Elastic Security SIEM
Modern, cost-efficient SIEM with years of searchable data.
RedELK
Centralized SIEM for Red Teams to monitor and detect Blue Team activity
RedELK aggregates operational and traffic logs from multiple Red Team assets, enriches data, and provides searchable dashboards and alerts to spot Blue Team investigations and streamline long‑term operations.
Overview
Overview
RedELK is built for Red Team operators, White Team overseers, and security consultants who need a single pane of glass for all operational logs across multi‑scenario, multi‑team engagements. It centralizes logs from teamservers and redirectors, enriches them, and stores the data in Elasticsearch for fast, historic searching and forensic analysis.
Capabilities
The platform visualizes enriched data through Kibana dashboards, offering read‑only views for White Teams and easy access to screenshots, IOCs, keystrokes, and other artifacts. Pre‑configured queries highlight Blue Team investigative activity, enabling rapid detection and response. Alerts can be customized via Logstash pipelines.
Deployment
RedELK ships as Docker images for Elasticsearch, Logstash, Kibana, Jupyter, and supporting services, with Ansible playbooks for both server and client setup. It runs on‑premise or in cloud environments and is released under the BSD‑3‑Clause license.
Highlights
Centralized aggregation of operational logs from multiple Red Team servers
Enriched traffic logs from redirectors enabling detection of Blue Team investigations
Searchable Kibana dashboards with built-in views for screenshots, IOCs, and keystrokes
Containerized components and Ansible playbooks for rapid deployment and scaling
Pros
- Provides a unified view across multi‑scenario, multi‑team operations
- Facilitates historic hunting and forensic analysis
- Read‑only mode supports White Team oversight without risk
- Extensible via Elasticsearch queries and custom alerts
Considerations
- Requires Elasticsearch/Kibana stack, which may be resource‑intensive
- Initial setup complexity for teams unfamiliar with Docker or Ansible
- Alert tuning may need domain expertise to avoid noise
- Primarily focused on Red Team use‑cases; may lack generic SIEM features
Managed products teams compare with
When teams consider RedELK, these hosted platforms usually appear on the same shortlist.
Looking for a hosted option? These are the services engineering teams benchmark against before choosing open source.
Fit guide
Great for
- Red Teams conducting long‑duration engagements across multiple infrastructures
- Security consultants needing a replayable audit trail of offensive operations
- White Teams that require a read‑only operational overview for compliance
- Organizations that already run Elastic stack and can integrate additional containers
Not ideal when
- Small, single‑host red‑team exercises with minimal logging needs
- Teams without access to sufficient compute resources for Elasticsearch
- Environments that require out‑of‑the‑box commercial SIEM dashboards
- Users seeking a turnkey solution without any configuration effort
How teams use it
Multi‑team Red Team campaign monitoring
Aggregates logs from all teamservers, enabling coordinated analysis and real‑time alerts across the entire operation.
Detecting Blue Team reconnaissance
Queries enriched redirector traffic to flag when defenders probe compromised assets, allowing immediate tactical response.
White Team compliance review
Provides a read‑only Kibana view of all activity, screenshots, and IOCs for audit without exposing control capabilities.
Post‑engagement forensic hunting
Allows investigators to search historic logs months later to uncover missed indicators or refine future tactics.
Tech snapshot
Python61%
Shell34%
Ruby2%
Dockerfile1%
Jupyter Notebook1%
Frequently asked questions
What components are required to run RedELK?
RedELK relies on Elasticsearch, Logstash, Kibana, and optional Jupyter; each component is available as a Docker image and can be orchestrated via the provided Ansible playbooks.
Can RedELK be used for defensive monitoring?
The project is designed for Red Team operations; while it can ingest defensive data, its alerts and dashboards focus on spotting Blue Team activity against offensive infrastructure.
How does RedELK detect Blue Team activity?
It enriches traffic logs from redirectors and provides pre‑built queries that identify patterns typical of defender investigation, such as repeated scans or credential checks.
Is there a licensing cost?
RedELK is released under the BSD‑3‑Clause license and can be used, modified, and redistributed freely.
What level of expertise is needed to deploy?
Familiarity with Docker and basic Ansible usage is recommended; the documentation includes step‑by‑step guides for both manual and automated installations.
Project at a glance
Active- Stars
- 2,611
- Watchers
- 2,611
- Forks
- 395
LicenseBSD-3-Clause
Repo age7 years old
Last commitlast month
Primary languagePython
Last synced yesterday