Network security enhancement through effective log analysis using ELK

Abstract

The main aim for any organization is to provide protection for their critical assets because they are face to face with many external threats that may cause interruption on providing services to customers which will lead to economical and reputation disaster. As long as organizations need to provide the protection required to secure their business they have to focus on two types of threats, internal and external threats. In previous paper [1] I have discussed about external threats and in this paper I will draw more attention on how the internal threats that will affect the overall network security mechanism. Log analysis can also help us to reveal the gap existed on our safeguards, which used to provide a protection for our systems, by which we can have a knowledge from the information extracted from our data that will help us to be aware of the gaps and vulnerabilities may found to resolve them before we become victims. For log analysis I will use ELK stack that will help me to receive the forwarded logs from a well-known commercial safeguard deployed in a real environment.