2021-005-Ronnie Watson (@secopsgeek), building a security monitoring system with ELK, and Wazuh

<p><span style="font-weight: 400;">Ronnie Watson (@secopsgeek)</span></p> <p><span style="font-weight: 400;">Youtube:</span> <a href= "https://www.youtube.com/channel/UChTkzU9VwalbWs_GJlILJDQ"><span style="font-weight: 400;"> watson infosec - YouTube</span></a></p> <p><a href="https://github.com/watsoninfosec"><span style= "font-weight: 400;">watsoninfosec (Watsoninfosec) · GitHub</span></a></p> <p><span style="font-weight: 400;">Wazuh - fork of OSSEC (</span><a href= "https://wazuh.com/migrating-from-ossec/"><span style= "font-weight: 400;">Migrating from OSSEC · Wazuh · The Open Source Security Platform</span></a><span style= "font-weight: 400;">)</span></p> <p> </p> <p><a href="https://github.com/ossec/ossec-hids"><span style= "font-weight: 400;">GitHub - ossec/ossec-hids: OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.</span></a></p> <p><a href= "https://www.giac.org/paper/gsec/1641/implementing-network-security-metrics-programs/103004"> <span style="font-weight: 400;">Implementing a Network Security Metrics Programs (giac.org)</span></a></p> <p><span style="font-weight: 400;">What to track.</span></p> <p><span style="font-weight: 400;">Some suggested metrics to start with: </span></p> <ol> <li><span style="font-weight: 400;">Number of Successful Logons – from security audits. </span></li> <li><span style="font-weight: 400;">Number of Unsuccessful Logons – from security audits. </span></li> <li><span style="font-weight: 400;">Number of Virus Infections during a given period. </span></li> <li><span style="font-weight: 400;">Number of incidents reported. </span></li> <li><span style="font-weight: 400;">Number of security policy violations during a given period. </span></li> <li><span style="font-weight: 400;">Number of policy exceptions during a given period. </span></li> <li><span style="font-weight: 400;">Percentage of expired passwords.</span></li> <li><span style="