Blueteam 16 Identificación de amenazas con tecnología Machine Learning

PRACTICE STEPS https://mega.nz/file/1lpimSJT#rGrATVI... FILES https://mega.nz/folder/phYH2SCS#s9QFy... PART 1: Prepare the Elasticsearch Database Load an index template with all the necessary fields and mappings. Run an Ingest pipeline for date transformation, field expansion, and IP geolocation. Run an orchestration pipeline to store the data in an Elasticsearch index. PART 2: Deploy a Threat Analysis Using the Single Metric Machine Learning Method Create a data view called webapp. Create a single metric anomaly detection job using the data view. Configure the anomaly detection parameters in the job. Interpret the results and conclusions obtained. PART 3 Amount of data sent and received via multimetric anomaly In parts 1 and 2, we were able to determine when the security incident occurred. This time, with the help of multimetric analysis, influencers, and the Split Field analysis, we will be able to determine what, who, and where. PART 4 ​​Population analysis: Population, IP vs. time Confirm that it is a Denial-of-Service attack. Isolate and unequivocally identify the responsible IP (population). Define security actions to contain or mitigate the attack.