Ansible EFK Stack 自动化部署
-
Updated
Oct 14, 2025 - Python
#
elastalert2
Here are 5 public repositories matching this topic...
A from-scratch modernization of HELK (The Hunting ELK) — rebuilding its threat-hunting pipeline (Elasticsearch, Kibana, Logstash, Kafka, ElastAlert2/Sigma, Spark/GraphFrames, Jupyter) on currently maintained software.
elasticsearch kibana logstash kafka apache-spark docker-compose jupyter-notebook dfir cybersecurity threat-hunting siem elk-stack graphframes mitre-attack helk detection-engineering sigma-rules elastalert2
-
Updated
Jul 18, 2026 - Jupyter Notebook
A concise collection of ElastAlert2 rule files used by the Cyberfortress project. Each rule is provided as a YAML file inside the rules/ directory and is intended for use with an ElastAlert2 deployment.
-
Updated
Dec 24, 2025
Install and configure ElastAlert 2 using Ansible.
-
Updated
Mar 25, 2026 - Python
Deployable Splunk app for SSH auth-log analysis: 9 correlation searches (brute force, credential stuffing, impossible travel, dormant accounts) mapped to MITRE ATT&CK + CIM, fed by live Tor/abuse.ch/Spamhaus threat intel. Full Elastic 8.15 + ElastAlert 2 port. Verified against real Hydra traffic.
ssh elasticsearch splunk cybersecurity brute-force siem soc threat-intelligence blue-team mitre-attack security-analytics credential-stuffing splunk-app detection-engineering elastalert2
-
Updated
Oct 15, 2026 - Python
Add this topic to your repo
To associate your repository with the elastalert2 topic, visit your repo's landing page and select "manage topics."