elk-skill

What problem does it solve?

This Skill enables security teams to detect Active Directory threats by analyzing Windows Event Logs and Sysmon data with the Elastic Stack.

Core Features & Use Cases

• Elastic search query templates to detect Kerberos abuse and Pass-the-Hash patterns across DC and clients.
• Logstash pipelines to normalize Windows security events and Sysmon data for unified dashboards.
• Kibana dashboards for incident timeline, network activity, and persistence detection; supports threshold-based alerts.
• Use Case: A SOC can ingest Windows Event Logs and Sysmon into Elasticsearch, then identify suspicious AD activity and generate actionable alerts.

Quick Start

Open Kibana and load the ELK-based AD threat dashboards. Run the sample queries to identify Kerberoasting and Pass-the-Hash patterns. Review the provided scripts in scripts/ to understand detection pipelines.