Hello again, and welcome to the last module for this course,
where we will look at extending Snort's functionality through additional tools.
Let's go to the overview and see what we'll cover in this module.
We'll start out this module with a quick discussion of why we
would want or need to integrate with other tools.
We'll follow this with a couple of demos of how to integrate Snort with
Elasticsearch, Logstash, and Kibana, or the ELK stack.
We're going to use the ELK stack to process our alerts.json
file we generated in the previous module.
Once processed, we'll use Kibana to create a visual dashboard. But first,
why do we want to leverage external applications anyway?
There are multiple advantages to using external
applications to process Snort's alerts,
including the visual display we're going to create in this module.
Although we have been operating in a command line
environment throughout the course,
this is not everyone's preference for a computer operation.
Visual dashboards are useful for explaining the
alerts to nontechnical audiences.
You can also track statistics over a longer period of time
and make comparisons to previous periods.
Finally, you can create multiple dashboards of the same alert,
depending on the function or your audience.