Instrumentation & Measurement Magazine 25-6 - 34

capabilities for the stored data, like plots, charts, histograms,
and built-in geospatial support. Moreover, it offers the ability
to interactively navigate through large amounts of log data.
Experiment Setup
The following section presents the architecture of the experiment
lab where the components are tested to observe their
capabilities. Table 1 shows the recommended hardware requirements
to deploy the test.
Table 1 - Hardware specifications
Requirement
RAM
CPU
Storage
Recommended
16 GB
2 cores
50 GB or more
Fig. 1 depicts the workflow from data collection to the visualization.
Starting from the left part of the figure; the process
begins with Endpoint monitoring as described previously.
Sysmon can be customized to filter the events. Then, the relevant
logs are shipped to Elasticsearch using Elastic Agent.
Winlogbeat is installed on the Active Directory on this setup to
gather the Windows Event Logs.
The upper part of Fig. 1 depicts the network monitoring process.
Specifically, the mirror port functionality is used to collect
the traffic from the network. Packetbeat is used to collect and send
the network traffic to Elasticsearch, where it is indexed and analyzed
as flow data. Lastly, the right part of of Fig. 1 illustrates the
data flow towards Kibana. Kibana is used for analysis, by providing
multiple filtering options based on its rich querying language.
Red/Blue Games and Data
In our previous work [9], we emulated the functionality of an
SOC within a cyber range. To showcase the operation of the
Fig. 1. ELK-Stack workflow for monitoring.
Fig. 2. Kibana security events overview.
34
IEEE Instrumentation & Measurement Magazine
September 2022

Instrumentation & Measurement Magazine 25-6

Table of Contents for the Digital Edition of Instrumentation & Measurement Magazine 25-6

Instrumentation & Measurement Magazine 25-6 - Cover1
Instrumentation & Measurement Magazine 25-6 - Cover2
Instrumentation & Measurement Magazine 25-6 - 1
Instrumentation & Measurement Magazine 25-6 - 2
Instrumentation & Measurement Magazine 25-6 - 3
Instrumentation & Measurement Magazine 25-6 - 4
Instrumentation & Measurement Magazine 25-6 - 5
Instrumentation & Measurement Magazine 25-6 - 6
Instrumentation & Measurement Magazine 25-6 - 7
Instrumentation & Measurement Magazine 25-6 - 8
Instrumentation & Measurement Magazine 25-6 - 9
Instrumentation & Measurement Magazine 25-6 - 10
Instrumentation & Measurement Magazine 25-6 - 11
Instrumentation & Measurement Magazine 25-6 - 12
Instrumentation & Measurement Magazine 25-6 - 13
Instrumentation & Measurement Magazine 25-6 - 14
Instrumentation & Measurement Magazine 25-6 - 15
Instrumentation & Measurement Magazine 25-6 - 16
Instrumentation & Measurement Magazine 25-6 - 17
Instrumentation & Measurement Magazine 25-6 - 18
Instrumentation & Measurement Magazine 25-6 - 19
Instrumentation & Measurement Magazine 25-6 - 20
Instrumentation & Measurement Magazine 25-6 - 21
Instrumentation & Measurement Magazine 25-6 - 22
Instrumentation & Measurement Magazine 25-6 - 23
Instrumentation & Measurement Magazine 25-6 - 24
Instrumentation & Measurement Magazine 25-6 - 25
Instrumentation & Measurement Magazine 25-6 - 26
Instrumentation & Measurement Magazine 25-6 - 27
Instrumentation & Measurement Magazine 25-6 - 28
Instrumentation & Measurement Magazine 25-6 - 29
Instrumentation & Measurement Magazine 25-6 - 30
Instrumentation & Measurement Magazine 25-6 - 31
Instrumentation & Measurement Magazine 25-6 - 32
Instrumentation & Measurement Magazine 25-6 - 33
Instrumentation & Measurement Magazine 25-6 - 34
Instrumentation & Measurement Magazine 25-6 - 35
Instrumentation & Measurement Magazine 25-6 - 36
Instrumentation & Measurement Magazine 25-6 - 37
Instrumentation & Measurement Magazine 25-6 - 38
Instrumentation & Measurement Magazine 25-6 - 39
Instrumentation & Measurement Magazine 25-6 - 40
Instrumentation & Measurement Magazine 25-6 - 41
Instrumentation & Measurement Magazine 25-6 - 42
Instrumentation & Measurement Magazine 25-6 - 43
Instrumentation & Measurement Magazine 25-6 - 44
Instrumentation & Measurement Magazine 25-6 - 45
Instrumentation & Measurement Magazine 25-6 - 46
Instrumentation & Measurement Magazine 25-6 - Cover3
Instrumentation & Measurement Magazine 25-6 - Cover4
https://www.nxtbook.com/allen/iamm/26-6
https://www.nxtbook.com/allen/iamm/26-5
https://www.nxtbook.com/allen/iamm/26-4
https://www.nxtbook.com/allen/iamm/26-3
https://www.nxtbook.com/allen/iamm/26-2
https://www.nxtbook.com/allen/iamm/26-1
https://www.nxtbook.com/allen/iamm/25-9
https://www.nxtbook.com/allen/iamm/25-8
https://www.nxtbook.com/allen/iamm/25-7
https://www.nxtbook.com/allen/iamm/25-6
https://www.nxtbook.com/allen/iamm/25-5
https://www.nxtbook.com/allen/iamm/25-4
https://www.nxtbook.com/allen/iamm/25-3
https://www.nxtbook.com/allen/iamm/instrumentation-measurement-magazine-25-2
https://www.nxtbook.com/allen/iamm/25-1
https://www.nxtbook.com/allen/iamm/24-9
https://www.nxtbook.com/allen/iamm/24-7
https://www.nxtbook.com/allen/iamm/24-8
https://www.nxtbook.com/allen/iamm/24-6
https://www.nxtbook.com/allen/iamm/24-5
https://www.nxtbook.com/allen/iamm/24-4
https://www.nxtbook.com/allen/iamm/24-3
https://www.nxtbook.com/allen/iamm/24-2
https://www.nxtbook.com/allen/iamm/24-1
https://www.nxtbook.com/allen/iamm/23-9
https://www.nxtbook.com/allen/iamm/23-8
https://www.nxtbook.com/allen/iamm/23-6
https://www.nxtbook.com/allen/iamm/23-5
https://www.nxtbook.com/allen/iamm/23-2
https://www.nxtbook.com/allen/iamm/23-3
https://www.nxtbook.com/allen/iamm/23-4
https://www.nxtbookmedia.com