L’agent sugli hosts remoti \u00e8 filebeat quindi anche su questi ultimi si dovr\u00e0 eseguire la procedura:
\nroot@sangiorgio:\/home\/guardian# wget -qO – https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | apt-key add –
\nOK
\nroot@sangiorgio:\/home\/guardian# apt install apt-transport-https
\nroot@sangiorgio:\/home\/guardian# echo “deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main” | tee \/etc\/apt\/sources.list.d\/elastic-7.x.list
\ndeb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main
\nroot@sangiorgio:\/home\/guardian# apt install filebeat
\nroot@sangiorgio:\/home\/guardian# update-rc.d filebeat defaults<\/p>\n
Il file \/etc\/filebeat\/filebeat.yml va modificato in questo modo:
\n# ============================== Filebeat inputs ===============================
\n…
\n…
\n…<\/p>\n
# filestream is an input for collecting log messages from files. It is going to replace log input in the future.
\n– type: filestream<\/p>\n
# Change to true to enable this input configuration.
\nenabled: true<\/p>\n
# Paths that should be crawled and fetched. Glob based paths.
\npaths:
\n# – \/var\/log\/*.log
\n– \/var\/log\/syslog
\n– \/var\/log\/nftables.log
\n– \/var\/log\/suricata\/eve.json
\n#- c:\\programdata\\elasticsearch\\logs\\*
\n# =================================== Kibana ===================================
\n…
\n…<\/p>\n
setup.kibana:<\/p>\n
# Kibana Host
\n# Scheme and port can be left out and will be set to the default (http and 5601)
\n# In case you specify and additional path, the scheme is required: http:\/\/localhost:5601\/path
\n# IPv6 addresses should always be defined as: https:\/\/[2001:db8::1]:5601
\nhost: “IP_di_ardito:5601”<\/p>\n
# —————————- Elasticsearch Output —————————-
\n#output.elasticsearch:
\n# Array of hosts to connect to.
\n# hosts: [“localhost:9200”]<\/p>\n
# —————————— Logstash Output ——————————-
\noutput.logstash:
\n# The Logstash hosts
\nhosts: [“IP_di_ardito:5044”]<\/p>\n
Dopo di che filebeat modules enable suricata\u00a0 system
\nEnabled system
\nEnabled suricata
\n\/etc\/init.d\/filebeat start
\nun rapido controllo con filebeat test config che restituisce:
\nConfig OK
\ne filebeat test output che restituisce
\nlogstash: IP_di_ardito:5044…
\nconnection…
\nparse host… OK
\ndns lookup… OK
\naddresses: IP_di _ardito
\ndial up… OK
\nTLS… WARN secure connection disabled
\ntalk to server… OK<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
L’agent sugli hosts remoti \u00e8 filebeat quindi anche su questi ultimi si dovr\u00e0 eseguire la procedura: root@sangiorgio:\/home\/guardian# wget -qO – https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | apt-key add – OK root@sangiorgio:\/home\/guardian# apt install apt-transport-https root@sangiorgio:\/home\/guardian# echo “deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main” | tee \/etc\/apt\/sources.list.d\/elastic-7.x.list deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main root@sangiorgio:\/home\/guardian# apt install filebeat root@sangiorgio:\/home\/guardian# update-rc.d filebeat defaults Il file \/etc\/filebeat\/filebeat.yml va […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,14,204],"tags":[136,213,214,55],"class_list":["post-1961","post","type-post","status-publish","format-standard","hentry","category-linux","category-networking","category-web-application","tag-devuan","tag-elk","tag-logging","tag-monitoring"],"_links":{"self":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1961","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1961"}],"version-history":[{"count":2,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1961\/revisions"}],"predecessor-version":[{"id":1963,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1961\/revisions\/1963"}],"wp:attachment":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1961"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1961"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}