Hi everyone! I’ve been lurking for a while, learning so much from this community, but this is my first real post. I’m still pretty new to Elastic Security, and we just finished our first tabletop ransomware drill. I wanted to share what our dashboard looked like afterwards because, honestly, it was a bit of a wake-up call. It really highlighted where we were blind, and I’m hoping maybe some of you more experienced folks can point me in the right direction for tightening things up.
We set up Elastic Security about six months ago, mainly focusing on our cloud workloads and email server. For the drill, our red team simulated a pretty classic phishing -> credential theft -> lateral movement -> data encryption scenario. Watching the timeline in Elastic was fascinating, but when I built a summary dashboard after the fact, the gaps were glaring.
The biggest blind spot for us was endpoint process lineage. We could see the initial malicious email and the beaconing out, but the detailed parent/child process relationships across our Windows servers were really fuzzy. We had alerts firing, but without that clear process tree, our SOC had a hard time piecing together the exact “blast radius” during the incident. It made response decisions slower.
Another thing that jumped out was a lack of context around user behavior. We saw a service account being used to move laterally, but we had no easy way to correlate that with a baseline of normal activity for that account. Is it normal for this account to spawn PowerShell at 2 AM from a workstation it’s never logged into before? We didn’t have that historical view readily available, so it took manual digging.
I’ve attached a rough mockup of the dashboard (with sanitized data, of course). The red sections basically show where we had no data or where the data was too sparse to be useful.
My main questions are:
* For those of you who’ve been through this, what are the most critical data sources or integrations you added to get better visibility into process execution chains, especially in a mixed Windows/Linux environment?
* How do you handle building behavioral baselines for service accounts? Is that mostly through custom rules and anomaly detection, or are there specific Elastic features or modules you leaned on?
* More broadly, are we just not using the right prebuilt detection rules? Or is this more about ingesting the correct logs in the first place?
I feel like we have a powerful tool but are only using half its potential. Any advice or stories from your own drills would be incredibly helpful. Thanks for letting a newbie share!
one integration at a time
Welcome to the sobering reality of dashboard demos versus actual incident response. You're seeing what most gloss over after a sales cycle. The process lineage gap you found is the rule, not the exception. Vendors love showing you the pretty, pre-canned attack storyboards, but the real environment is always a mess of partial logs and blind spots.
It's good you found this in a drill. Now, consider if your red team was operating under full knowledge of your telemetry gaps. If they were, that's another layer of survivorship bias. The real attack won't be so courteous.
Focusing on cloud and email first is classic. It leaves the on-prem server sprawl, which is usually the actual crown jewel for ransomware, as an afterthought. Your "blast radius" problem starts with your data collection scope.
Your mileage will vary