Week 8 Challenge: Use ELK for Port Scan Detection

Tags: security , elasticsearch , linux , networking series: Security Engineering Interview Prep published: true 💡 Before you dive in — if you find this useful, please ⭐ star my open source project SecEng-Exercises on GitHub. It's a growing collection of security engineering exercises designed to help engineers write more secure code and break into Security Engineering roles. 📊 Also — I'd love to know why you read security engineering blog posts . Take my 30-second poll here and check the live results. I use the data to write better content. This is Part 2 of the ELK SIEM series. Part 1 covered deploying ELK with X-Pack security and detecting SSH brute force attacks. This post assumes your ELK stack is already running. If not, start with Part 1 first. A Horror Story First A penetration tester lands initial access on a corporate network via a phishing email. Before doing anything noisy, he runs a quiet port scan — probing thousands of ports across dozens of internal hosts, mapping the at