As you can probably tell,
I barely scratched the surface of the capabilities of HELK.
There are numerous blogs that can take you deeper.
If anything,
this is a tool for finding activity that you would otherwise not find.
But if you are looking for additional resources to
vector in your hunting career,
you can leverage the Threat Hunter Playbook information here as well.
If you are trying to catch something that no one else has a great detection for,
it's a lot like a science experiment.
You start with the hypothesis and test that again and
again, assessing results and adjusting fire.
Sometimes you're wrong, but the power in a lot of this analysis
is that especially in endpoint event logs,
you can detect a number of activities by writing a
behavioral detection instead of a signature,
so one detection can detect many techniques.
But it really all starts with having the right data sources.
You can have all the awesome detection tools you want,
but if you're not importing the right data,
it doesn't matter.
You can find the MITRE ATT&CK techniques mapped to data sources in the
MITRE blog. That also includes a number of other helpful visualizations.
HELK is foremost a tool made of other tools.
As such, if you want to look deeper into Windows Log analysis,
Sigma rules are the seam‑agnostic signatures used to identify
attacker behavior in logs, much like a network signature for
packet inspection. ElastAlert is used to check the data held in
Elasticsearch for conditions or, in this case,
Sigma rules that match and then generate indices with that
information. Sysmon is ages old in name now,
but has been kept well up to date,
providing Windows event logs with all of the security
relevant data you wish the other logs had already. I
realize that this is a barrage of links,
but don't worry about writing them down because I've included them
in a text file in the downloads for this course.
I hope that you've enjoyed this course on the open source Blue Team
Tools HELK. Thank you for watching, and happy hunting!