While we've been considering how to deploy Suricata,
we haven't looked specifically at how we operationalize the data it generates.
Let's now take a look at one way to accomplish just that. By default,
Suricata stores the logs it generates on the server it is running on.
This means that if you want to view your data,
you need to log into the server to access Suricata logs.
While this could work in small deployments,
it certainly doesn't scale well. Instead, it's usually a better option to
send the logs from the server to a central location.
How you collect and aggregate your data will vary, but looking at
the open‑source Elastic Stack will allow us to walk through all of
the key components you will need.
What we'll look at includes how to get the logs,
how to enrich or normalize log data,
how to store your logs, and then how to visualize this data.
Getting into building an Elastic Stack is beyond the scope of this
course, so we'll just focus on how to get the data off the server and
how to visualize it. Assuming that we have Suricata deployed and
generating data, we'll use Filebeat,
which is part of the log shipper framework provided by Elastic to
gather logs from the server and send them to Elasticsearch.
Elasticsearch will provide storage and searchability.
We won't use log stash, but log stash is a stopover point as logs are
collected before they are stored in Elastic. This allows you to
normalize or enrich data through pipelines.
If you want to set up your Elastic Stack, I recommend starting with the
Elastic Stack documentation. They have great quick start tutorials to get you
up and running in short order to start experimenting.
Next up is a demo that will show you how to install Filebeat in the
training VM and get started with default visualizations.