infosecn1nja
/
HELK
mirror of https://github.com/infosecn1nja/HELK.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
The Hunting ELK
516 Commits
4 Branches
12 Tags
262 MiB
Jupyter Notebook 78.3%
CSS 14%
Shell 5.6%
Ruby 1%
Dockerfile 0.7%
Other 0.4%
 
 
 
 
 
 
Go to file
Roberto Rodriguez 3533156fd7 Updated README and Links 2020-01-21 15:41:34 -05:00
.github/ISSUE_TEMPLATE separate OS, scripts, software, and other updates from logstash configs, schema, dashboards, kql queries, elasticsearch indexes from 2019-12-30 15:05:04 -05:00
configs Updated repo structure 2020-01-14 18:40:27 -05:00
docker updates for logstash plugins 2020-01-15 15:49:07 -05:00
docs Updated README and Links 2020-01-21 15:41:34 -05:00
resources Initial Documentation 2020-01-21 15:20:44 -05:00
scripts Sigma to Notebooks Integration 2020-01-11 12:59:39 -05:00
.gitignore separate OS, scripts, software, and other updates from logstash configs, schema, dashboards, kql queries, elasticsearch indexes from 2019-12-30 15:05:04 -05:00
.gitmodules Update .gitmodules 2020-01-14 18:46:22 -05:00
CHANGELOG.md [Alpha] v0.1.7-alpha02242019 2019-02-24 17:27:03 -05:00
LICENSE Updating License 2018-07-11 20:54:57 -04:00
PULL_REQUEST_TEMPLATE.md Update PULL_REQUEST_TEMPLATE.md 2018-05-17 09:33:56 -04:00
README.md Updated README and Links 2020-01-21 15:41:34 -05:00

README.md

HELK

License: GPL v3 GitHub issues-closed Twitter Open Source Love stability-alpha

The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed primarily for research, but due to its flexible design and core components, it can be deployed in larger environments with the right configurations and scalable infrastructure.

alt text

Goals

  • Provide an open source hunting platform to the community and share the basics of Threat Hunting.
  • Expedite the time it takes to deploy a hunt platform.
  • Improve the testing and development of hunting use cases in an easier and more affordable way.
  • Enable Data Science capabilities while analyzing data via Apache Spark, GraphFrames & Jupyter Notebooks.

Current Status: Alpha

The project is currently in an alpha stage, which means that the code and the functionality are still changing. We haven't yet tested the system with large data sources and in many scenarios. We invite you to try it and welcome any feedback.

Docs:

Resources

Author

Current Committers

Contributing

There are a few things that I would like to accomplish with the HELK as shown in the To-Do list below. I would love to make the HELK a stable build for everyone in the community. If you are interested on making this build a more robust one and adding some cool features to it, PLEASE feel free to submit a pull request. #SharingIsCaring

License: GPL-3.0

HELK's GNU General Public License

TO-Do

  • Kubernetes Cluster Migration
  • OSQuery Data Ingestion
  • MITRE ATT&CK mapping to logs or dashboards
  • Cypher for Apache Spark Integration (Adding option for Zeppelin Notebook)
  • Test and integrate neo4j spark connectors with build
  • Add more network data sources (i.e Bro)
  • Research & integrate spark structured direct streaming
  • Packer Images
  • Terraform integration (AWS, Azure, GC)
  • Add more Jupyter Notebooks to teach the basics
  • Auditd beat intergation

More coming soon...