Add practical Elastic Security examples for DNS tunnel detection and small-business/home SIEM collection patterns.
What is included
- DNS tunnel detection Packetbeat configuration, index template, and unique-hostnames watch.
- SIEM-at-Home Beats configurations for Windows, CentOS, macOS, syslog, and Packetbeat.
- Source README files and Apache 2.0 license.
Who it helps
Security teams can adapt these examples for lab detections, home-lab SIEM learning, or small-environment monitoring patterns.
Compatibility
The DNS tunnel README states Elastic 6.0. The SIEM-at-Home README states Elastic Stack 7.4. Tagged as 6.x and 7.4 compatibility.
Source and license
Source: elastic/examples Security Analytics. The upstream repository is licensed under Apache 2.0.
The ZIP attached to this draft contains the reusable upstream files plus the available license or notice files.
| Tested versions | 6.x, 7.4 |
| ECS compliant | |
| Tested versions |
You must log in to submit a review.