Globomantics couldn't be happier with our progress so far,
and they're excited to see you make use of the JSON alerts
you produced in the last demonstration.
Leadership selected the ELK stack for a visual demonstration,
since the product is free to try.
You downloaded the software and load it on your computer.
Now you just need to configure the ELK stack to ingest
Snort's JSON alerts from a file.
Once we prove that ELK can ingest the Snort alerts,
we'll be set up to create a visual dashboard.
Globomantics wants you to ingest both the alerts file and the appid logs.
Let's get started with the ELK configuration files.
I'm going to run the ELK stack from my Windows PC for this exercise.
Obtaining the Elasticsearch, Kibana,
and Logstash software is done through the Elastic website.
The original configuration files for this exercise came from this
Snort blog post on integrating Snort with ELK.
The alerts files we produced are different from this guide,
and these files were built for Linux,
so I modified them slightly to fit our scenario.
But if you want to access the original files, you can find them here.
The files I used are included in the demo files for this module.
I also included the alerts JSON file and appid files from
my Snort server, in case you run into any issues importing
and using your own files.
I am running Elasticsearch, Kibana, and Logstash out of a folder I
created on a separate hard drive shown here. I left the ports each
one is running on as the default settings.
Once you run Elasticsearch,
you can use this PowerShell command to verify that
it's up and running correctly.
You can verify Kibana's running by navigating to localhost at port 5601.
You want to start Kibana after you start Elasticsearch, if you
haven't used these before. If it's working correctly,
you should open up a page similar to this one.
Once you verify that you have Elasticsearch and Kibana running,
you're ready to use Logstash to ingest the alerts.json
file and the appid_stats.log file.
We need to make a few changes to the configuration files first.
Within each of these files,
this directory needs to reflect the path to your alerts.json file and
the appid_stats.log files on your computer or server.
If you're using Windows, the path for sincedb should
be set to null, like these files.
If you're using Linux,
you'll need to enter /dev/null instead. You can leave
these indexes with the values shown here, but since I
already imported these as a test, I'm going to change them to new values.
Then I'll go ahead and save these, and I'm set to run my Logstash commands.
If you're using windows,
you can run Logstash from a command prompt using a command similar to this.
Just make sure you're using the right directory where you
have Logstash stored on your machine, and the right
directory for your snort_json.txt file.
So we'll go ahead and run that. (Working) Once the JSON
entry stops scrolling across the screen,
you're safe to turn off Logstash, and we're set up to import our appids,
which we'll import using a similar command, but instead of json.txt,
we're going to use apps.txt instead. (Working) And once again,
when we see Logstash stops importing we can go ahead and close it out,
and our data should be loaded and indexed in Elasticsearch.
Let's head over to Kibana to check.
We'll use Kibana to visualize our data and create a dashboard in the next demo,
but first we need to create an index pattern.
To do that, we just click on this gear to access the management page.
From here,
we select Index Patterns and go to Create index
patterns at the top right of the page.
You should see the indexes you imported down here.
Yours might be called snort3a. snort3j, apps, json, or whatever you named it.
If you only have two, don't panic.
As I mentioned earlier, I had previously imported two of these as a test.
We need to give our index pattern a name that matches the indices below,
so we use logstash‑snort3, and we'll start with the JSON file.
Okay for the time filter,
we're going ahead and put @timestamp, and then click Create index pattern.
There's one other step that we have to complete for this part,
and that's to go down to our Base64 data and click Edit and then change the
default format to String and the transform to Base64 Decode,
and then we'll just save that field.
This setting will enable Kibana to decode and display that field, and that's it.
Our snort3json index pattern is created, and we're ready to visualize the data.
But first, we have one other index pattern to create,
and that's a pattern for our app data. To do that, we'll go back to index
patterns and create another index pattern. Again, we'll name it
logstash‑snort3, but this time we'll call it snort 3apps. We'll go ahead
and hit next, again use @timestamp and Create index pattern, and this time
we don't have to edit any fields.
So now that we've created the two index patterns, we should be able
to see them when we click on this Discover option.
We should be able to pull up our logstash‑snort3json index
pattern and our apps index pattern as well.
So for a quick recap, in this demo,
we set up our ELK stack and made the appropriate changes to our
Logstash configuration files to import our data.
We used Logstash to ingest the alerts.json file and our appid_stats.log file.
We then used Kibana to create index patterns to prepare for
visualization of the data. Coming up, we're going to finish this
integration and use the data to create a dashboard.