Module 27 Working with Network Security Data

Question 1

What are the core elements for ELK

Answer 1

Elasticsearch, Logstash, Kibana and Beats

Question 2

What is Kibana

Answer 2

Provides a graphical interface to data that is compiled by Elasticsearch

Question 3

What is beats

Answer 3

Series of software plugins that send diff types of data to the elasticsearch data stores

Question 4

What is logstash

Answer 4

Enables collection of network data into data indexes that can be searched by elasticsearch

Question 5

What is Elasticsearch

Answer 5

An open-core platform for searching and analyzing an org data in near real time

Question 6

What is ELK

Answer 6

To reduce Data, ELK identifies the volume of network data, shrinks it down, only the relevant stuff

Question 7

What is data normalizaiton?

Answer 7

Process of combining data from a number of sources into a common format.

Question 8

Why is data archiving important?

Answer 8

Retaining NSM data is not feasbile, Sguil alert data can be retained for 30 days.