{"permissions":{},"commerce":{"user_subscriptions":null,"subscription_plans":[],"global_tracking_code":"","conversion_tracking_code":"\n<script src="//platform.twitter.com/oct.js" type="text/javascript"></script>\n<script type="text/javascript">twttr.conversion.trackPid('nxgvm', { tw_sale_amount: 0, tw_order_quantity: 0 });</script>\n<noscript>\n<img height="1" width="1" style="display:none;" alt="" src="https://analytics.twitter.com/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n<img height="1" width="1" style="display:none;" alt="" src="//t.co/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n</noscript>\n\n\n\n\n\n\n<script>\n gtag('event', 'conversion', {\n 'send_to': 'AW-779065575/jLMdCKTdhI8BEOexvvMC',\n 'transaction_id': ''\n });\n</script>","payment_requires_zip_code":false,"currency_code":"usd"},"media":{"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&ixlib=python-1.1.0&w=500&s=67714604a0a4dd036627a0b24d864157","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=250&ixlib=python-1.1.0&w=250&s=dd186d13312ece08824791a21b8f85ac","logo":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FwlZeWsU7RmexXY78HFKG%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&h=200&ixlib=python-1.1.0&w=600&s=3e88e4a65c1be65bf90a14c62bb9ddd8","url":"//d1do9mm1n6degf.cloudfront.net/","banners":[{"id":908,"school_id":5379,"background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FfJx85Y2NQeCeXz6Ou47r%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=0a17a1f2151f9c1fa92974d6a8410ff3","background_type":1,"background_overlay":"0,0,0,0.2","heading":"Applied Network Defense","subhead":"Information Security Training","readability":true,"button_text":"","button_func":"url","button_url":"","order":0,"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FfJx85Y2NQeCeXz6Ou47r%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=0a17a1f2151f9c1fa92974d6a8410ff3","font_color":"ffffff","is_visible":true,"hide_for_subscription_plans":[],"show_for_subscription_plans":[]}],"theme":{"id":283,"name":"Applied Network Defense - 7600","description":"","primary_color":"0d71fb","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=cb76712ea91191b11d11e186e7c71b3d","heading_font":"","typekit_id":"","custom_css":"","theme_css_url":null,"typekit_scripts":null,"background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=700&high=-80&ixlib=python-1.1.0&q=100&w=700&s=7a4e72884667a9e2ef8fba320516b46a","background_overlay":"0,0,0,0","background_type":1,"background_image_raw":"https://cdn.filestackcontent.com/B8TQJqo9RoOCyIQVKYNa"},"pages":[]},"school":{"id":5379,"name":"Applied Network Defense","platform_version":2.2,"url":"https://www.networkdefense.io/","is_ssl_disabled":false,"is_curriculum_licensor":false,"is_curriculum_subscriber":false,"is_activated":true,"is_activated_via_override":false,"resource_licensing_enabled":false,"trial_has_expired":false,"trial_days_remaining":null,"is_curriculum_enabled":true,"has_public_resources":true,"billing_model_display":"User (Pathwright 2)","billing_model":10,"website":"","has_certificate":true,"subdomain":"networkdefense","ietf_language_tag":"en-US","short_description":"Affordable, effective, online information security training. Made by analysts, for analysts.","has_consent_description":false},"support":{"has_faqs":false,"support_email":"chris@chrissanders.org","support_phone":"","support_link":"","support_policy":"

Course support is provided by e-mail. Most questions will be answered within 24 hours.

