Mohammed Daffalla Elradi*

Communication Systems Engineering Department, University of Science and Technology, Khartoum, Sudan

*Corresponding Author: Mohammed Daffalla Elradi, Communication Systems Engineering Department, University of Science and Technology, Khartoum, Sudan.

Received: July 12, 2022; Published: September 02, 2022

Abstract

Cyber threats and attacks are evolving and been conducted more frequently and in various manners. Security analysts are challenged to detect, respond to, remediate and prevent those attacks as they impose immense risks. Logs are crucial in providing the tendency to have information about what happened, what is happening, and even predicting what will happen. Hence, having a tool that can centrally manage these logs, process them and even visualize them can be of great importance. There are many Data Analytics tools among which Elasticsearch Stack is standing out and getting more popular, formed from three main tools named Elasticsearch used for data storage and indexing, Logstash act as a data pipeline with input filter and output. In addition to Kibana that is used for data visualization and creating dashboards. In this paper the Elasticsearch Stack was used to provide concise yet detailed dashboards to identify system metrics, network performance measurements as well as user management events and security events that give security analysts a thorough insight about security events occurring to help them promptly investigate on demand. It was found to be a reliable tool in such a highly-demanding environment.

Keywords: Elasticsearch Stack; Elasticsearch; Logstash; Kibana; Elastic Agent