Investigating with ELK 101

Walkthrough summary

Investigating with ELK 101 TryHackMe walkthrough with 12 answered prompts and lab methodology notes.

Sample prompts covered

• Logstash is used to visualize the data. (yay / nay)
  Open the walkthrough page to inspect the full answer and command flow.
• Elasticstash supports all data formats apart from JSON. (yay / nay)
  Open the walkthrough page to inspect the full answer and command flow.
• Select the index vpn_connections and filter from 31st December 2021 to 2nd Feb 2022. How many hits are returned?
  Open the walkthrough page to inspect the full answer and command flow.
• Which IP address has the max number of connections?
  Open the walkthrough page to inspect the full answer and command flow.
• Which user is responsible for max traffic?
  Open the walkthrough page to inspect the full answer and command flow.