Servidae: Log Analysis in ELK (TryHackMe)

Completed a comprehensive log analysis project using the ELK Stack (Elasticsearch, Logstash, and Kibana) to collect, process, visualize, and analyze system and security logs. The project focused on identifying suspicious activities, monitoring system performance, and creating actionable dashboards for security monitoring. Included investigation of an scenario involving Bill Smith, a senior Finance Executive at Servidae Industries who opened and downloaded an email that caused a security alert generated by EndDefender EDR.

Key Responsibilities & Accomplishments

Configured and deployed Elasticsearch, Logstash, and Kibana components.
Ingested and normalized log data from multiple sources, including system, application, and security logs.
Developed Logstash pipelines to parse, filter, and enrich incoming log events.
Created Kibana dashboards and visualizations to monitor network activity, authentication events, and system health.
Conducted log analysis to identify anomalies, failed login attempts, unauthorized access attempts, and potential security incidents.
Utilized Elasticsearch queries to investigate events and perform threat-hunting activities.
Generated reports and documented findings to support incident response and security operations.
Implemented data indexing and retention strategies to optimize search performance and storage management.

Skills & Technologies

ELK Stack (Elasticsearch, Logstash, Kibana)
Log Analysis & Monitoring
Security Information and Event Management (SIEM)
Threat Hunting
Incident Detection & Response
Linux Administration
Data Visualization
JSON, Syslog, and Log Parsing
Cybersecurity Operations