Operations | Monitoring | ITSM | DevOps | Cloud

It’s a metaphor that would have been impossible to decode even a decade ago: a Command and Control environment where essential data flows as quickly and intuitively as a map on Uber or Lyft. It’s a way of imagining efficient access to up-to-the-minute mission-relevant information, so that any sensor can make useful intelligence available to any device or effect, on a single screen, in time to make a difference.

When the coronavirus pandemic hit Asia-Pacific back in January, no one knew what to expect. As the first region to grapple with the questions and uncertainties that the virus presented, leaders had to process the new reality and spring into action at record speed. While navigating the shifting landscape has been a unique journey for all organizations, a few things have proven to be consistent.

In Part 1 of this blog series, we took a look at how we could use Elastic Stack machine learning to train a supervised classification model to detect malicious domains. In this second part, we will see how we can use the model we trained to enrich network data with classifications at ingest time. This will be useful for anyone who wants to detect potential DGA activity in their packetbeat data.

Monitoring requires a multi-faceted approach if DevOps teams want end-to-end visibility and deep insight into issues. This is especially true in the case of modern microservices applications, which are essentially collections of distributed services that talk to each other over a service mesh. With monolithic applications, requests can be tracked easily from the client to the server and back, but with modern applications, every request passes through numerous services before completion.

In today’s digital world, every transaction is logged to give businesses endless amounts of functional data, and there is near-universal agreement that data insights will be integral to the success of businesses in the future. There is undoubtedly a need for a more data literate workforce.

This post is the second in our Kubernetes observability tutorial series, where we explore how you can monitor all aspects of your applications running in Kubernetes, including: We’ll cover using Elastic Observability to ingest and analyze container metrics in Kibana using the Metrics app and out-of-the-box dashboards.

Unless you’ve been living under a rock you are probably familiar with the recent Shadow Brokers data dump of the Equation Group tools. In that release a precision SMB backdoor was included called Double Pulsar. This backdoor is implemented by exploiting the recently patched Windows vulnerability: CVE-2017-0143. For detection, we are going to first focus on the backdoor portion of the implant, hunting for traces left behind on the network.