{"id":601849,"date":"2021-04-16T08:50:21","date_gmt":"2021-04-16T06:50:21","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/elastic-security-capture-the-flag\/"},"modified":"2021-04-16T08:50:21","modified_gmt":"2021-04-16T06:50:21","slug":"elastic-security-capture-the-flag","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/","title":{"rendered":"Elastic Security: Capture the Flag"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><b>This week we attended the Webinar Elastic Security Capture the Flag for Partners. Elastic has set up an introduction around Elastic SIEM and Elastic security in a fun but interesting way.<\/b><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400\">After the introduction about <a href=\"https:\/\/nl.devoteam.com\/elastic-services\/\">Elastic<\/a> and more in depth Elastic Security, including a short demo it was time for the game.<\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-challenge\"><b>The challenge<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400\">First we needed to register ourselves and create a team. We had to form a team and compete with other teams\/persons. The battle field consisted of 11 teams with 4 people per team, some serious competition. The challenge comes with a pre-installed Elastic environment with data that will be used to detect the security risks and to analyze the data to solve the questions.<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400\">The challenge took one hour, in which we had to solve 27 questions. Per question you can earn 10 points, asking for a hint will cost you 5 points. During the game you have to solve questions from different kinds of categories (all related to security). For example:&nbsp;<\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Elastic Security<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Credential Access<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Execution<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Command &amp; Control<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Security Analytics<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Initial Access<\/span><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-biggest-game-changer\"><b>The biggest game changer<\/b><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400\">It is a game changer that information that is so critical to any business is at the fingertips of Dev, Ops, Sec and Business teams. Dashboards, alerts various views built by these separate teams all look at the same data from different angles. This speeds up investigation, analysis and incident mitigation tremendously.<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400\">Security data is neatly sectioned in:<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><b>Overview<\/b><b><br><\/b><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Detection alert trends stacked by field of preference<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">External alert trends<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Events, split in Network events and host events<\/span><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><b>Detections<\/b><span style=\"font-weight: 400\"><br><\/span><span style=\"font-weight: 400\">Detected alerts stacked by field which immediately filters the information below in detail:&nbsp;<\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li style=\"font-weight: 400\"><span style=\"font-weight: 400\"><strong>Hosts<\/strong>: showing amount of hosts, user authentications (success vs failures) and unique ip\u2019s sources and destinations.<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\"><strong>Network<\/strong>: amount of network events, dns queries, unique flow id\u2019s, TLS handshakes and unique private ip\u2019s by source and destination.&nbsp;<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\"><strong>Timelines<\/strong>: work on timelines for future use and investigations, drag and drop fields from any of the panels mentioned above for quick filtering.<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\"><strong>Cases<\/strong>: cases can be entered by authorized staff to report incidents, anomalies or suspicious cases. The security team analyzers can then investigate, update and report in one place without leaving the analysis space.<\/span><\/li><li style=\"font-weight: 400\"><span style=\"font-weight: 400\">And last but certainly not least in all panels you have the option to use the well known search and filter bars. Quickly filtering and pinpointing issues you are investigating.&nbsp;<\/span><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400\">Our team did not complete all the questions, we solved 60% of the questions. This game was a good way to introduce you in the world of Elastic Security \/ SIEM and what this feature can do for your organization. If you are working in a SOC team or your organization already has an Elastic subscription, then this game is a real recommendation for you. You get a good understanding of the product and you also have fun, the best way to learn new stuff.&nbsp;<\/span><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-more-information\"><b>More information&nbsp;<\/b><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400\">If you are interested in more information or you want to see what this game can do for your organization, <a href=\"https:\/\/nl.devoteam.com\/en\/contact-en\/\">don\u2019t hesitate to contact us<\/a>.&nbsp;<\/span><\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>This week we attended the Webinar Elastic Security Capture the Flag for Partners. Elastic has set up an introduction around Elastic SIEM and Elastic security in a fun but interesting way. After the introduction about Elastic and more in depth Elastic Security, including a short demo it was time for the game. The challenge First [&hellip;]<\/p>\n","protected":false},"featured_media":353758,"template":"","categories":[],"tags":[2297,3262,2717],"industry":[],"class_list":["post-601849","expert-view","type-expert-view","status-publish","has-post-thumbnail","hentry","tag-data-en-nl","tag-elastic-en-nl","tag-netherlands-en-nl"],"acf":[],"cards":"\n\t<div class=\"single-post-card\">\n\n\t\t<figure class=\"wp-block-post-featured-image\"><a href=\"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/\" target=\"_self\" ><img width=\"2560\" height=\"727\" src=\"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1.jpg\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"Elastic Security: Capture the Flag\" style=\"aspect-ratio:4\/3;width:100%;object-fit:cover;\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1.jpg 2560w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-300x85.jpg 300w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-1024x291.jpg 1024w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-768x218.jpg 768w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-1536x436.jpg 1536w, https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-2048x582.jpg 2048w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><\/a><\/figure>\n\n\t\t\n\t\t<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-43282307 wp-block-group-is-layout-flex\">\n\t<p style=\"font-style:normal;font-weight:700\" class=\"has-link-color wp-elements-1 wp-block-lp-post-type has-text-color has-primary-color has-small-font-size\">Expert View<\/p>\n\n\t\t\n\t\t<h3 style=\"font-style:normal;font-weight:400\" class=\"wp-block-post-title has-base-font-size\"><a href=\"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/\" target=\"_self\" >Elastic Security: Capture the Flag<\/a><\/h3><\/div>\n\t\t\n\t<\/div>\n\n","yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.4 (Yoast SEO v28.