Welcome to the Detection with Winlogbeat course. My name is Michael
Edie, and in this course, you will learn how to leverage Winlogbeat on
Windows endpoints to collect and ship logs to a security incident and
event management platform for analysis.
Winlogbeat is developed and maintained by Elastic, the company behind
Elasticsearch, Logstash, Kibana, and Beats. Their software suite is sometimes
referred to as ELK, but is now more appropriately called the Elastic Stack.
When you want to collect Windows endpoint logs at scale and leverage a
platform designed for big data analytics,
then Winlogbeat should be at the top of your list.
It's open source and available for download on the Elastic website.
Winlogbeat is a lightweight agent that will take care of shipping your
Windows event logs to several outputs such as Kafka, Logstash,
Elasticsearch, and many others.
Winlogbeat also comes with several modules that will take care
of parsing some of the more complex logs like PowerShell,
Sysmon, and the Security Event Log.
The NIST Cybersecurity Framework provides organizations of any size
with a common language that can be used to communicate risk management
strategies using domain‑based guidance, industry standards, and best practices.
The core functions of the NIST Cybersecurity Framework are identify,
protect, detect, respond, and recover.
Each function has several categories and subcategories that
map to other well‑known frameworks such as COBIT and the CIS
Critical Security Controls.
Winlogbeat can help an organization detect anomalies and events since
each deployed agent will allow for the centralized collection and
correlation of event logs. Let's look at a sample diagram of a
Winlogbeat deployment using the Elastic Stack. An administrator will
deploy Winlogbeat on your Windows endpoints and configure them to ship
Windows event logs to Logstash. Logstash has a persistent queue and can
buffer requests,
which are sent to Elasticsearch. Analysts can then use the Kibana web
user interface to interrogate and visualize the data.
In the rest of this course,
I'll talk about and demonstrate how Winlogbeat can help your
organization detect anomalies and events.