RedELK

RedELK is an open-source red team SIEM (Security Information and Event Management) system built on the Elastic Stack that provides operational security monitoring and campaign tracking for long-running red team engagements. It aggregates logs from Cobalt Strike, redirectors, phishing infrastructure, and other C2 frameworks into Elasticsearch, with Kibana dashboards that visualize blue team detection activity and operator actions. Red team leads and operators use RedELK to monitor whether their infrastructure has been detected, track which payloads and techniques are triggering alerts, and maintain situational awareness across complex multi-operator campaigns. The tool automatically correlates blue team indicators like sandbox detonations and known-bad IP lookups with red team activity, enabling operators to adapt their tradecraft in real time.