skills.rest
SeeKT
SeeKTCOMMUNITY
Explore all skills by this author →
GitHub

elk-skill

Analyze Windows Event Logs and Sysmon data with Elastic Stack to detect Active Directory threats.

Updated Jan 2, 2026
Search Tags:#elasticsearch#sysmon#kerberos#elk#kibana#windows-event-logs#logstash
One-click install
npx skills add https://github.com/SeeKT/Active-Directory-Forge-Ticket-Agent-ELK --skill elk-skill
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: elk-skill
Source: https://github.com/SeeKT/Active-Directory-Forge-Ticket-Agent-ELK/tree/main/.github/skills/ELK
Command: npx skills add https://github.com/SeeKT/Active-Directory-Forge-Ticket-Agent-ELK --skill elk-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and assets (resource) components.

What problem does it solve?

This Skill enables security teams to detect Active Directory threats by analyzing Windows Event Logs and Sysmon data with the Elastic Stack.

Core Features & Use Cases

  • Elastic search query templates to detect Kerberos abuse and Pass-the-Hash patterns across DC and clients.
  • Logstash pipelines to normalize Windows security events and Sysmon data for unified dashboards.
  • Kibana dashboards for incident timeline, network activity, and persistence detection; supports threshold-based alerts.
  • Use Case: A SOC can ingest Windows Event Logs and Sysmon into Elasticsearch, then identify suspicious AD activity and generate actionable alerts.

Quick Start

Open Kibana and load the ELK-based AD threat dashboards. Run the sample queries to identify Kerberoasting and Pass-the-Hash patterns. Review the provided scripts in scripts/ to understand detection pipelines.

Frequently Asked Questions about elk-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Kerberos abuse and Pass-the-Hash in Active Directory?▼

You can detect Kerberos abuse and Pass-the-Hash in Active Directory by analyzing Windows Event Logs and Sysmon data with Elastic Stack query templates designed to identify suspicious authentication patterns across domain controllers and clients.

How do I normalize Windows security events and Sysmon data for unified Kibana dashboards?▼

Normalize Windows security events and Sysmon data for Kibana dashboards by configuring Logstash pipelines to parse and standardize the ingested logs, enabling a unified view for incident timelines and network activity monitoring.

Can I use Elastic Stack for continuous SIEM monitoring and lateral movement threat hunting?▼

Yes, Elastic Stack supports continuous SIEM monitoring and lateral movement threat hunting by ingesting Windows Event Logs and Sysmon data into Elasticsearch to identify suspicious AD activity and generate threshold-based alerts.

What is the best way to visualize incident timelines and persistence detection in Elasticsearch?▼

The best way to visualize incident timelines and persistence detection in Elasticsearch is by loading pre-built Kibana dashboards that aggregate normalized Windows security events and Sysmon data to highlight suspicious activity patterns.

Do I need Sysmon data to detect Active Directory threats with Logstash and Elasticsearch?▼

While you can analyze Windows Event Logs alone, incorporating Sysmon data with Logstash pipelines provides deeper visibility into process creation and network connections, significantly enhancing Active Directory threat detection accuracy.

Related Skills

Explore More Data & Analytics Skills→
xenitV1xenitV1
132

red-team-tactics

Model attacker techniques mapped to MITRE ATT&CK phases for defender simulations.

Community
Intermediate
hmzainjamilhmzainjamil
1

Security Monitoring

Automate security monitoring, threat detection, and incident response from enterprise logs.

Community
Advanced
dandyedandye
120

hunt-threat

Conduct hypothesis-driven threat hunts across SIEM and telemetry sources with GTI enrichment.

Community
Advanced
robit-manrobit-man

sigma-hunting

Applies Sigma detection rules to logs and converts them to Elasticsearch, Splunk, and grep queries.

Community
Advanced