Skip to content

Latest commit

 

History

History
508 lines (386 loc) · 12.2 KB

HOW_TO_DEMO.md

File metadata and controls

508 lines (386 loc) · 12.2 KB

📚 Complete Documentation Index

Your APT Detection System - All Resources

🎯 Quick Links

Document Purpose When to Use
README.md Project overview & setup First-time users, general info
DEMO_GUIDE.md Complete demo instructions Preparing for presentations
DEMO_CHEAT_SHEET.md One-page reference During live demos
PRESENTATION_SLIDES_OUTLINE.md Slide deck structure Creating presentations
VIDEO_DEMO_SCRIPT.md Recording instructions Making demo videos
KIBANA_USAGE_GUIDE.md How to use Kibana Learning the interface
KIBANA_INDEX_PATTERN_SETUP.md Detailed setup steps First-time Kibana setup
QUICK_START_INDEX_PATTERNS.md Quick reference Fast index pattern creation
INDEX_PATTERN_ERROR_SOLUTION.md Troubleshooting When you see errors
SEARCH_EXAMPLES.md Query examples Finding specific threats
DETECTION_QUERIES.md Detection rules explained Understanding how detection works
PROJECT_STATUS.md Current system state Checking what's working

🚀 How to Demo This Project in the Future

Step 1: Preparation (1 day before)

  1. Clone/Update Repository

    git clone https://github.com/Prajjwal2051/Detection-of-APT-s-attack.git
cd Detection-of-APT-s-attack
git pull  # if already cloned

  2. Test System

    ./start.sh
# Wait 2-3 minutes
docker-compose ps  # Verify all services running

  3. Verify Data

    curl 'http://localhost:9200/_cat/indices?v' | grep apt
curl 'http://localhost:9200/apt-detection-*/_count?pretty'

  4. Create Index Patterns

    • Open: http://localhost:5601
    • Go to: Management → Stack Management → Index Patterns
    • Create: apt-detection-*
    • Create: apt-threats-*

  5. Practice Demo

    • Follow DEMO_GUIDE.md
    • Time yourself (should be 5-20 minutes depending on version)
    • Practice transitions between sections

Step 2: Demo Day Setup (30 minutes before)

  1. Start System

    cd Detection-of-APT-s-attack
./start.sh

  2. Quick Checks

    # All services up?
docker-compose ps

# Kibana responsive?
curl http://localhost:5601/api/status | grep available

# Data exists?
curl 'http://localhost:9200/apt-threats-*/_count?pretty'

  3. Prepare Browser

  4. Have Ready

    • DEMO_CHEAT_SHEET.md printed or on second screen
    • Terminal open with project directory
    • Backup screenshots (in case of failure)
    • Water for your voice

Step 3: Demo Execution

Option A: Quick Demo (5 minutes)

Follow: DEMO_CHEAT_SHEET.md → "5-Minute Demo Script"

Outline:

  1. Intro (30s): "APT Detection System using ELK Stack"
  2. Architecture (30s): Show diagram
  3. Live Detection (2m): Show threats in Kibana
  4. Details (1m): Expand event, show MITRE mapping
  5. Wrap-up (1m): Key features, GitHub link

Option B: Full Demo (15-20 minutes)

Follow: DEMO_GUIDE.md → "Full Demo Presentation"

Structure:

  1. Problem Statement (2m): Why APT detection matters
  2. Solution Overview (3m): System architecture
  3. MITRE Coverage (2m): Attack techniques covered
  4. Live Demo (8m):
    • View all threats
    • Investigate credential dumping
    • Track lateral movement
    • Show data exfiltration
    • Demonstrate search capabilities
  5. Use Cases (2m): SOC, incident response, threat hunting
  6. Q&A (3m): Answer questions

Option C: Attack Scenario Demo (10 minutes)

Follow: DEMO_GUIDE.md → "Live Demonstration Script"

Story-based approach:

  1. Setup (1m): "Let's track an APT attack"
  2. Stage 1 - Reconnaissance (2m)
  3. Stage 2 - Credential Theft (2m)
  4. Stage 3 - Lateral Movement (2m)
  5. Stage 4 - Data Exfiltration (2m)
  6. Summary (1m): Complete attack timeline

Step 4: Handling Different Audiences

For Technical Audience (Developers, Engineers)

