Author

Articles by Aaron Jewitt

Principal Security Analyst, Elastic

Videos

Inventory to insight: How Elastic’s asset inventory powers InfoSec use cases

See how Elastic’s asset inventory has evolved into a critical tool for InfoSec, transforming from a basic inventory to a powerful solution that addresses real-world cybersecurity challenges.

Videos

Reducing false positives with automated SIEM investigations from Elastic and Tines

Discover how Elastic's InfoSec team saves thousands of hours per month by using Tines to automate SIEM alert investigations while reducing false positives and detect compromised accounts.

Videos

Detecting account compromise with UEBA detection packages

Detecting a compromised account is one of the most challenging detections to build. This blog shows one approach we are using internally at Elastic to create detections that alert when multiple new events are seen for a user.

Videos

Detection engineering — Maximizing analyst efficiency using Cardinality Threshold rules on your alerts

Using Threshold rules to create alerts on your alerts is a great way to maximize your analyst effectiveness without sacrificing visibility. By using these rules, security analysts spend less time investigating false positives.

Videos

This blog is a guide to configuring Elastic’s Security App to work with Cross Cluster Search

Videos

Elastic on Elastic Series: Data collected to the Infosec SIEM

In this series of blogs we will provide an overview of our architecture, what data we send to our clusters, how and why we use Cross Cluster Search with the Security and Machine Learning (ML) applications, and how we tune, manage and notify.

Videos

Elastic on Elastic: Deep dive into our SIEM architecture

Take a deep dive into Elastic Infosec team’s architecture, the many sources of data collected for security uses, how and why cross-cluster search is used, and how to configure Elastic Security and machine learning to work with cross-cluster search.

Videos

How to build a malware analysis sandbox with Elastic Security

In this blog post, we will demonstrate how the Elastic Infosec team uses the Elastic Stack with Elastic Endpoint Security to build a fully instrumented malware analysis sandbox using free software.