Multi-Stage Threat Detection & Incident Triage using Elastic SIEM

​I set up a dedicated cloud and virtualization threat detection lab to simulate real-world attacks and monitor them using the Elastic Stack (SIEM). The objective was to ingest endpoint telemetry, simulate adversarial attacks against an authentic target environment, and configure custom detection rules and alerts to capture anomalous and malicious activities.

I deployed and configured the Elastic SIEM environment and connected target endpoints using Elastic Agent and Fleet to ingest authentication, system, and Sysmon logs. I simulated several offensive techniques, including credential brute-forcing, privilege escalation, and suspicious command-line executions. Using Elastic Query Language (EQL) and KQL, I created and validated custom detection rules, correlated security events across alerts, and analyzed false positives to improve rule precision.

Successfully triggered and verified real-time security alerts upon attack execution with low latency. Reduced false positive alerts through baseline tuning and created an actionable incident response workflow. Thoroughly documented the architecture, configuration steps, attack vectors, and detection rules in a public GitHub repository to serve as a practical portfolio artifact.

• Elastic SIEM
• Elasticsearch
• Kibana
• Elastic Agent
• Fleet
• EQL
• KQL
• Sysmon

• GitHub ↗ (opens in a new tab)