ELK Stack — Elastic Security (SIEM)

4 minute read

Elastic Security (SIEM)

Elastic Security transforms your ELK Stack into a full-featured Security Information and Event Management (SIEM) platform. It combines log analytics, endpoint security, and threat detection — all built on the Elasticsearch engine you already know.

Elastic Security Architecture

┌──────────────────────────────────────────────┐
│              Data Sources                     │
├──────────┬───────────┬───────────┬───────────┤
│ Firewall │  Auth     │  Network  │ Endpoint  │
│  Logs    │  Logs     │  Traffic  │  Events   │
└────┬─────┴─────┬─────┴─────┬─────┴─────┬─────┘
     │           │           │           │
     └───────────┴─────┬─────┴───────────┘
                       │
              ┌────────▼────────┐
              │  Elastic Agent  │
              │  (Fleet-managed)│
              └────────┬────────┘
                       │
              ┌────────▼────────┐
              │  Elasticsearch  │
              └────────┬────────┘
                       │
              ┌────────▼────────┐
              │ Kibana Security │
              │  ├─ Detection   │
              │  ├─ Timeline    │
              │  ├─ Cases       │
              │  └─ Endpoints   │
              └─────────────────┘

Detection Engine

The detection engine automatically identifies threats using rules:

Pre-built Detection Rules

Elastic provides 700+ pre-built rules covering:

  • Initial Access — brute force, phishing, exploits
  • Persistence — scheduled tasks, registry modifications, startup scripts
  • Privilege Escalation — sudo abuse, token manipulation
  • Lateral Movement — RDP, SSH, SMB activity
  • Exfiltration — unusual data transfers, DNS tunnelling
  • Cloud — AWS, GCP, Azure suspicious activity

Enabling Pre-built Rules

  1. Navigate to Security → Detections → Rules
  2. Click Load Elastic prebuilt rules
  3. Review and enable rules relevant to your environment
  4. Configure rule actions (email, Slack, webhook)

Custom Detection Rules

Create rules tailored to your environment:

Threshold Rule Example

Detect brute-force login attempts:

{
  "name": "Brute Force Login Attempts",
  "description": "Detects more than 10 failed logins from a single IP in 5 minutes",
  "type": "threshold",
  "query": "event.action:\"authentication_failure\" and event.outcome:failure",
  "threshold": {
    "field": ["source.ip"],
    "value": 10
  },
  "risk_score": 73,
  "severity": "high",
  "interval": "5m",
  "from": "now-6m",
  "tags": ["Brute Force", "Authentication"]
}

EQL (Event Query Language) Rule

Detect process injection patterns:

process where event.action == "start" and
  process.parent.name == "winword.exe" and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe")

Machine Learning Rule

Anomaly detection for unusual behavior:

  1. Enable ML jobs for security (e.g., security_linux_anomalous_process)
  2. Create an ML rule that triggers on anomaly score thresholds
  3. Automatically detect unusual login times, process behavior, or network patterns

Rule Severity and Risk Score

Severity Risk Score Range Example
Low 1-21 Informational policy violation
Medium 22-47 Suspicious but may be legitimate
High 48-73 Likely malicious activity
Critical 74-99 Active threat requiring immediate response

Timeline Investigation

Timeline is a workspace for investigating security events:

Creating a Timeline

  1. Navigate to Security → Timelines
  2. Click Create new Timeline
  3. Add events by:
    • Dragging fields from alerts
    • Using KQL queries
    • Adding events from Discover

Timeline Features

  • Event correlation — view related events across data sources
  • Templates — save investigation patterns for reuse
  • Notes — add investigation notes to individual events
  • Pinned events — mark key events during investigation
  • EQL queries — use Event Query Language for sequence detection

EQL Sequence Detection in Timeline

sequence by host.name with maxspan=30s
  [process where event.action == "start" and process.name == "cmd.exe"]
  [network where destination.port == 443]
  [file where event.action == "creation" and file.extension == "exe"]

Cases Management

Track investigations from detection to resolution:

Creating a Case

  1. Navigate to Security → Cases
  2. Click Create case
  3. Add title, description, severity, and tags
  4. Attach alerts and Timeline events
  5. Assign to team members

Case Workflow

New → In Progress → Resolved → Closed
                 ↓
            Escalated

External Integrations

Cases integrate with external ticketing systems:

  • Jira — create and sync Jira tickets
  • ServiceNow — bi-directional case synchronization
  • IBM Resilient — incident response integration
  • Swimlane — SOAR platform integration

Elastic Endpoint Security

Elastic Endpoint provides host-based protection:

Capabilities

Feature Description
Malware prevention Signature and behaviour-based detection
Ransomware prevention Detect and block encryption behaviour
Memory threat prevention Detect in-memory attacks
Malicious behaviour protection ML-based behaviour analysis
Host isolation Isolate compromised hosts from network
Live queries Query endpoint data with osquery

Deploying Endpoint Security

  1. Add Elastic Defend integration in Fleet
  2. Configure policy (prevent/detect modes)
  3. Deploy Elastic Agent to endpoints
  4. Monitor in Security → Endpoints

Threat Intelligence Integration

Enrich security data with threat feeds:

Indicator Match Rules

Match your data against threat intelligence indicators:

{
  "name": "Threat Intel IP Match",
  "type": "threat_match",
  "query": "event.category:network",
  "threat_query": "event.dataset:ti_*",
  "threat_mapping": [
    {
      "entries": [
        {
          "field": "destination.ip",
          "type": "mapping",
          "value": "threat.indicator.ip"
        }
      ]
    }
  ]
}

Supported Threat Feeds

  • Elastic Threat Intelligence (ESET, Recorded Future, Anomali)
  • MISP integration
  • AbuseCH (URLhaus, MalwareBazaar)
  • AlienVault OTX
  • Custom feeds via Filebeat threat intel module

ML Anomaly Detection for Security

Elastic Security includes pre-built ML jobs:

ML Job Detects
security_linux_anomalous_process Unusual process execution
security_auth_rare_user Rare user authentication
security_network_rare_dest Unusual network destinations
security_cloudtrail_rare_method Unusual AWS API calls
security_packetbeat_rare_dns Rare DNS queries

Enabling ML Jobs

# List available security ML jobs
curl -s -u elastic:changeme \
  "https://localhost:9200/_ml/anomaly_detectors?pretty" | \
  grep -i security

In Kibana:

  1. Navigate to Security → Detections → ML job settings
  2. Enable relevant ML jobs
  3. Create ML rules that trigger on anomaly scores

Common Security Use Cases

1. Brute Force Detection

  • Collect authentication logs (sshd, AD, web apps)
  • Threshold rule: > 10 failures in 5 minutes per source IP
  • Alert with source IP, target user, geographic location

2. Data Exfiltration

  • Monitor network flow data
  • Anomaly detection for unusual outbound data volume
  • DNS tunnel detection with ML

3. Insider Threat

  • Track user behaviour patterns
  • Detect after-hours access to sensitive resources
  • Monitor for privilege escalation

4. Cloud Security Posture

  • Ingest AWS CloudTrail, GCP Audit, Azure Activity logs
  • Pre-built rules for cloud misconfigurations
  • Detect unauthorised IAM changes

Quick Reference — Elastic Security provides SIEM capabilities with 700+ pre-built detection rules, Timeline investigation, Cases management, and Endpoint Security. Use EQL for sequence detection, ML jobs for anomaly detection, and threat intelligence integration for indicator matching. Deploy via Elastic Agent with the Elastic Defend integration for endpoint protection.

You may also enjoy