If you have access to an ELK stack (Elasticsearch, Logstash, Kibana), skip this step. Otherwise, there are two options available:
- Pay for an ELK installation. See logit.io, logz.io, and, of course, Elastic Cloud.
- Set up your own ELK installation. I will go through those steps here:
This tutorial will focus on a fully functioning ubuntu server. ELK can be run in Docker, but ELK’s resource requirements are more than what a minimal docker container would usually have.
Minimum specs:
- 2GB RAM
- 5GB storage
- Almost any processor
Recommended specs:
- 4GB RAM
- 50GB storage (at least)
- Intel i7-9700 or equivalent
There are plenty of other tutorials on the internet that cover how to make/get an ubuntu machine to use.
See official documentation here: https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html
Note: Some obscure errors can be caused by a lack of resources.
Once you have verified that all services are up and running (on ubuntu, this can be done by running sudo systemctl status <servicename>), connect to Kibana on port 5601 of the host machine via a browser. Copy the enrollment token generated by elasticsearch into the field.
Log into Kibana with the elastic user. Regenerate the password if you don’t have it.
Note: if you get a “connection reset” error, make sure your kibana config file at /etc/kibana/kibana.yml has the machine’s external IP as the server.host hostname
Note: This section has many helpful commands, including password resets and generating enrollment tokens
Note: Elastic Security has much of the functionality, if not all or more than, what will be set up in the next steps. Go to the official elastic documentation here for more info: https://www.elastic.co/security
https://www.elastic.co/beats/auditbeat
First party, highly configurable beat for linux machines.
See script here:
https://www.elastic.co/beats/winlogbeat
First party, highly configurable beat for windows machines.
See script here:
https://github.com/jaakkoo/macoslogbeat
Log beat for macOS machines. Not on the same level as auditbeat for linux, but fills in some of the gaps.
https://www.elastic.co/beats/auditbeat
First party, highly configurable beat for linux machines.
Less capable on Macs, but still very powerful.
See script for C and D here: