jupyter2kibana VS PurpleCloud

For context, if you didn't read the linked post, our team uses ELK stack as our SIEM, and a few of us wanted to set up a test lab to practice threat hunting on ELK. And we needed to do it on a Hobbyist budget. And we wanted to apply the data-science (inspired by this) strengths of Jupyter to our hunting workflow, since all of us already know Python.

Big picture: We want to work out an in-depth ELK workflow and develop some threat hunting automation. I found that a small ELK stack is hosted for a very reasonable price ($0.0263/hr for a small stack w/ 45GB storage as of today). And a CoCalc instance (collaborative cloud-hosted JupyterLab) costs another $6 per month. So between those two low-cost resources we've figured out a pretty neat Python -> Vega -> Kibana workflow to apply some data science and visualization to our threat-hunting workflow (after some trouble).

Here's the example referred to as well as the overarching project which inspired us to try this.

Elastic Eland (Python Elasticsearch client for exploring and analyzing data in Elasticsearch)

We looked into pre-configured, plug-and-play options. One project (leveraging Ansible) is called PurpleCloud. Probably because running even a handful of Windows VMs on a PC can get pretty slow, pretty fast, their project spins this network up on Azure. However, the estimated monthly cost of the cloud resources is not attractive; over $300 per month. While it's true that we would not need to run the lab every day resulting in lower cost, I think we would want to run new tests fairly often, especially if multiple analysts are using it (and I already know the burn of forgetting an EC2 instance on for a week or two).