Tag: Elastic

Rule Deployment into a Data Plane
Rule Deployment into a Data Plane

How It Works Uncoder AI supports native integration with Microsoft Sentinel, Google SecOps, and Elastic Stack, enabling users to deploy detection rules directly from the platform. Once a rule is authored or translated within Uncoder AI, the user can instantly push it into their SIEM’s data plane without exporting files or manual upload. In the […]

Read More
From IOCs to Queries: How Uncoder AI Automates Threat Intelligence Action
From IOCs to Queries: How Uncoder AI Automates Threat Intelligence Action

How It Works Threat reports often contain valuable Indicators of Compromise (IOCs) — hashes, IP addresses, domain names — that security teams need to operationalize quickly. But manually copying and converting them into queries for platforms like Microsoft Sentinel is slow, error-prone, and distracting from real response. Uncoder AI eliminates this bottleneck by automatically extracting […]

Read More
Elasticsearch: Cluster Status is RED
Elasticsearch: Cluster Status is RED

It happens very rarely, but sometimes your cluster gets red status. Red status means that not only has the primary shard been lost but also that the replica has not been upgraded to primary in its place. However, as in the case of yellow status, you should not panic and start firing commands without finding […]

Read More
Generating a CSR and Using an External Certificate with Elasticsearch
Generating a CSR and Using an External Certificate with Elasticsearch

This guide is aimed at beginners and provides a step-by-step walkthrough for connecting Elasticsearch to external certificates issued by a Certificate Authority (CA). All instructions and steps are based on the official Elasticsearch documentation to ensure accuracy and compatibility. Generate a CSR for Each Node Step 1: Create a CSR Configuration FileFor each node in […]

Read More
Handling the Dynamic Pruning Failure in Cardinality Aggregations in Elasticsearch
Handling the Dynamic Pruning Failure in Cardinality Aggregations in Elasticsearch

When working with Elasticsearch, you may encounter the following error during complex queries involving cardinality aggregations: This error typically occurs when Elasticsearch’s dynamic pruning mechanism, designed to optimize aggregation queries, struggles to handle high cardinality (i.e., a large number of unique terms or values). Let’s dive into what this means and how to resolve it. […]

Read More
Making Use of Building Block Rules in Elastic
Making Use of Building Block Rules in Elastic

Within the “Advanced Options” of the “About Rule” section of Elastic hides a useful feature that gets little attention. This feature makes the rule generate alerts that are ‘hidden’ from the alerts view. This can be powerful. Here are some ideas to get you started! Threshold Rules Create some rules that look for distinct behaviors […]

Read More
Elastic Flattened Fields Explained
Elastic Flattened Fields Explained

Elastic has many “Field Types”. Flattened is a type that allows you to search subfields. Typically for cyber security analysts subfields appear in cloud logs, especially requests and responses, where the person who built the parser needed it to be future-proofed against the ever changing cloud. For instance, if we had the following JSON in […]

Read More
Detecting Network Spikes Identified by WAF for the Elastic Stack Platform
Detecting Network Spikes Identified by WAF for the Elastic Stack Platform

There are a lot of interesting cases that you can find while investigating anomalies in the traffic baselines, for example, in FTP, SSH, or HTTPS. This guide describes how to use the “Imperva WAF – Kibana Dashboard, Watchers and Machine Learning for ELK Stack” Content Pack to detect abnormal spikes of attacks identified by WAF […]

Read More
Elastic for Security Analysts. Part 1: Searching Strings.
Elastic for Security Analysts. Part 1: Searching Strings.

Purpose: With Elastic increasing their foothold in the cybersecurity space through the speed and scalability of their solution, we expect more new Elastic users. These users will approach Elastic armed with an intuition built from experience with other platforms and SIEMs. Often this intuition will be directly challenged after a few searches in Elastic. The […]

Read More
Proactive detection content: CVE-2019-0708 vs ATT&CK, Sigma, Elastic and ArcSight
Proactive detection content: CVE-2019-0708 vs ATT&CK, Sigma, Elastic and ArcSight

I think the most of security community has agreed that CVE-2019-0708 vulnerability is of critical priority to deal with. And while saying “patch your stuff!” feels like the first thing that one should think of, the memories of WannaCry and NotPetya are still fresh in my mind. We know that patching ain’t gonna happen at […]

Read More