Kibana: OpenSOC CTF Tool Demo
Demonstrates using Kibana to query, visualize, and analyze security event logs during the OpenSOC defense CTF.
Summary
OpenSOC Incident Response CTF
OpenSOC is a defense capture-the-flag competition designed to train and evaluate practical incident response skills within a realistic enterprise environment.
Centralized Log Analysis with Kibana
Kibana serves as the primary visualization and exploration interface for the Elastic Stack, enabling defenders to search through massive volumes of network and endpoint telemetry during an active breach.
Hands-On Investigation Workflows
The session covers constructing Lucene queries, building situational dashboards, and correlating disparate log sources to reconstruct attacker activities during the competition.
Related talks
Blue Team Village·9 min
Whitney Champion
Demonstrates using Osquery SQL syntax to query endpoint state and investigate security incidents during the OpenSOC defense CTF.
Blue Team Village·34 min
Project Obsidian
Project Obsidian breaks down the Observe-Orient-Decide-Act (OODA) loop applied to real-time incident triage and crisis response.
Blue Team Village·43 min
Mike Cohen
Demonstrates endpoint hunting, artifact collection, and forensic querying using Velociraptor VQL in OpenSOC.