Lecture 4 pt. 6

Question 1

What is Kibana?

Answer 1

Kibana is a browser-based analytics and search dashboard for Elasticsearch.

Question 2

What is Logstash?

Answer 2

Logstash is a pipeline processing system that connects ‘inputs’ to ‘outputs’ with optional ‘filters’ in between.

Question 3

What is Elasticsearch?

Answer 3

Elasticsearch is a document-oriented full-text search engine.

Question 4

What does ELK stand for?

Answer 4

ELK stands for:
* Elasticsearch
* Logstash
* Kibana

Question 5

What is Security Onion?

Answer 5

Security Onion is an open-source product that includes the ELK suite to provide SIEM functionality.

Question 6

What are two popular proprietary SIEM systems?

Answer 6

Two popular proprietary SIEM systems are:
* SolarWinds Security Event Manager
* Splunk Enterprise Security

Question 7

What is Squert?

Answer 7

Squert is a web application used to query and view event data stored in a Sguil database, such as IDS alert data.

Question 8

How is Sguil pronounced?

Answer 8

Sguil is pronounced ‘sgweel’.

Question 9

What is Sguil?

Answer 9

Sguil is an intuitive SIEM GUI that provides access to real-time events, session data, and raw packet captures.