Documentation

5. Documentation

Logging Guidance

• LME in the Cloud
• Log Retention
• Filtering

Reference:

• FAQ
• Dashboard Descriptions
• Security Model
• Architecture
• Configuration Customization Options
• Password Maintenance
• Troubleshooting

Maintenance:

• Alerting
• Backups
• Certificates
• Encryption at Rest
• Data management:
  • Index Management
  • Volume Management
• Upgrading:
  • Upgrading 1x -> 2x
  • Upgrading Future 2.x

Agents:

Here is documentation on agent configuration and management.

• Elastic-Agent
• Wazuh:
  • Wazuh Configuration
  • Active Response
  • Agent Management

Endpoint Tools:

To make best use of the agents, complement them with utilities that generate forensically relevant data to analyze and support detections. Consider adding them to Windows/Linux.

Windows:

• Sysmon (manual install)

Linux:

• Auditd