jupyter2kibana VS nbdev

For context, if you didn't read the linked post, our team uses ELK stack as our SIEM, and a few of us wanted to set up a test lab to practice threat hunting on ELK. And we needed to do it on a Hobbyist budget. And we wanted to apply the data-science (inspired by this) strengths of Jupyter to our hunting workflow, since all of us already know Python.

Big picture: We want to work out an in-depth ELK workflow and develop some threat hunting automation. I found that a small ELK stack is hosted for a very reasonable price ($0.0263/hr for a small stack w/ 45GB storage as of today). And a CoCalc instance (collaborative cloud-hosted JupyterLab) costs another $6 per month. So between those two low-cost resources we've figured out a pretty neat Python -> Vega -> Kibana workflow to apply some data science and visualization to our threat-hunting workflow (after some trouble).

Here's the example referred to as well as the overarching project which inspired us to try this.

Elastic Eland (Python Elasticsearch client for exploring and analyzing data in Elasticsearch)

One example I've seen is ML/DL folks using jupyter notebooks to develop DL libraries in jupyter notebooks, see https://github.com/fastai/nbdev

- https://github.com/fastai/nbdev: Increase developer productivity by 10x with a new exploratory programming workflow.

9. Nbdev: Boost developer productivity with an exploratory programming workflow - https://nbdev.fast.ai/

See if you like nbdev way of working with data through python and jupyter. nbdev is an optional part that will create python packages from jupyter notebooks. Also even the simple tutorials are opinionated and will guide you to unit test your code and write CICD pipelines.

You probably don’t have time for this for the purposes of your task, but I will also throw in the recommendation of nbdev especially if you’re a Python person. I haven’t had a project to use it on yet, but I’ve gone through the docs and the walkthrough and it seems like a great framework for starting potential projects with all the infrastructure needed for if/when they eventually get big and need all the packaging and stuff

nbdev: jupyter notebooks -> python package

Take a look at https://github.com/fastai/nbdev - haven't used it but supposedly the whole if fast.ai library was written that way. It sounds like a natural direction in your scenario - allowing your to keep working in a familiar environment and still producing production ready code (will, at least in paper 😅)