mirror of https://github.com/infosecn1nja/HELK.git
Updated README and Links
Roberto Rodriguez
parent
1e356a7b25
commit
3533156fd7
12
README.md
12
README.md
|
|
@ -8,7 +8,7 @@
|
|||
|
||||
The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed primarily for research, but due to its flexible design and core components, it can be deployed in larger environments with the right configurations and scalable infrastructure.
|
||||
|
||||
|
||||
|
||||
|
||||
# Goals
|
||||
|
||||
|
|
@ -23,14 +23,8 @@ The project is currently in an alpha stage, which means that the code and the fu
|
|||
|
||||
## Docs:
|
||||
|
||||
* [Introduction](https://github.com/Cyb3rWard0g/HELK/wiki)
|
||||
* [Architecture Overview](https://github.com/Cyb3rWard0g/HELK/wiki/Architecture-Overview)
|
||||
* [Kafka](https://github.com/Cyb3rWard0g/HELK/wiki/Kafka)
|
||||
* [Logstash](https://github.com/Cyb3rWard0g/HELK/wiki/Logstash)
|
||||
* [Elasticsearch](https://github.com/Cyb3rWard0g/HELK/wiki/Elasticsearch)
|
||||
* [Kibana](https://github.com/Cyb3rWard0g/HELK/wiki/Kibana)
|
||||
* [Spark](https://github.com/Cyb3rWard0g/HELK/wiki/Spark)
|
||||
* [Installation](https://github.com/Cyb3rWard0g/HELK/wiki/Installation)
|
||||
* [Introduction](https://thehelk.com/introduction.html)
|
||||
* [Installation](https://thehelk.com/installation.html)
|
||||
|
||||
# Resources
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ prev_page:
|
|||
next_page:
|
||||
url: /architecture/elasticsearch.html
|
||||
suffix: .md
|
||||
search: helk info docker installation spark cybrwardg mb kibana pulling ksql jupyter server e elasticsearch t o kb kafka tcp xx creating elastalert minutes gib set master done bash script following elastic logstash zookeeper ago p pluginsservice loaded module version access gb elk hour mib url ubuntu option log nginx worker install co running sudo password logs broker b des ip ngnix default want usr share true using vm run current helkinstall basic hunting build file confluentinc cp cli useconcmarksweepgc node github ce compose sure bit available includes helks sh license ui local monitor container n name data however work centos
|
||||
search: helk info docker installation spark cybrwardg mb kibana pulling ksql jupyter server e elasticsearch t o kb kafka tcp xx creating elastalert minutes gib set master done bash script following elastic logstash zookeeper ago p pluginsservice loaded module version access gb elk hour mib url option log nginx worker install co running password logs broker b des ip ngnix sudo default want usr share true using vm run current basic hunting build file confluentinc cp cli useconcmarksweepgc node ubuntu github ce compose sure bit available includes helks helkinstall license ui local monitor container n name data however work centos supported
|
||||
|
||||
comment: "***PROGRAMMATICALLY GENERATED, DO NOT EDIT. SEE ORIGINAL FILES IN /content***"
|
||||
---
|
||||
|
|
@ -69,13 +69,7 @@ sudo ./helk_install.sh
|
|||
</li>
|
||||
</ul>
|
||||
|
||||
<pre><code>helk@ubuntu:~$
|
||||
helk@ubuntu:~$ ls
|
||||
HELK
|
||||
helk@ubuntu:~$ cd HELK/docker/
|
||||
helk@ubuntu:~/HELK/docker$ sudo ./helk_install.sh
|
||||
|
||||
**********************************************
|
||||
<pre><code>**********************************************
|
||||
** HELK - THE HUNTING ELK **
|
||||
** **
|
||||
** Author: Roberto Rodriguez (@Cyb3rWard0g) **
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ prev_page:
|
|||
next_page:
|
||||
url: /installation.html
|
||||
suffix: .md
|
||||
search: open com source img helk src href svg class left github cybrwardg twitter data shields io license hunting apache spark elasticsearch engine thehelk badges analytics capabilities such sql jupyter notebooks scalable platform features kafka allows general gnu gpl badge issues follow style v blob master stability div design elk hunt language streaming via community share system designed fast text real hadoop libraries provides java python code ksql processing elastalert sigma neuron build introduction www org licenses gplv blue q isaissueisaclosedimg closed thehelkimg sociallabel ellerbrock frapsoft os mkenney software guides md alphaimg alpha fdf clear both br images png simply platforms
|
||||
search: open com source img helk spark data src href svg class left github cybrwardg twitter apache shields io license hunting jupyter notebooks elasticsearch engine thehelk badges analytics capabilities such sql streaming scalable platform features kafka allows general build gnu gpl badge issues follow style v blob master stability div images design elk hunt language structured via research community share basics system designed fast text real hadoop libraries cluster provides java python code ksql processing elastalert sigma neuron adding integration integrate add introduction www org licenses gplv blue q isaissueisaclosedimg closed thehelkimg sociallabel ellerbrock frapsoft os mkenney software guides md alphaimg
|
||||
|
||||
comment: "***PROGRAMMATICALLY GENERATED, DO NOT EDIT. SEE ORIGINAL FILES IN /content***"
|
||||
---
|
||||
|
|
@ -24,9 +24,7 @@ comment: "***PROGRAMMATICALLY GENERATED, DO NOT EDIT. SEE ORIGINAL FILES IN /con
|
|||