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Elastic Security: Capture the Flag | Devoteam<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Elastic Security: Capture the Flag\" \/>\n<meta property=\"og:description\" content=\"This week we attended the Webinar Elastic Security Capture the Flag for Partners. Elastic has set up an introduction around Elastic SIEM and Elastic security in a fun but interesting way. After the introduction about Elastic and more in depth Elastic Security, including a short demo it was time for the game. The challenge First [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/\" \/>\n<meta property=\"og:site_name\" content=\"Devoteam\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/\",\"url\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/\",\"name\":\"Elastic Security: Capture the Flag | Devoteam\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/Elastic_Security-scaled-1.jpg\",\"datePublished\":\"2021-04-16T06:50:21+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/#breadcrumb\"},\"inLanguage\":\"en-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-NL\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/#primaryimage\",\"url\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/Elastic_Security-scaled-1.jpg\",\"contentUrl\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/Elastic_Security-scaled-1.jpg\",\"width\":2560,\"height\":727},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/elastic-security-capture-the-flag\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Expert View\",\"item\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/expert-view\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Elastic Security: Capture the Flag\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/#website\",\"url\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/\",\"name\":\"Devoteam\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/devoteam.info\\\/en-nl\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-NL\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Elastic Security: Capture the Flag | Devoteam","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/","og_locale":"en_US","og_type":"article","og_title":"Elastic Security: Capture the Flag","og_description":"This week we attended the Webinar Elastic Security Capture the Flag for Partners. Elastic has set up an introduction around Elastic SIEM and Elastic security in a fun but interesting way. After the introduction about Elastic and more in depth Elastic Security, including a short demo it was time for the game. The challenge First [&hellip;]","og_url":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/","og_site_name":"Devoteam","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/","url":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/","name":"Elastic Security: Capture the Flag | Devoteam","isPartOf":{"@id":"https:\/\/devoteam.info\/en-nl\/#website"},"primaryImageOfPage":{"@id":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/#primaryimage"},"image":{"@id":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/#primaryimage"},"thumbnailUrl":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1.jpg","datePublished":"2021-04-16T06:50:21+00:00","breadcrumb":{"@id":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/#breadcrumb"},"inLanguage":"en-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/"]}]},{"@type":"ImageObject","inLanguage":"en-NL","@id":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/#primaryimage","url":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1.jpg","contentUrl":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1.jpg","width":2560,"height":727},{"@type":"BreadcrumbList","@id":"https:\/\/devoteam.info\/en-nl\/expert-view\/elastic-security-capture-the-flag\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devoteam.info\/en-nl\/"},{"@type":"ListItem","position":2,"name":"Expert View","item":"https:\/\/devoteam.info\/en-nl\/expert-view\/"},{"@type":"ListItem","position":3,"name":"Elastic Security: Capture the Flag"}]},{"@type":"WebSite","@id":"https:\/\/devoteam.info\/en-nl\/#website","url":"https:\/\/devoteam.info\/en-nl\/","name":"Devoteam","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devoteam.info\/en-nl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-NL"}]}},"uagb_featured_image_src":{"full":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1.jpg",2560,727,false],"thumbnail":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-150x150.jpg",150,150,true],"medium":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-300x85.jpg",300,85,true],"medium_large":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-768x218.jpg",768,218,true],"large":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-1024x291.jpg",1024,291,true],"1536x1536":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-1536x436.jpg",1536,436,true],"2048x2048":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/Elastic_Security-scaled-1-2048x582.jpg",2048,582,true]},"uagb_author_info":{"display_name":"lea.mitteaux","author_link":"https:\/\/devoteam.info\/en-nl\/author\/"},"uagb_comment_info":0,"uagb_excerpt":"This week we attended the Webinar Elastic Security Capture the Flag for Partners. Elastic has set up an introduction around Elastic SIEM and Elastic security in a fun but interesting way. After the introduction about Elastic and more in depth Elastic Security, including a short demo it was time for the game. The challenge First&hellip;","_links":{"self":[{"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/expert-view\/601849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/expert-view"}],"about":[{"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/types\/expert-view"}],"version-history":[{"count":0,"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/expert-view\/601849\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/media\/353758"}],"wp:attachment":[{"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/media?parent=601849"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/categories?post=601849"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/tags?post=601849"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/devoteam.info\/en-nl\/wp-json\/wp\/v2\/industry?post=601849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}