elastic-agent

Official repository for code snippets from Data Engineering for Cybersecurity, No Starch Press, July 2025

🚀 Enterprise-grade Android Monitoring with Elastic: Streamline Fleet Management and Security Insights. 📊

Vagrant box with Elastic Stack via Ansible 🔨 ⏱ 📊

DShield Sensor Scripts

Dockerized Datacenter

Terraform module for managing Elastic Fleet agent policies.

Detection Engineering Playground

A Collection of Elastic-Stack HowTos

SOC detection lab using Elastic SIEM + Fleet + Sysmon with detections, alerts, incident write-ups, and troubleshooting.

A comprehensive guide to setting up a home lab for Elastic Stack SIEM with Kali Linux, enabling security event generation, data forwarding, and log analysis.

I am creating this SOC-Lab to learn how to draw logical diagrams, setup and configure Elastic Logstash and Kibana (ELK), attack detect and investigate, create alerts and dashboards, setup and integrate a ticketing system. I will be using this person's tutorial playlist to do so.

Tutorial-guided Elastic SIEM home lab using Kali Linux, Elastic Agent, log analysis, dashboards, and a custom detection rule for nmap activity.

MCP server for Elastic Fleet package metadata

Docker Compose lab for shipping Solace PubSub+ broker syslog to Elasticsearch via a standalone Elastic Agent.

Visually diagrams Elasticsearch ingest pipelines using Python and Graphviz

Elastic - Docker - Swarm - Trafik - Deploy

Customer-facing demo: real-time SQL injection detection with Elastic Security. Vulnerable PHP login app → Elastic Agent → ES|QL detection rule → High alert in ~60s.

SOC Lab 11 — Elastic SIEM Setup | Deploying Elastic Security and ingesting logs from Kali Linux via Elastic Agent

Lab 2 for Cyber Threat Intelligence (CTI) — Integration of MISP with Elastic Stack for IoC ingestion, and deployment of Elastic Agents on Linux and Windows endpoints via Fleet Server for centralized log forwarding.