Marc Smeets

As far as RedELK goes I would like keep the C2 adapters as simple and default as possible. That means that for current supported C2 frameworks PoshC2 we ingest text...

Please don't overdo it ;-) If you can get the same level of details as Cobalt Strike does, it should be good!

Awesome! Do you have any examples of the logs it generates? Also paging @fastlorenzo , you may want to take a loot at this

Great, thank you. Whats the quickest way to get some example logs for us to work with? /cc @fastlorenzo

Thank you, this helps to get started and very much looks like something that we can work with! We'll take this up when we closed off some pending issues on...

I believe this happens when there is no data yet in ES. Might that be the case for you?

Not sure if duplicate.

Below the full list of bad words that should be checked against. I created this by carving the documentation by the domain classifiers. Some words are cut short for easier...

After discussion with @fastlorenzo, decided that this first needs restructuring of how we handle domain info. So this is pending on #270

Thanks for brining this to our attention. We are limited in time so I don't see us picking this up in the very near future. Happy to help you though...