performing-threat-hunting-with-elastic-siem

【效率与协作】Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.

独立 GitHub 快照 · 自动分类 · 以原作者文档为准