  • Focus on architecture and implementation
  • Show code (Logstash rules, Docker Compose)
  • Discuss scalability and performance
  • Deep dive into detection logic

For Security Audience (SOC Analysts, CISOs)

  • Emphasize MITRE ATT&CK mapping
  • Show threat hunting capabilities
  • Discuss integration with existing tools
  • Highlight detection accuracy

For Management/Business

  • Focus on ROI (open-source = $0 cost)
  • Show business value (prevent breaches)
  • Discuss compliance benefits
  • Use analogies (avoid jargon)

For Academic (Students, Professors)

  • Explain learning objectives
  • Discuss methodologies
  • Share technical challenges
  • Encourage experimentation

Step 5: Creating Presentation Materials

Slides (Use PRESENTATION_SLIDES_OUTLINE.md)

Tools: Google Slides, PowerPoint, Keynote

Structure:

  1. Title slide
  2. Problem statement
  3. Solution overview
  4. Architecture diagram
  5. MITRE coverage
  6. LIVE DEMO (main attraction)
  7. Technical implementation
  8. Use cases
  9. Resources & GitHub
  10. Q&A

Time: 15-20 slides for 20-minute presentation

Video Recording (Use VIDEO_DEMO_SCRIPT.md)

Tools: OBS Studio, Camtasia, Screen Recorder

Process:

  1. Prepare system (all services running)
  2. Write script with timing
  3. Practice 2-3 times
  4. Record in segments (easier editing)
  5. Edit with text overlays
  6. Export in 1080p
  7. Upload to YouTube

Length: 10-12 minutes for complete demo

Step 6: Emergency Troubleshooting

Issue: No Data in Kibana

Quick Fix:

# Insert sample data manually
curl -X POST "http://localhost:9200/apt-threats-$(date +%Y.%m.%d)/_doc" \
  -H 'Content-Type: application/json' -d'{
  "@timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "threat_detected": "credential_dumping",
  "severity": "critical",
  "mitre_technique": "T1003.001",
  "host": {"name": "DEMO-PC"},
  "message": "Demo threat event"
}'

# Refresh
curl -X POST "http://localhost:9200/apt-*/_refresh"

Issue: Kibana Not Loading

Quick Fix:

# Restart Kibana
docker-compose restart kibana

# Wait 30 seconds
sleep 30

# Check status
curl http://localhost:5601/api/status

While waiting, say:

"While Kibana restarts, let me explain the system architecture..."

Issue: Index Pattern Error

Quick Fix:

  1. Go to: Management → Stack Management → Index Patterns
  2. Create: apt-detection-* with @timestamp
  3. Create: apt-threats-* with @timestamp

See: INDEX_PATTERN_ERROR_SOLUTION.md for details

Issue: Complete System Failure

Backup Plan:

  1. Show screenshots (prepare beforehand)
  2. Show recorded video (have ready)
  3. Walk through documentation
  4. Explain architecture verbally
  5. Answer questions about implementation

📖 Documentation Usage Guide

For First-Time Setup

Read in order:

  1. README.md (overview)
  2. Start system: ./start.sh
  3. KIBANA_INDEX_PATTERN_SETUP.md (setup Kibana)
  4. KIBANA_USAGE_GUIDE.md (learn interface)

For Demo Preparation

Read in order:

  1. DEMO_GUIDE.md (full instructions)
  2. DEMO_CHEAT_SHEET.md (quick reference)
  3. PRESENTATION_SLIDES_OUTLINE.md (if making slides)
  4. VIDEO_DEMO_SCRIPT.md (if recording)

For Troubleshooting

Check:

  1. PROJECT_STATUS.md (current state)
  2. INDEX_PATTERN_ERROR_SOLUTION.md (if errors)
  3. README.md → Troubleshooting section

For Learning Kibana

Read in order:

  1. KIBANA_INDEX_PATTERN_SETUP.md (setup)
  2. QUICK_START_INDEX_PATTERNS.md (quick ref)
  3. KIBANA_USAGE_GUIDE.md (complete guide)
  4. SEARCH_EXAMPLES.md (practice queries)

🎬 Demo Scenarios by Context

Job Interview Demo

Time: 10-15 minutes Focus: Technical skills, problem-solving Show: Architecture, detection logic, code quality Documents: DEMO_GUIDE.md + GitHub profile

