Welcome back. In the previous module,
we were able to check out Security Onion and identify how Zeek
integrates with the powerful security platform. In this module, we're
going to take integrating Zeek to the next level.
We'll focus a bit more on the ELK stack and also learn about
integrating Zeek with Arkime. So we learned a little bit about
Kibana and how we can use it to view our data, similar to how we
do with other SEIM platforms.
That's just part of the larger ELK stack though,
which includes other projects that you may or may not
have heard of, Elasticsearch, Logstash.
Kibana, and Beats. The acronym only includes the first
three, but Beats is a huge part of this tool.
It's also referred to as the Elastic Stack. We'll see all of
these tools in action throughout this module. Before we jump into
how we're going to use the ELK stack,
let's define what each component is so that you can have an idea of why we're
looking at these and how they will affect our integrations.
Elasticsearch, I briefly mentioned in the previous module.
This is the search engine. It's open source, RESTful, and
uses JSON‑based searching.
Logstash is one that you may or may not have heard of yet,
and it's our ingestion and storage tool.
It allows us to parse the data coming in and store or stash it
away. Kibana is our front‑end GUI for viewing the data and can be
considered our visualization tool.
Finally, Beats. We're going to be focusing on Filebeat for this
module, but there are other ones to be aware of as well.
These are our log shippers and data shippers,
each built with their own purposes.
Alright, now that we've learned a little bit about those,
how are we going to use them in this module?
Well, I have a basic installation of the ELK stack built as a starting point.
We're going to use Filebeat to gather those Zeek logs that we want
and send them off to Logstash. From there, we'll use Kibana to look
at some of the data, similar to the way we did in the previous
module with Security Onion.
This isn't the end though.
We're going to use Logstash to parse the data coming in from
Zeek and map it to Arkime's data scheme,
enrich it, and validate that we're able to use it inside of Arkime's dashboards.
That's what we'll be learning about and, more importantly,
demonstrating here in this module.
So, where do we go from here?
Well, if you already have a great idea of how to use the ELK stack, then great.
You should be able to follow along very well. If not though, that's all right.
My installation of ELK is almost right out of the box, so you
can get up to speed very quickly and install it on a VM to be
able to use it and follow along.
Here's a few courses at Pluralsight, as well as some other places
to visit to gain more skills with the ELK stack. We'll visit the
various components of the ELK stack throughout this module to
configure them as needed.
We'll also use another platform called Malcolm to help us out with
the Arkime integration. Logstash and Filebeat will be the main
focus of these configurations though, as those will be what we need to ingest,
parse, and enrich the data coming from Zeek.