Threat Hunting Using Elastic Stack: An Evaluation

Information Technology (IT) is now widely adopted in current business and organizations, which refers to the usage of any computers, networking and physical devices to help create, exchange and handle electronic data. While cyber-attacks are one major threat to IT based systems and networks. A successful attack can cause a major business loss, thus every organisation has their own information security measures. Among them, logging and monitoring is one important security measure to prevent an organization from threats. In particular, threat hunting is a significant approach to identify intruders. In this paper, our purpose is to study how well the Elastic stack tool can be used in threat hunting and compare it with four similar tools. It is found that Elastic Stack tool can be effective in detecting the threats/security events as well as cost-efficient while implementing on a large-scale environment.