SOF-ELK

Security Operations and Forensics ELK Distribution

[SOF-ELK @SOF_ELK]

New Public SOF-ELK build release! Version 2022-10-25 is ready for you to download.
https://t.co/atsfW8WQTV. Changes include ES components v7.17.7 and new cloud evidence parsers built-in.
Thank you to @texaquila for the prerelease testing assistance and SANS #FOR509 integrations!

[SOF-ELK @SOF_ELK]

New SOF-ELK release is now live!
- Elastic stack components 7.15.0
- LOTS of cloud parsers for AWS, GCP, Azure, and Microsoft 365
- Dashboards and visualizations all updated for the latest stack

Download, feed, and examine! Details and download link: https://t.co/P9PKBwdqLy

[SOF-ELK @SOF_ELK]

aaaaaand a typo. of course. #WFH

[SOF-ELK @SOF_ELK]

Hot off the WHF presses! New SOF-ELK VM release - Update to Elastic 7.6.1 components, fully built from included Ansible playbooks, and lots of parser tweaks.

Check out the README here: https://t.co/gaN5H112k2 (including direct download link)

[Heather Mahalik Barnhart @HeatherMahalik]

In just a few hours we hit the stage. Now time for my costume change 🤣 #RSAC2020

[Ismael Valenzuela @aboutsecurity]

Great guide on how to protect a small/home network with #SquidProxy & @OpenDNS, using @SOF_ELK for monitoring & #Kibana dashboards for analysis. This blog post, inspired by #SEC530, earns the red #AllRoundDefenders creator’s coin! Congrats Andrew! https://t.co/nBGvvBlELL

[Andy Ratcliffe @Andy_Ratcliffe]

Squid Proxy with SOF-ELK Part 1 https://t.co/ZYiIKe1C2y

[SOF-ELK @SOF_ELK]

@GerganaKara And thanks for checking out the new features!!!

[SOF-ELK @SOF_ELK]

New code merged to master, now available for current public VM (v20190606)!!

New features:
- KAPE EVTX json parsing
- Plaso (log2timeline) CSV parsing
- Dashboard and other updates

Run "sof-elk_update.sh" to get the new stuff!

[SOF-ELK @SOF_ELK]

@GerganaKara SQLite inputs are not available for Logstash that I am aware of

[SOF-ELK @SOF_ELK]

@thomaswilburn Cool subtweet after block, bro.
You’re also facing some issues with steing comparison... those words don’t exist in the bio...

Even your cat knows not to write its own CSV parser.

[Lee Whitfield @lee_whitfield]

Whether you're just getting started in #DFIR or you've been doing it for years, the @sansforensics #FOR500 class has plenty to offer. Please join me in Pittsburgh for a week of Windows forensics. https://t.co/PYC3BC6gRC https://t.co/78zhTEQHCj

[SOF-ELK @SOF_ELK]

New VM distribution!!
Biggest news: Initial KAPE support (LNK and MFT so far), NetFlow v9 (including IPv6 parsing), and Elastic stack 6.7.2. VM details and download: https://t.co/gaN5H112k2

Thanks to @EricRZimmerman for the KAPE tool and help integrating to SOF-ELK!

[SOF-ELK @SOF_ELK]

Question for the masses: Any success in converting our VMware instance to VHD (Hyper-V)? Someone's asking and I haven't done that particular conversion... Please reach out if so!

[SOF-ELK @SOF_ELK]

Thanks to everyone who joined the @sansforensics webcast today! Those looking for the awesome Elastic primer from John Hubbard (@SecHubb), it's available here: https://t.co/LdSeCNkZ8c

[SANS DFIR @sansforensics]

IN TWO DAYS! join @chadtilbury webcast "Investigating #WMIAttacks". Chad will provide an overview of the state of WMI hacking, including real world examples of nation state and criminal actor tradecraft | March 7, 3:30 pm ET | https://t.co/raTnPWLzhS
#DFIR #ThreatHunting

[SANS DFIR @sansforensics]

IN ONE HOUR! Join @PhilHagen's webcast at 1:00 pm ET to learn about the new version of @SOF_ELK and how it can streamline your investigations.
Read about it: https://t.co/vn5m1NYAjJ
Register for the webcast here: https://t.co/cDgjFufUnT
#DFIR #FOR572 #Threathunting

[domenica @domenicacrognal]

And if you like what you hear, we’re teaching classes in Orlando, London, Boston, and Madrid this April!

[SOF-ELK @SOF_ELK]

Also with a brand new SOF-ELK distribution included, with two new SOF-ELK labs and lots more!

[SOF-ELK @SOF_ELK]

New SOF-ELK VM release! Updated to Elastic Stack v6.5.3 and a bunch of changes to dashboards and parsers from the git repo - enjoy! README here: https://t.co/fapzK7D29J (includes download link and other important info)
[repost with fixed link]