","support_faqs":null},"security":{"terms_of_service":"https://www.networkdefense.io/pages/terms-of-use.html","privacy_policy":"https://www.networkdefense.io/pages/privacy-policy.html","csrf_token":"S2vVpQz06MWWobClsqPdyVzP4n8Bv3Keq6LGFI8iaizcFInp9KsDMKqeLbdjxPSM","terms_agreement_prompt_override":""},"social":{"twitter_username":"","facebook_username":"","google_plus_username":"","pinterest_username":""},"integrations":{"facebook":null,"filepicker":{"read_policy":"eyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0=","read_signature":"888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34"},"algolia":false,"intercom":{"app_id":null,"school_app_id":null,"school_staff_app_id":null,"pathwright_app_id":"5txzvi2k","segment":false,"school_profile":null},"stripe":{"publishable_key":"pk_live_KFOuFb4HE2BpHFfGHilvfHmK"},"firebase":null,"google_analytics":{"account_id":"UA-92588624-1","domain_name":"pathwright.com"},"sso":{"pathwright_login_enabled":true,"providers":[],"current_provider":null}},"customizations":{"head_markup":["","\n\n\n\n"],"script_markup":["\n\n\n"],"global_tracking_code":""},"pathwright_account":{"is_on_legacy_plan":false,"is_activated":true,"payment_key":"pk_V26ZEKLGb9otX6E1CRSVns4V7Im9e","subscription":{"id":909,"school":5379,"plan":{"id":16,"name":"Essentials 2.0","image":null,"description":"For launching a full online school & community.","amount":99.0,"fee_per_additional_learner":0.0,"features":{"1-staff-member":true,"create-unlimited-courses":true,"start-at-1000-active-learners":true,"free-course-design-courses":true,"sell-courses-with-commerce":true,"friendly-email-support":true,"starts-with-5-staff-members":true,"use-your-own-domain-name":true,"essential-app-integrations":true,"guided-course-design-courses":true,"sell-subscriptions":true,"priority-email-support":true},"plan_order":2,"plan_color":"6bc288","visibility":15,"learners_included":1000,"user_discount_func":{"id":1,"name":"Default Range Discount","method_name":"applyRangeDiscount","method_body_js":"function applyRangeDiscount(users, rate) {\n var thresholds = [0, 10,30,50,100,250,500,1000]\n function calcDiscount(threshold) {\n var perc = threshold / thresholds[thresholds.length-1]\n var min = .25\n var max = .75\n var discount = ((max - min) * perc) + min\n return discount\n }\n var discount = 0\n var discountableUsers = users\n for (var i=thresholds.length-1; i >= 0;--i) {\n var threshold = thresholds[i]\n //console.log(users + \" > \" + threshold, i, users>threshold)\n if (users > threshold) {\n var usersToDiscount = (discountableUsers - threshold)\n var userDiscount = usersToDiscount * calcDiscount(threshold)\n //console.log(\"discounting \" + usersToDiscount + \" users at \" + userDiscount)\n discount += userDiscount\n discountableUsers -= usersToDiscount\n }\n }\n return discount}"},"should_contact_for_pricing":false,"intervals_by_month":[{"interval_id":5,"months":1,"amount_per_cycle":99.0,"amount_per_month":99.0,"discount_percent":0.0,"discounted_amount_per_month":99.0,"discounted_amount_per_cycle":99.0,"discount_per_month":0,"discount_per_cycle":0},{"interval_id":7,"months":6,"amount_per_cycle":594.0,"amount_per_month":99.0,"discount_percent":0.05,"discounted_amount_per_month":94.0,"discounted_amount_per_cycle":564.0,"discount_per_month":5,"discount_per_cycle":30},{"interval_id":10,"months":12,"amount_per_cycle":1188.0,"amount_per_month":99.0,"discount_percent":0.1,"discounted_amount_per_month":89.0,"discounted_amount_per_cycle":1068.0,"discount_per_month":10,"discount_per_cycle":120},{"interval_id":20,"months":1,"amount_per_cycle":99.0,"amount_per_month":99.0,"discount_percent":0.0,"discounted_amount_per_month":99.0,"discounted_amount_per_cycle":99.0,"discount_per_month":0,"discount_per_cycle":0}],"scholarships_available":false},"subscription":{"id":34550,"card_last_4":"1907","subscription_plan":{"id":84,"amount":0.0,"interval":5,"trial_period_days":0,"trial_type":null},"is_delinquent":false,"cycle_start_dtime":"2019-05-11T16:03:37-04:00","cycle_end_dtime":"2019-06-11T16:03:37-04:00","canceled_dtime":null,"provider_school_stripe_key":null,"trial_type":null,"trial_end_dtime":null,"paused_until_dtime":null,"is_canceled_at_cycle_end":false,"cancellation_reason":null},"interval":5,"additional_learners_included":0}},"user":null,"session":{"user":null,"school_membership":null,"csrf_token":"UFWDOARpQkTxs2VLQFWhjWaVJB6S7kjxsJco4sqHUQwNJzGPxZzHxL1kqpbA96r5","search":{"school_membership":{"key":"9a23457bee6a290743d7a8f537493471979df0782a7110de5f76035478526870","params":{"tagFilters":["school_5379"],"validUntil":1558986718,"restrictIndices":"prod_school_membership"}},"index_prefix":"prod_"},"firebase":null,"is_authenticated":false},"DEBUG":false,"resource":{"id":28074,"name":"ELK for Security Analysis","description":"

You must master your data If you want to catch bad guys and find evil. But, how can you do that? That's where the ELK stack comes in.

