invoke-atomicredteam VS jupyter2kibana

Or if you want something with more features - use Atomic Red Team tests (https://github.com/redcanaryco/invoke-atomicredteam)

Also, if you want to use Atomic Red Team (which you should), look towards https://github.com/redcanaryco/invoke-atomicredteam, a framework for automating usage of tests through that.

powershell-based - https://github.com/redcanaryco/invoke-atomicredteam

However, I've been tinkering with this for a few days now without success so far. I'm running into bugs and also am simply uncertain whether this is even viable. For example, I don't know if the Windows images offered for Docker will support the commands run by the PowerShell testing suite we have in mind for simulating threats, Invoke-AtomicRedTeam. Theoretically, everything should work fine. I'm also curious if someone else has already done this and published setup scripts or anything to help.

For context, if you didn't read the linked post, our team uses ELK stack as our SIEM, and a few of us wanted to set up a test lab to practice threat hunting on ELK. And we needed to do it on a Hobbyist budget. And we wanted to apply the data-science (inspired by this) strengths of Jupyter to our hunting workflow, since all of us already know Python.

Big picture: We want to work out an in-depth ELK workflow and develop some threat hunting automation. I found that a small ELK stack is hosted for a very reasonable price ($0.0263/hr for a small stack w/ 45GB storage as of today). And a CoCalc instance (collaborative cloud-hosted JupyterLab) costs another $6 per month. So between those two low-cost resources we've figured out a pretty neat Python -> Vega -> Kibana workflow to apply some data science and visualization to our threat-hunting workflow (after some trouble).

Here's the example referred to as well as the overarching project which inspired us to try this.

Elastic Eland (Python Elasticsearch client for exploring and analyzing data in Elasticsearch)