ELK SIEM Open Distro: ELK stack - installation and configuration.
This chapter will describe the installation and configuration of the ELK stack. One could have skipped this chapter and not translated, but then the thread between the original chapters will be lost.
Table of contents for all posts.
- Introduction. Infrastructure and technology deployment for SOC as a Service (SOCasS)
- ELK stack - installation and configuration
- Walking through the open Distro
- Dashboards and ELK SIEM visualization
- Integration with WAZUH
- Alerting
- Making report
- Case Management
1- Installing and configuring ELK STACK
1.1- Introduction to ELK
A- What is ELK?
B- Difference between ELK Basic and ELK Oss?
1.2- Installing ELK
In our project, we started configuring ELK Stack Basic (7.6.1) and referenced the official guide provided by elastic.co:
https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html
1.3- ELK configuration
In this section, we will provide you with the configuration we made for the ELK stack.
A- Elasticsearch configuration
All settings were made in elasticsearch.yml file located at /etc/elasticsearch/elasticsearch.yml
, : sudo nano /etc/elasticsearch/elasticsearch.yml
elasticsearch.
. , , . http.port . .
network.bind_host: 0.0.0.0 Elasticsearch, ELK.
, ElasticSearch :
sudo systemctl restart elasticsearch: network.bind_host to 0.0.0.0 - . .
B-Kibana:
kibana.yml, /etc/kibana/kibana.yml. , :
sudo nano /etc/kibana/kibana.yml
Kibana , server.host: "0.0.0.0". , , . , , 5601. Kibana: sudo systemctl restart kibana
Kibana . Http://your_Server_IP: 5601
, , , .
: server.host 0.0.0.0 - . .
C-Logstash:
logstash:
sudo cat /etc/logstash/logstash-sample.confLogstash. , /etc/logstash/conf.d/ logstash.conf
: sudo systemctl restart logstash
D- :**
logstash, kibana elasticsearch. :
, . , tcp6 tcp.
Kibana: 5601
Elasticsearch: 9200
Logstash: 5044
2-Beats :
A- Winlogbeat:
URL:
https://www.elastic.co/fr/downloads/beats/winlogbeat
:
https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html
B- Winlogbeat:
winlogbeat.yml:
winlogbeat.event_logs:
winlogbeat winlogbeat.yml , Winlogbeat. , , . , Sysmon .
:
— index.number_of_shards:
, . , Elasticsearch , , .
— index.number_of_replicas:
, Elasticsearch . , , Elasticsearch. , .
:
Elasticsearch Logstash .
:
, winlogbeat, :
(ILM):
, ILM. ILM Index Lifecycle Manager — x-pack, ELK, ELK oss. ILM , . : , , , , , .
ILM ELK, , Elasticsearch. ILM , .
Sysmon MITER ATT & CK:
Sysmon , , sysmon ELK.
(Sysmon) — Windows , , , Windows. , . , Windows Event Collection SIEM, , , .
MITER ATT & CK — , . ATT & CK , , .
I. Sysmon:
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
II. xml- sysmon, MITER ATT CK: https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml
III. Sysmon :
sysmon64 -accepteula -i sysmonconfig-export.xmlIV. :
sysmon64 –c, :
I. :
, . , , , , .
Elasticsearch. Elasticsearch, . winlogbeat Elasticsearch, .
Logstash Elasticsearch.
II. :
https://www.elastic.co/guide/en/beats/winlogbeat/current/load-kibana-dashboards.html
:
, Kibana.
:
, . Elasticsearch, , Logstash, .
ELK:
winlogbeat sysmon PowerShell services.msc, Kibana.
winlogbeat. ELK STACK Logstash , .
winlogbeat:
Discover sysmon ( MITER):
winlogbeat , .
, :
Winlogbeat
Filebeat
Packetbeat
Metricbeat
, , metricbeat filebeat, , .
, filebeat ssh, sudo ubuntu Suricata Suricata IDS.
Suricata:
Suricata filebeat:
sudo filebeat modules enable Suricata
, filebeat, /etc/filebeat/modules.d/
, :
filebeat modules list
This is the link we used to install Suricata on our device: https://www.alibabacloud.com/blog/594941
You should get a toolbar similar to this one. Don't worry if you don't get exactly this result, we will work with the dashboard in the following articles.
It is also possible to integrate Suricata interface into ELK stack, for which you can check this link .