🐙 🕊️ ✋🏼 ELK，来自OpenSource，Open Distro的SIEM：走进Open Distro 🐔 🧑🏿‍🤝‍🧑🏻 👨🏼‍🔧

这篇文章将描述如何为Elasticsearch安装和配置open Distro。

以下插件在开放发行版中可用：

安全
警示
的SQL
信息安全管理（ISM）
性能分析仪

所有职位的目录。

在我们的项目中，我们仅安装了安全和警报插件。

1-警报功能：

Open Distro for Elasticsearch可让您跟踪数据并自动将警报发送给利益相关者。它易于设置和管理，并通过功能强大的API使用Kibana接口。

, , - . , , . , Elasticsearch .

URL- ( 1.6.0 ) :

https://opendistro.github.io/for-elasticsearch-docs/version-history/

, elasticsearch kibana:

/usr/share/elasticsearch :  Elasticsearch
/usr/share/kibana :  Kibana

1.1- Alerting elasticsearch:

cd /usr/share/elasticsearch
sudo bin/elasticsearch-plugin install https://d3g5vo6xdbdb9a.cloudfront.net/downloads/elasticsearch-plugins/opendistro-sql/opendistro_sql-1.6.0.0.zip

1.2- Alerting kibana :

cd /usr/share/kibana
sudo bin/kibana-plugin install — allow-root https://d3g5vo6xdbdb9a.cloudfront.net/downloads/kibana-plugins/opendistro-alerting/opendistro-alerting-1.6.0.0.zip

1.3- , :

— Kibana :

sudo bin/kibana-plugin list
sudo bin/kibana-plugin remove <plugin-name>

— elasticsearch :

sudo bin/elasticsearch-plugin list
sudo bin/elasticsearch-plugin remove <plugin-name>

1.4- kibana elasticsearch :

systemctl restart kibana elasticsearch

: , elasticsearch kibana , kibana ( kibana is not ready yet ). kibana elasticsearch top.

1.5- kibana :

1.6- :

) URL- - Slack:

Slack — , « , ». Slack — .

Webhooks — Slack. - URL-, JSON . Incoming Webhooks, .

(slack.com)
, Slack.
, ,
, , Incoming Webhook, :
Slack
( ) « ».
, URL- - ( , )
Kibana → Alerting → Destination add destination:
, Slack, URl - .

1.6.2- Slack:

( : 4624 , )

Monitor Schedule

, :

, , :

Kibana, Slack:

Slack- (#test ) :

2- :

, , , .

2.1- :

, Kibana . , , , .

( 1 4), , . URL:

Kibana:

sudo bin/kibana-plugin install — allow-root https://d3g5vo6xdbdb9a.cloudfront.net/downloads/kibana-plugins/opendistro-security/opendistro_security_kibana_plugin-1.6.0.0.zip

Elasticsearch:

sudo bin/elasticsearch-plugin install https://d3g5vo6xdbdb9a.cloudfront.net/downloads/elasticsearch-plugins/opendistro-security/opendistro_security-1.6.0.0.zip

: type y

sudo sh /usr/share/elasticsearch/plugins/opendistro_security/tools/install_demo_configuration.sh

securityadmin.sh.

cd /usr/share/elasticsearch/plugins/opendistro_security/tools/
chmod +x install_demo_configuration.sh
./install_demo_configuration.sh

y ( : admin / : admin)

/etc/elasticsearch/elasticsearch.yml

2.2- elasticsearch logstash kibana:

, SSL elasticsearch. , .

2.2.1- Elasticsearch:

x-pack security elasticsearch: elasticsearch , , - xpack, ELK Stack, /etc/elasticsearch/elasticsearch.yml .

2.2.2- :

x-pack security Kibana: xpack.security ssl /etc/kibana/kibana.yml

. , — https, http.

2.2.3- Logstash:

elasticsearch, logstash, , logstash.

, https, http.

sudo nano /etc/logstash/conf.d/logstash.conf

: , elasticsearch , SSL, , . , — https, http.

2.3- :

systemctl restart elasticsearch
systemctl restart logtash
systemctl restart kibana

, . top . (kibana is not ready yet).

ELK .

, URL- Elasticsearch (http , https)

您可以在此处创建用户，分配角色和权限：

它可以帮助您根据角色，操作和特权来组织SOC。

这是内部用户的默认角色和数据库：

在Elasticsearch上进行电报聊天：https：//t.me/elasticsearch_ru

ELK，来自OpenSource，Open Distro的SIEM：走进Open Distro