https://www.logsec.cloud/tags/elastic/ Recent content in elastic on logsec Hugo -- gohugo.io Sat, 28 Jan 2023 00:00:00 +0000 https://www.logsec.cloud/posts/ansible-making-api-calls-idempotent/ Sat, 28 Jan 2023 00:00:00 +0000 https://www.logsec.cloud/posts/ansible-making-api-calls-idempotent/ Use the Ansible URI module to call the Kibana Fleet API idempotently, choosing between POST and PUT based on which policies already exist. https://www.logsec.cloud/posts/upload-csv-to-elastic/ Tue, 28 Dec 2021 00:00:00 +0000 https://www.logsec.cloud/posts/upload-csv-to-elastic/ Load a CSV of Log4j IOCs into Elasticsearch using a custom index, an ingest pipeline and a short bash loop, to detect outbound traffic to them. https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Tue, 20 Apr 2021 00:00:00 +0000 https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Seven Kibana (KQL) queries for spotting suspicious AWS CloudTrail activity, from disabled logging to backdoor access keys, mapped to MITRE ATT&CK.