ELK is Elasticsearch, Logstash, and Kibana and together they provide a framework for collecting, storing, and investigating network security data. In this course, you'll learn how to use this powerful trio to perform security analysis. This isn't just an ELK course, it's a course on how to use ELK specifically for incident responders, network security monitoring analysts, and other security blue teamers.
You'll learn the basics of:

Elasticsearch: How data is stored and indexed. Working with JSON documents.
Logstash: How to collect and manipulate structured and unstructured data.
Kibana: Techniques for searching data and building useful visualizations and dashboards.
Beats: Use the agent to ship data from endpoints and servers to your ELK systems.

I'll also show you how to build complete data pipelines from ingest to search. This means you'll get to watch step-by-step guides for dealing with security specific data types like:

HTTP Proxy Logs
File-Based Logs (Unix, auth, and application logs)
Windows Events & Sysmon Data
NetFlow Data
IDS Alerts
Dealing with any CSV file you're handed
Parsing unstructured logs, no matter how weird they are

When you walk away from this course, you should be equipped with the skills you need to build a complete IDS alert console, investigation platform, or security analysis lab.

Course Format
The ELK for Security Analysis course is delivered completely online using recorded video lectures that you can go through at your convenience. It is modeled like a college course and consists of lectures that overview critical concepts, demonstrations where I walk through ELK configuration, and lab exercises when you practice the concepts you’ve learned. There is also a discussion forum where you can ask questions and share tips and tricks with other students. The course can be completed at whatever pace is comfortable for you.

Prerequisites
This course doesn't require any prior ELK knowledge.
The demonstrations are done on Linux, so a basic understanding of the Linux command line is helpful.
The course is delivered in English.

Cost
Pricing for the course is $497 for a single user license. Bulk discounts are available for organizations that want to purchase multiple licenses (please contact me to discuss payment and pricing). A portion of the purchase price will go to support multiple charities including the Rural Technology Fund, the Against Malaria Foundation, and others.
You’ll receive:

6 month access to course video lectures and lab exercises
A Certification of Course Completion
Continuing Education Credits (CPEs/CEUs)

FAQ

Q: Who is this course designed for?
A: Anyone who wants to learn how to use ELK to collect, store, and investigate data. This course is specifically targeted at blue teamers like DFIR investigators or NSM analysts. However, you'll also gain a lot from this course as a red teamer or sysadmin too!

Q: How much ELK experience should I have before starting?
A: No previous experience is required. We start with the fundamentals. If you have some prior knowledge and want to get straight into the sections on building security-related data pipelines, you can do that!

Q: Are there any hands on labs?

A: Yes! Lots of them. You’ll have plenty of opportunities to practice the techniques we discuss. The class is loaded with demonstrations you can follow along with, too!

","short_description":"It's time to master your data. This course will teach you how to use the Elasticsearch, Logstash, and Kibana (ELK) to build your own IDS console, investigation platform, or security analysis lab.","categories":[{"id":2727,"name":"Computer Security","slug":"computer-security","description":"","order":0,"resources_count":11},{"id":952,"name":"Information Technology","slug":"information-technology","description":null,"order":0,"resources_count":11}],"image":"","cover_image":"https://cdn.filestackcontent.com/xDxSDZBFRGaGzhgEUdYq","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FxDxSDZBFRGaGzhgEUdYq%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=1&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=a9752b63816af3102517dc7e27f21318","thumb_2x":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FxDxSDZBFRGaGzhgEUdYq%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=2&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=aaf8bb40cb4d96152cf22cdd1d87344c","icon":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FxDxSDZBFRGaGzhgEUdYq%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=35&ixlib=python-1.1.0&w=35&s=1a57bacc2131482dcd6da999615ec4e4","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FNQt6Id22TP6xOzQIBrjz%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=67d60c023261ea110786c36d7fbfa825","background_overlay":"0,0,0,0.2","background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FNQt6Id22TP6xOzQIBrjz%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=500&high=-80&ixlib=python-1.1.0&q=100&w=500&s=cf7824342e267152c12338e141c47afc","background_type":1,"authors":[{"id":771,"display_name":"Chris Sanders","first_name":"Chris","last_name":"Sanders","bio":"","image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FJpBWM6TR6yHc0lz8Q1LQ%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=115&ixlib=python-1.1.0&w=115&s=08c599e53f9797ce19c27e6c1cd49d5f","resources_count":5,"salutation":"","title":"CEO at Applied Network Defense","slug":"chris-sanders","order":0,"avatar":"https://cdn.filestackcontent.com/JpBWM6TR6yHc0lz8Q1LQ"}],"created":"2017-06-28T16:20:26.098916-04:00","url":"https://www.networkdefense.io/library/elk-for-security-analysis/","offering_counts":{},"resource_type":10,"resource_type_display":"Course","slug":"elk-for-security-analysis","trailer_embed_code":"","list_order":null,"total_registration_count":250,"sum_registration_count":257,"lowest_public_offering_price":497.0,"highest_public_offering_price":497.0,"group_offering":null,"curriculum_offering":null,"num_offerings":5,"visibility_level_override":null,"licensing_enabled":false,"license_offerings":[],"licensed_from_resource":null,"certificate_generator_class":"CertificateGenerator","lowest_price_currency_display":"$497.00 USD","highest_price_currency_display":"$497.00 USD","discussion_enabled":true},"offering":{"id":65870,"name":"ELK for Security Analysis","access_starts":null,"access_ends":null,"enrollment_starts":null,"enrollment_ends":null,"description":"

