Elastic Stack (ELK)
Log and alert platforms (SIEM) — Elastic
What is this product?
A storage, search and visualisation stack: Elasticsearch stores, Kibana searches and displays. Field names follow the ECS standard — `host.name`, `source.ip` — knowledge that transfers even if you move to another system.
About the company
A Dutch-American company behind Elasticsearch and Kibana. Its stack, known as ELK, is used for search and analytics in general, and a full security product is built on top of it.
What does an analyst do inside it?
- Searches in Kibana with Lucene/KQL such as `host.name: "FIN-WS-014"`.
- Reads the event result from `event.outcome`.
- Builds a quick dashboard to spot the most frequent addresses.
- Opens a Case and records the findings there.
Its search language
These examples are written in the syntax the product itself accepts.
- host.name: "FIN-WS-014"
- event.outcome: failure and user.name: admin
The field names it uses
- event.dataset
- host.name
- user.name
- source.ip
- destination.ip
- event.action
- event.outcome
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Popular at tech companies and platforms; knowing ECS field names is a clear advantage in interviews.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.