Investigating with ELK 101

• Logstash is used to visualize the data. (yay / nay)

nay

• Elasticstash supports all data formats apart from JSON. (yay / nay)

nay

• Select the index vpn_connections and filter from 31st December 2021 to 2nd Feb 2022. How many hits are returned?

2861

• Which IP address has the max number of connections?

238.163.231.224

• Which user is responsible for max traffic?

james

• Apply Filter on UserName Emanda; which SourceIP has max hits?

107.14.1.247

• On 11th Jan, which IP caused the spike observed in the time chart?

172.201.60.191

• How many connections were observed from IP 238.163.231.224, excluding the New York state?

48

• Create a search query to filter out the logs from Source_Country as the United States and show logs from User James or Albert. How many returns were returned?

161

• As User Johny Brown was terminated on 1st January 2022, create a search query to determine how many times a VPN connection was observed after his termination.

1

• Which user was observed with the greatest number of failed attempts?

Simon

• How many wrong VPN connection attempts were observed in January?

274