs
from software such as Sysmon.
However, searching the logs on each endpoint is not feasible.
Winlogbeat can ship event logs at scale from your enterprise systems to an
Elasticsearch cluster where defenders can interrogate the aggregated data
to correlate events and detect anomalies.
Beats are agents you place on your servers or endpoints to send data to
Elasticsearch. Winlogbeat is the Windows‑specific beat that integrates with
the Microsoft Windows API to ship various event logs.
In this course, we will be focusing on Winlogbeat in relation to the
detect function of the NIST Cybersecurity Framework.
More specifically, we will look at the anomalies and events category.
I will use several demos to cover the subcategory DE.AE‑3,
which ensures that event data are collected and correlated
from multiple sources and sensors.
I hope you'll join me on this journey to learn Winlogbeat with the Detecting
Anomalies and Events with Winlogbeats course, at Pluralsight.