Graylog: OpenSOC CTF Tool Demo
Demonstrates deploying and querying Graylog centralized log management for real-time threat investigation in OpenSOC.
Summary
Centralized Logging for Incident Response
Graylog provides high-performance log collection, parsing, and search capabilities, enabling defenders to monitor diverse event streams across enterprise environments.
Tool Demonstration for the OpenSOC CTF
This walkthrough shows participants how to navigate Graylog's web interface, construct pipeline rules, and filter complex server logs to uncover attacker activities during the OpenSOC competition.
Accelerating Log Investigation Workflows
The session highlights practical querying strategies, dashboard visualization techniques, and stream configurations to rapidly isolate indicators of compromise during live incidents.
Related talks
Blue Team Village·36 min
Defenders explore unconventional log analysis techniques, correlating seemingly unrelated telemetry sources to uncover stealthy enterprise intrusions.
Blue Team Village·31 min
Tim Johnson
Demonstrates using Kibana to query, visualize, and analyze security event logs during the OpenSOC defense CTF.
Blue Team Village·33 min
Zeek Team
Shows how to analyze network traffic, extract protocol metadata, and identify malicious connections using Zeek in OpenSOC.