$ show activecm/BeaKer
BeaKer is a self-contained threat-hunting deployment for Windows network beacon detection. It provisions an Elasticsearch/Kibana backend with Docker Compose, configures Windows endpoints via a PowerShell agent installer, and ships prebuilt index templates, ingest pipelines, and Kibana dashboards for Sysmon event data. The dominant character is an application/infrastructure project: the core artifacts are deployment scripts, Ansible playbooks, and ELK configuration rather than a library or data analysis framework. A secondary data-pipeline nature is visible in the Elasticsearch ingest pipelines that normalize Windows Security/PowerShell/Sysmon events into ECS, and in the export/import tooling for dashboards and indices.
The LLM identified 2 files worth highlighting for reuse:
Standalone PowerShell script that installs Sysmon and Winlogbeat on a Windows host, generates a Sysmon config, configures the Elasticsearch output including keystore credentials, and starts both services. It is self-contained and parameterized, so it can be lifted into other Windows log-shipping setups with minimal changes.
Elasticsearch ingest pipeline that maps over 100 Windows Security event IDs to ECS categories and types, and enriches logon types, Kerberos options, UAC flags, SIDs, and failure reasons. The logic is self-contained in a JSON pipeline and can be adapted to normalize Windows event logs in any Elastic Stack without coupling to this repository's dashboards.