Skip to main content

OPERATION: Metasponse

1. Start Elastic + supporting services​

  1. Ensure the Elastic and support services (kibana, elasticsearch, logstash, filebeat, arkime-viewer) are started:

    sudo systemctl start elastic.target

    NOTE: These services are set to auto-start on boot due to systemctl enable elastic.target being ran during installation

  2. You can also verify by accessing the web interfaces of Kibana (https://localhost:5601) and Arkime (https://localhost:8005)

    NOTE: Username: assessor | Password: elastic

2. Install and Configure Metasponse​

  1. Start the Windows VM on the MIP and login to the OS

  2. From the VM settings, add a new Host-only network adapter to the Windows VM on the MIP

  3. Identify the IP address of the Host-only RHEL VMnet adapter (vmnet1) - this will be referenced as <HOST_ONLY_RHEL_IP> later, where Metasponse on the Windows VM will be forwarding data:

    ip a s vmnet1

  4. If not already performed, install the latest Metasponse IAW 262COS-MS-SOP-001 - Metasponse Client Setup as a Standalone configuration

  5. Modify the following Metasponse settings from the Web UI: (don't forget to click the save icon for each change)

    • ⛭ Analysis Option Defaults

      Elasticsearch: Server URL
      elastic.url      		https://<HOST_ONLY_RHEL_IP>:9200
      Elasticsearch: Pipeline name
      elastic.pipeline      		metasponse
      Elasticsearch: Export Data Model
      elastic.model      		ecs
      Elasticsearch: Version
      elastic.version      		ElasticSearch

    • ⛭ Authentication Option Defaults

      Elasticsearch: Username
      elastic.auth.user      		assessor
      Elasticsearch: Password
      elastic.auth.password      		elastic
      Elasticsearch: Verify SSL Certificate
      elastic.ssl.verify      		UNCHECKED (False)

3. Executing Metasponse​

info

All Metasponse jobs executed from the MIP's Metasponse instance that use the Elasticsearch Analyzer will now forward their job logs to the local MIP Elasticsearch instance.