Open for Immediate Access

","visibility":15,"price":497.0,"seats":null,"seats_filled":101,"seats_available":-1,"price_for_user":497.0,"currency_display":"$497.00 USD","include_in_subscription_plans":[],"is_subscription_only":false,"resource_id":28074,"path_id":1616606,"permissions":{"can_participate":false,"can_register":true,"can_access":false,"can_edit":false,"can_facilitate":false,"can_view_analytics":false,"can_invite_editor":false,"can_invite_teacher":false,"can_invite_moderator":false,"can_invite_student":false,"can_invite_observer":false},"due_dates_enabled":false,"is_group_offering":false,"step_counts":{"total":42,"reading":3,"video":27},"is_curriculum":false,"url":"/library/elk-for-security-analysis/65870/","invite_urls":{},"grade_report_url":null,"access":{"is_full":false,"has_registration_ended":false,"has_registration_started":true,"has_access_started":true,"has_access_ended":false},"analytics_visibility":5,"staff":[{"id":720631,"role":15,"user":{"id":74872,"username":"networkdefense","first_name":"Chris","last_name":"Sanders","full_name":"Chris Sanders","email":"chris@chrissanders.org","profile":{"image":"https://pathwright.imgix.net/https%3A%2F%2Fcoursebook-uploads.s3.amazonaws.com%2Fuploads%2Fcbid_images%2Fp74803.jpg?crop=faces&fit=crop&h=600&ixlib=python-1.1.0&w=600&s=6a5e564a33d6da853a08f901e5311a59","title":"","bio":"Founder @ Applied Network Defense and Rural Technology Fund","location":"United States","image_thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcoursebook-uploads.s3.amazonaws.com%2Fuploads%2Fcbid_images%2Fp74803.jpg?crop=faces&fit=crop&h=250&ixlib=python-1.1.0&w=250&s=141744500f6c6539cb335e8f333f72e6","image_circle":"https://pathwright.imgix.net/https%3A%2F%2Fcoursebook-uploads.s3.amazonaws.com%2Fuploads%2Fcbid_images%2Fp74803.jpg?crop=faces&fit=crop&h=250&ixlib=python-1.1.0&mask=ellipse&w=250&s=0d754ee7523c974fb878c8f3be5ec3fd","image_face_data":"https://pathwright.imgix.net/https%3A%2F%2Fcoursebook-uploads.s3.amazonaws.com%2Fuploads%2Fcbid_images%2Fp74803.jpg?crop=faces&faces=1&fit=crop&fm=json&ixlib=python-1.1.0&s=7eea5bcde5c0acf7819b6699486f4706","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcoursebook-uploads.s3.amazonaws.com%2Fuploads%2Fcbid_images%2Fp74803.jpg?balph=40&blend=666666&blur=500&bm=screen&fit=crop&fm=jpg&h=400&high=-80&ixlib=python-1.1.0&q=100&w=600&s=edf96858e6d67225a8db8f6ca9a65bda","fb_id":null,"avatar":"https://coursebook-uploads.s3.amazonaws.com/uploads/cbid_images/p74803.jpg"},"is_superuser":false,"date_joined":"2015-04-05T14:04:10.772592-04:00","date_joined_timestamp":1428257050,"display_name":"Chris S.","membership":null,"id_salted":null}}],"resource_license":null,"discussion_enabled":true,"parent_offering_id":null}}

Loading ELK for Security Analysis...