[Autogenerated] now that we've seen the integration with Pf sense.
Let's talk about getting our data over to a sim snort
being one of the most popular I.
D.
S I.
P.
S tools out there has robust integrations with many different sim providers.
Let's talk about the popular open source tool or set of tools,
the Elastic Stack This tool provides the ability to
not only collect in stash logs, event data and telemetry from multiple sources,
but it gives you the ability to visualize the data
in many different ways as well.
There's different components that you need to work with for this
and the Elastic Stack encompasses many of them.
Elasticsearch is the base of the ecosystem and serves
as the search and analytics engine.
Kibana is the front end web GUI that allows us to search and visualize the data.
The visualizations are one of the cool things that this integration
provides many people have created their own visualizations and you can
find some of them out there on the web.
You can also use some of the pre built visualizations that Kibana
provides on top of these that we'll see in the next demo.
You can also use the security dashboard in Kibana to use the snore
alerts to assist with identifying specific events,
create alerts and investigate the activity log stash,
collects parses filters and normalizes the data for Elasticsearch to use,
You can use log stash to collect the logs that snort generates,
create configurations to rewrite fields filter the data
and send it to the rest of the stack.
The beats applications help us collect and normalize data and provides pre built
modules to help us with this for their single source type.
You can use file B to do the same as log stash for some applications and it
has those pre built modules that I was talking about.
There are so many benefits to using snort with a sim that is
absolutely crucial in most production instances.
These help us understand our deployments better and allow us
to view the data in more efficient ways.
Also, this gives us the ability to tune a bit better as well.
Sims provide us with a lot of stats that are helpful with this.
If you've ever set up the Elastic Stack you can get it set up
quickly by using a few different methods,
building your own machine and installing the tools and using the
Elastic Stack Docker containers are two of those options.
Check out the documentation for the tools to learn more about this.