OS Analysis with HELK

Although many cyber attacks can be identified using endpoint log analysis, it is not possible to identify all of them. There are very few capabilities that only focus on the OS logs and OS data. This makes it difficult to do advanced statistical analysis. This course, OS Analysis using HELK, will show you how to use Hunt ELK to identify adversary endpoint attacks techniques in an enterprise environment. First, you will see how HELK can fill the gap left by Windows event log analysis. Next, we'll show you how to use the advanced hunt features offered by HELK. You'll also learn how to analyze live data to search for adversary activity. This course will equip you with the knowledge and skills to detect these techniques: Bits Jobs T1208, Kerberoasting T1208, and indicator removal on hosts using HELK.