Class Presentation

Time: 15-20 minutes Focus: Learning outcomes, methodology Show: Problem → Solution → Demo → Lessons learned Documents: PRESENTATION_SLIDES_OUTLINE.md

Conference/Meetup Talk

Time: 20-30 minutes Focus: Technical depth, community value Show: Full demo, Q&A, open-source contribution Documents: DEMO_GUIDE.md (full version)

Social Media Video

Time: 3-5 minutes Focus: Quick impact, shareability Show: Hook → Quick demo → Call-to-action Documents: VIDEO_DEMO_SCRIPT.md (short version)

Corporate Presentation

Time: 15-20 minutes Focus: Business value, ROI Show: Problem impact → Solution benefits → Live demo Documents: PRESENTATION_SLIDES_OUTLINE.md

💡 Pro Tips for Success

Before Demo

✅ Practice 3+ times ✅ Test on actual demo machine ✅ Prepare backup materials ✅ Know your audience ✅ Time yourself ✅ Charge laptop ✅ Test screen sharing (if remote)

During Demo

✅ Start with impact (show cool stuff first) ✅ Speak clearly and steadily ✅ Make eye contact (live) or look at camera (video) ✅ Point out important elements with cursor ✅ Pause to let concepts sink in ✅ Handle questions confidently ✅ Show enthusiasm!

After Demo

✅ Share GitHub link ✅ Offer to answer questions ✅ Follow up via email ✅ Get feedback ✅ Update documentation based on questions

🎯 Success Checklist

Your demo is successful if:

  • Audience understands what APTs are
  • They see the system working live
  • They understand MITRE mapping
  • They see practical value
  • They ask engaged questions
  • They visit your GitHub repo
  • You feel confident and proud

📞 Getting Help

During Preparation

  • Review all documentation in /docs/
  • Check GitHub Issues for common problems
  • Test early and often

During Demo

  • Use DEMO_CHEAT_SHEET.md as reference
  • Have backup plan ready
  • Stay calm and confident

After Demo

  • Document lessons learned
  • Update documentation
  • Share your experience

🏆 Final Reminders

  1. You built this! You understand it better than anyone
  2. Practice makes perfect - The more you demo, the better you get
  3. Backup plans - Always have screenshots/video ready
  4. Passion shows - Your enthusiasm is contagious
  5. Questions are good - They show engagement
  6. It's okay to say "I don't know" - Follow up later
  7. Have fun! - Enjoy showcasing your work

📋 Pre-Demo Quick Checklist

Print this and check off:

24 Hours Before:

  • System tested on demo machine
  • All documentation reviewed
  • Backup materials prepared (screenshots/video)
  • Practiced demo script 3+ times
  • Slides created (if needed)

1 Hour Before:

  • System started (./start.sh)
  • All services running healthy
  • Data verified (indices exist)
  • Index patterns created
  • Browser tabs ready
  • Notifications disabled
  • Laptop charged

5 Minutes Before:

  • Kibana responsive
  • Quick search test successful
  • Cheat sheet ready
  • Water available
  • Deep breath taken 😊

During Demo:

  • Speak clearly
  • Show enthusiasm
  • Make eye contact
  • Handle questions well
  • Stay within time

After Demo:

  • Share GitHub link
  • Thank audience
  • Offer follow-up

🎉 You're Ready!

You have everything you need to deliver an impressive demo:

✅ Working system ✅ Complete documentation ✅ Demo scripts ✅ Presentation outlines ✅ Video scripts ✅ Troubleshooting guides ✅ Backup plans

Now go showcase your amazing work! 🚀

Good luck! You've got this! 💪

Quick Command Reference

# Start system
./start.sh

# Check status
docker-compose ps

# Verify data
curl 'http://localhost:9200/apt-*/_count?pretty'

# Access Kibana
http://localhost:5601

# Emergency data insert
curl -X POST "http://localhost:9200/apt-threats-$(date +%Y.%m.%d)/_doc" \
  -H 'Content-Type: application/json' -d'{
  "@timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "threat_detected": "credential_dumping",
  "severity": "critical",
  "mitre_technique": "T1003.001",
  "host": {"name": "DEMO-PC"},
  "message": "Live demo threat"
}'

# Stop system
docker-compose down

Project GitHub: https://github.com/Prajjwal2051/Detection-of-APT-s-attack

Remember: Practice → Prepare → Present → Prosper! 🎯