RedELK for Red Team SIEM and Blue Team Detection

RedELK is a centralized security information and event management (SIEM) platform designed specifically for authorized red team operations. It collects operational logs from command-and-control (C2) servers and traffic logs from redirectors, helping teams review their activity, investigate historical events, and identify signs that a blue team may be monitoring their infrastructure.

Unlike a conventional SIEM built primarily for defenders, RedELK focuses on red team visibility and operational security. It brings information from multiple servers and long-running engagements into one searchable interface, making it easier to review activity across teams, operators, and scenarios.

Key Features of RedELK

• Centralized operational logging: Collects and enriches logs from multiple teamservers, creating a unified view of activity across an engagement.
• Historical investigation: Makes it easier to search past events during multi-team, multi-server, or multi-month operations.
• Artifact access: Provides convenient access to supported operational artifacts, including screenshots, keystroke records, and beacon logs.
• Redirector traffic monitoring: Aggregates traffic logs from redirectors so operators can investigate connections and identify patterns that may indicate blue team investigation.
• Log enrichment: Uses Python scripts to add useful context to collected events and support detection queries and alerts.
• Centralized dashboards: Uses Kibana to help operators search, filter, and visualize collected information.

How RedELK Works

RedELK combines several components from the Elastic Stack with additional synchronization and enrichment scripts. Each component performs a specific role in the logging pipeline.

• Filebeat: Ships supported log data from monitored systems to the collection pipeline.
• Logstash: Processes, filters, and enriches incoming events before storage.
• Elasticsearch: Stores indexed events and supports searches across collected records.
• Kibana: Provides dashboards and a searchable interface for investigating operational and redirector traffic data.
• Rsync: Synchronizes additional teamserver data, including supported logs and artifacts.
• Nginx: Provides web access controls and serves supported artifacts through the browser.
• Python scripts: Perform additional enrichment and help identify patterns associated with potential blue team activity.

This architecture separates data collection, processing, storage, and visualization. For background on the underlying log pipeline, see the official Logstash pipeline documentation.

RedELK for Red Team Operations

During a complex engagement, operators may work across multiple C2 servers and redirectors. Reviewing each system independently can make it difficult to reconstruct a timeline or understand how separate activities relate to one another. RedELK brings supported records into a central location, helping teams search events and review activity across the operation.

The same centralized view can help authorized white team members oversee an exercise without needing direct access to every operational server. Access permissions should be configured carefully, particularly when logs contain sensitive testing artifacts or operator activity.

Detecting Blue Team Activity

RedELK also analyzes redirector traffic to help identify possible signs of defensive investigation. Specific searches, enrichment logic, and alerting rules can highlight patterns that warrant further review. These signals may indicate that defenders are examining infrastructure associated with an engagement, although a single event should not automatically be treated as proof of detection.

Detection quality depends on accurate redirector logging, suitable configuration, and the rules used to interpret collected events. Teams should validate alerts against the wider engagement timeline before drawing conclusions.

Getting Started with RedELK

RedELK is an open-source project maintained in the official RedELK GitHub repository. Its documentation covers system requirements, installation, server configuration, supported tooling, and operational use.

Before deployment, review the project’s official wiki and verify compatibility with your C2 framework, redirector software, and Elastic Stack components. The project has published beta releases, so check the current release status and test the deployment in a controlled environment before relying on it for an engagement.

For more tools used in digital investigations, explore our forensic toolkit collection.