Hello, people.
I'm looking for some article that have relative to "how to be guru in security monitoring".
For example, i'm using splunk + ossec + auditd, monitoring bash history,
I'm not monitoring network (so, any tips about it will be cool). How to example, monitoring linux firewall?

Maybe, any information that can help me detect bad hackers who want to get access to my PC (indicators of compromise).

For me it's shit monitoring and I'm junior in this issue, so any guides will be help me.

Thank you!

Google and other search engines proves a really good search tool for articles on whatever topic.
I am not googling around here pun intended.

https://www.google.com/search?q=splunk+firewall

Splunk s good on documentation.

I utilized ELK and professionals forward their logs to a centralized server.

"linux firewall" could be elaborated on.
I used https://www.digitalocean.com/community/search?q=ELK
to conquer my logs.

Which "linux firewall" are you monitoring? There is no 'guide' to security...it's a process. You need to first understand the topic, and it's fairly clear you don't have much of an idea about it now. As habitual stated, Google can get you started.
Again, which PC? Running what services? On what kind of network, behind what firewalls? With what open ports??? Your question is sort of like asking "how high is up?" Without context, it has no meaning.
You need to read the LQ Rules, and quit using profanity. If you want to be more than 'junior in this issue', you need to **LEARN** things. It doesn't appear as if you have a good idea what the topic of computer security entails. Without knowing the basics, you can't learn anything advanced.

Since you probably found THIS site with a Google search, go back there and put things in like "basics of computer security", and learn the CONCEPTS. Build on them, and learn how they apply to different systems/network. Then learn more...and prepare to keep learning the rest of your life, because it is a NEVER ENDING process.

Want to be a 'guru' and keep your computer 100% safe? Lock it in a metal room, and don't ever connect it to a network. Aside from that...you're ALWAYS vulnerable.

1 members found this post helpful.

No network monitoring?
Why is it "shit monitoring"?

Advice: They give the good jobs to those whose do "shit" jobs well.

Good Luck!

It's always the hard lessons I remember best.

Think back on this.

Have a look at snort. It'll keep you busy for a while.