Elastic Endpoint Security Lab

The Elastic Endpoint Security Lab is a capability of the Advanced Technology Center (ATC) designed to provide an environment to gain hands-on experience with the fundamental features of Elastic Endpoint Security.

Endpoint detection and response (EDR) is an integrated endpoint security solution that combines real-time monitoring with rule based response. First generation EDR tools are becoming ineffective due to lack of efficiency in detecting fast moving threat and with increase visibility comes increased amounts data and analysis.

Elastic Security provides a different approach to EDR by combing EDR and SIEM capabilities which leads to reduced mean time to detect and respond to threats. Elastic Security for endpoint prevents ransomware and malware, detects advanced threats and arms responders with vital investigative context, such as prioritized detections to help stop alert fatigue.

The goal of this lab is to introduce users to XDR technology through the use of Elastics Endpoint Security solution. This lab will help users develop proficiency in navigating Kibana console by reviewing security detection rules and navigating alerts, monitoring and response capabilities of Elastic Endpoint Security. This lab utilizes a Kali Linux machine to perform simulated attacks that compromise an endpoint allowing the user to see how Elastic Endpoint Security responds.

This lab environment allows you to:

• Review the key features of Elastic Endpoint Security
• Simulate attacks to compromise an endpoint
• Create a Case around a group of attacks
• Perform Host Isolation

Software

• 1x Elasticsearch
• 1x Kibana

Servers

• 1x Ubuntu Server
• 1x Windows 2012 Server
• 1x Windows 2016 Server
• 2x Windows 2019 Server

Clients

• 4x Windows 10 Client (Windows 10 Enterprise)
• 2x Windows 7 Clients
• 1x Attack Client Software (Kali Linux & Metasploit)