<a href="https://twitter.com/THE_HELK"><img src="https://img.shields.io/twitter/follow/THE_HELK.svg?style=social&label=Follow" class="left"></a>
|
||||
<a href="https://github.com/ellerbrock/open-source-badges/"><img src="https://badges.frapsoft.com/os/v3/open-source.svg?v=103" class="left"></a>
|
||||
<a href="https://github.com/mkenney/software-guides/blob/master/STABILITY-BADGES.md#alpha"><img src="https://img.shields.io/badge/stability-alpha-f4d03f.svg" class="left"></a></p>
|
||||
<p><div style="clear:both;"></div>
|
||||
<br/>
|
||||
<img src="images/HELK-Design.png"></p>
|
||||
<div style="clear:both;"></div><p><img src="images/HELK-Design.png"></p>
|
||||
<p>The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed primarily for research, but due to its flexible design and core components, it can be deployed in larger environments with the right configurations and scalable infrastructure.</p>
|
||||
<h2 id="Goals">Goals<a class="anchor-link" href="#Goals"> </a></h2><ul>
|
||||
<li>Provide an open source hunting platform to the community and share the basics of Threat Hunting.</li>
|
||||
|
|
@ -55,6 +53,19 @@ comment: "***PROGRAMMATICALLY GENERATED, DO NOT EDIT. SEE ORIGINAL FILES IN /con
|
|||
<li>Nate Guagenti <a href="https://twitter.com/neu5ron">@neu5ron</a></li>
|
||||
</ul>
|
||||
<h2 id="Contributing">Contributing<a class="anchor-link" href="#Contributing"> </a></h2><p>There are a few things that I would like to accomplish with the HELK as shown in the To-Do list below. I would love to make the HELK a stable build for everyone in the community. If you are interested on making this build a more robust one and adding some cool features to it, PLEASE feel free to submit a pull request. #SharingIsCaring</p>
|
||||
<h1 id="TO-Do">TO-Do<a class="anchor-link" href="#TO-Do"> </a></h1><ul>
|
||||
<li>[ ] Kubernetes Cluster Migration</li>
|
||||
<li>[ ] OSQuery Data Ingestion</li>
|
||||
<li>[ ] MITRE ATT&CK mapping to logs or dashboards</li>
|
||||
<li>[ ] Cypher for Apache Spark Integration (Adding option for Zeppelin Notebook)</li>
|
||||
<li>[ ] Test and integrate neo4j spark connectors with build</li>
|
||||
<li>[ ] Add more network data sources (i.e Bro)</li>
|
||||
<li>[ ] Research & integrate spark structured direct streaming</li>
|
||||
<li>[ ] Packer Images</li>
|
||||
<li>[ ] Terraform integration (AWS, Azure, GC)</li>
|
||||
<li>[ ] Add more Jupyter Notebooks to teach the basics</li>
|
||||
<li>[ ] Auditd beat intergation</li>
|
||||
</ul>
|
||||
<h2 id="License:-GPL-3.0">License: GPL-3.0<a class="anchor-link" href="#License:-GPL-3.0"> </a></h2><p><a href="https://github.com/Cyb3rWard0g/HELK/blob/master/LICENSE"> HELK's GNU General Public License</a></p>
|
||||
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -69,12 +69,6 @@ In order to make the installation of the HELK easy for everyone, the project com
|
|||
* If the license is set to trial, HELK asks you to set the password for the elastic account.
|
||||
|
||||
```
|
||||
helk@ubuntu:~$
|
||||
helk@ubuntu:~$ ls
|
||||
HELK
|
||||
helk@ubuntu:~$ cd HELK/docker/
|
||||
helk@ubuntu:~/HELK/docker$ sudo ./helk_install.sh
|
||||
|
||||
**********************************************
|
||||
** HELK - THE HUNTING ELK **
|
||||
** **
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
<a href="https://github.com/ellerbrock/open-source-badges/"><img src="https://badges.frapsoft.com/os/v3/open-source.svg?v=103" class="left"></a>
|
||||
<a href="https://github.com/mkenney/software-guides/blob/master/STABILITY-BADGES.md#alpha"><img src="https://img.shields.io/badge/stability-alpha-f4d03f.svg" class="left"></a>
|
||||
<div style="clear:both;"></div>
|
||||
<br/>
|
||||
|
||||
<img src="images/HELK-Design.png">
|
||||
|
||||
The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed primarily for research, but due to its flexible design and core components, it can be deployed in larger environments with the right configurations and scalable infrastructure.
|
||||
|
|
@ -46,6 +46,20 @@ The Hunting ELK or simply the HELK is one of the first open source hunt platform
|
|||
|
||||
There are a few things that I would like to accomplish with the HELK as shown in the To-Do list below. I would love to make the HELK a stable build for everyone in the community. If you are interested on making this build a more robust one and adding some cool features to it, PLEASE feel free to submit a pull request. #SharingIsCaring
|
||||
|
||||
# TO-Do
|
||||
|
||||
- [ ] Kubernetes Cluster Migration
|
||||
- [ ] OSQuery Data Ingestion
|
||||
- [ ] MITRE ATT&CK mapping to logs or dashboards
|
||||
- [ ] Cypher for Apache Spark Integration (Adding option for Zeppelin Notebook)
|
||||
- [ ] Test and integrate neo4j spark connectors with build
|
||||
- [ ] Add more network data sources (i.e Bro)
|
||||
- [ ] Research & integrate spark structured direct streaming
|
||||
- [ ] Packer Images
|
||||
- [ ] Terraform integration (AWS, Azure, GC)
|
||||
- [ ] Add more Jupyter Notebooks to teach the basics
|
||||
- [ ] Auditd beat intergation
|
||||
|
||||
## License: GPL-3.0
|
||||
|
||||
[ HELK's GNU General Public License](https://github.com/Cyb3rWard0g/HELK/blob/master/LICENSE)
|
||||
Loading…
Reference in New Issue