Elastic: Setting up a SOC Lab | TryHackMe

Set up a SOC lab with Elasticsearch, Kibana, and Fleet Server.

In a modern Security Operations Center (SOC), detection starts with data, but raw logs alone provide limited value without the ability to centralize, search, and visualize them at scale. The Elastic Stack enables security teams to ingest massive volumes of data and transform them into actionable insights. In this room, you’ll explore Elastic’s core architecture and get hands-on experience building a SOC lab to ingest, search, and investigate log data from multiple sources.

Learning Objectives

• Understand the core components of the Elastic Stack
• Install and configure an Elastic Stack deployment
• Ingest, parse, and search log data from multiple sources
• Build dashboards and visualizations to analyze log data

Prerequisites

Some familiarity with the Linux command line, SIEM concepts, and log analysis is recommended. However, all required commands and necessary information are provided in the walkthrough:

• Elastic Stack: The Basics for an overview of Elastic architecture, running queries, and creating visualizations

Machine Access

Click the Start Lab Machine button below. The machine will start in Split-Screen mode, and you will have access to all necessary files in the /home/ubuntu/Downloads directory.

We recommend switching to Full Screen mode for a more immersive experience. This provides a larger workspace, making it easier to manage the terminal and browser as you progress through the room. If your side menu is stuck in full screen, please enter and exit to fix the issue.

Answer the questions below

• Which component of the Elastic Stack represents the interface analysts use to visualize log data?

Kibana

• Which Elastic component would you use to manage the agents deployed across your client’s infrastructure?

Fleet Server

• Which port does the Kibana web interface run on by default?

5601

• Access the Kibana menu in the top left of the Kibana home page. What is the name of the first section that is listed?

Analytics

• What is the name of the default integration used to collect system metrics and log data from your host?

System

• In your VM terminal, create a new user with useradd testuser. In Discover, enter the query process.name: "useradd" to highlight the useradd events. What is the event.dataset field value of the associated logs?

system.auth

• Add testuser to the sudoers group with gpasswd -a testuser sudo. Enter the query process.name: "gpasswd" to highlight the log. What is the full message field value for the event created?

user testuser added by root to group sudo

• What is the event.dataset field value for the Apache access logs?

apache.access

• Head to /secret.html on the TryHatMe site. Using Discover, investigate the user_agent.original field from the recent requests. What is the hidden flag value?

THM{access_log_secrets!}

• Investigate the newly ingested VPN log data. Who is the most active user on the network?

s.summer

• What is the source.ip of the user you identified in the previous question?

72.14.24.1

• Create a new Pie chart visualization using the search event.action: "auth_fail". In Slice by, add the user.name field and set the Metric to Count. What percent of auth_fail events does the user p.mallow account for? (e.g., 82.7%)

62.5%

• Using your dashboard, experiment with creating a visualization for the vpn.server.region field. Which field value represents the least accessed vpn.server.region?

us-west-1

• Investigate the vpn.client.ip field. Which vpn.client.ip was only logged 26 times within the available data?

10.10.10.116