outflanknl/RedELK

Health v2 · maintenance only

Adoption not part of the score

2665 stars · 392 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RedELK is a self-hosted SIEM built on the Elastic stack (Elasticsearch, Logstash, Kibana) tailored for red team operations. It aggregates and enriches operational logs from teamservers and traffic logs from redirectors, providing operational oversight and alerts when the Blue Team investigates red team infrastructure.

Use cases

• track red team operator activity across multiple teamservers in one place
• detect when the blue team is investigating my C2 infrastructure
• give the white team a read-only view of a long-running red team operation
• search historical logs, screenshots, IOCs and keystrokes from a months-long engagement
• centralize traffic logs from multiple redirectors and get alerted on defensive activity
• manage oversight for multi-scenario, multi-member red team campaigns

When to choose

• you run long-term, multi-teamserver red team operations needing centralized logging
• you want to alarm on blue team activity against your redirector infrastructure
• you already use or are comfortable with the Elastic stack and Docker deployments

When to avoid

• you need a general-purpose enterprise SIEM for blue team defense rather than red team operations
• you want a lightweight single-binary tool without Elasticsearch infrastructure overhead
• your engagement is short and simple enough that centralized log aggregation adds no value

Facets

application · maturity active

monitoring alerting logging search-engine security data-visualization security monitoring self-hosted developer-tools self-hosted red-team siem elk-stack blue-team-detection penetration-testing c2-logging elastic-stack docker linux web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="outflanknl/RedELK")