Skip to main content

APPENDIX: Architecture + Maintenance

Web Services​

info

The following web UI services are exposed on all interfaces of the MIP RHEL host for analyst use:

  • KIBANA: https://localhost:5601

    NOTE: Username: assessor | Password: elastic

  • ARKIME-VIEWER: https://localhost:8005

    NOTE: Username: assessor | Password: elastic

Network Services​

info

The following non-web UI network services are exposed on all interfaces of the MIP RHEL host:

  • ELASTICSEARCH: https://localhost:9200

    NOTE: Username: assessor | Password: elastic

  • LOGSTASH: localhost:5045

    NOTE: TCP over TLS - feeds Auditbeat, Winlogbeat, and Filebeat logs through the pipeline

SystemD Services / Docker Containers​

info

The following SystemD services and correspinging Docker containers are installed:

elastic.target services: (enabled to auto-start on boot)

  • KIBANA: The kibana Docker container is running via the kibana service

    TIP: Use systemctl status kibana or docker logs -f kibana to track status
    NOTE: kibana cannot run without elasticsearch active

  • ELASTICSEARCH: The elasticsearch Docker container is running via the elasticsearch service

    TIP: Use systemctl status elasticsearch or docker logs -f elasticsearch to track status

  • LOGSTASH: The logstash Docker container is running via the logstash service

    TIP: Use systemctl status logstash or docker logs -f logstash to track status

  • ARKIME-VIEWER: The arkime-viewer Docker container is running via the arkime-viewer service

    TIP: Use systemctl status arkime-viewer or docker logs -f arkime-viewer to track status
    NOTE: arkime-viewer cannot run without elasticsearch active

sensor.target services:

  • FILEBEAT: The filebeat Docker container is running via the filebeat service

    TIP: Use systemctl status filebeat or docker logs -f filebeat to track status
    NOTE: filebeat is required to be active in order to ship zeek and suricata logs to logstash

  • ZEEK: The zeek Docker container is running via the zeek service

    TIP: Use docker exec zeek /opt/zeek/bin/zeekctl status to check status

  • SURICATA: The suricata Docker container is running via the suricata service

    TIP: Use systemctl status suricata or docker logs -f suricata to track status

  • ARKIME-CAPTURE: The arkime-capture Docker container is running via the arkime-capture service

    TIP: Use systemctl status arkime-capture or docker logs -f arkime-capture to track status
    NOTE: arkime-capture cannot run without elasticsearch active

Support services:

  • sensor-interfaces.service: Configures interfaces set in /cvah/dmip/sensor.cfg to promiscuous mode, disable ARP, and block outbound connections while the service is running, and reverts the configuration when stopped

SystemD Targets / Service Groups​

info

SystemD "targets" can be used to group services that are meant to run together so that you don't have to manage them individually.

  • elastic.target is used to control the status of all Elastic and support services (kibana, elasticsearch, logstash, arkime-viewer)

    NOTE: elastic.target is enabled to start on boot (all corresponding services will start on boot)
    STARTING: Use systemctl start elastic.target to start all corresponding services
    STOPPING: Use systemctl stop elastic.target to stop all corresponding services
    RESTARTING: Use systemctl restart elastic.target to restart all corresponding services

  • sensor.target is used to control the status of all Sensor services (zeek, suricata, arkime-capture, filebeat)

    NOTE: sensor.target is NOT enabled to start on boot (no corresponding services will start on boot)
    STARTING: Use systemctl start sensor.target to start all corresponding services
    STOPPING: Use systemctl stop sensor.target to stop all corresponding services
    RESTARTING: Use systemctl restart sensor.target to restart all corresponding services

Logging Locations​

info

Zeek and Suricata logs are automatcally shipped by filebeat.service to localhost:5045 (by way of logstash.service), but if you want to view the raw logs, they are mounted here:

  • ZEEK: /cvah/dmip/zeek/logs/
  • SURICATA: /cvah/dmip/suricata/logs/

Arkime PCAP collected by arkime-capture.service are stored here as compressed .tgz files:

  • ARKIME: /cvah/dmip/arkime/pcap/

Config Locations​

info

Unless otherwise directed by this SOP, it is highly recommended to not modify any of these configurations:

  • SENSOR CONFIG: /cvah/dmip/sensor.cfg - Config file that sets the sniffing interface(s), HOME_NET, and EXTERNAL_NET that propogates to zeek.service, suricata.service, and arkime-capture.service

    NOTE: This file exists so that you don't have to mess with any of the other config files

  • ELASTICSEARCH: /cvah/dmip/elasticsearch/ - Data and config files are stored here

    TIP: To wipe all Elasticsearch data (including Arkime), delete the contents of /cvah/dmip/elasticsearch/data/* and restart elastic.target

  • LOGSTASH: /cvah/dmip/logstash/ - Pipelines and config files are stored here

    TIP: Custom pipeline .conf are placed in /cvah/dmip/logstash/pipeline/ - you can place your own here too

  • KIBANA: /cvah/dmip/kibana/ - Config files are stored here

    WARNING: Do not touch unless you really know what you are doing

  • FILEBEAT: /cvah/dmip/filebeat/filebeat.yml - If you really want to redirect Zeek and Suricata logs to somewhere other than localhost:5045, you can modify this file

    WARNING: Do not touch unless you really know what you are doing

  • ZEEK: /cvah/dmip/zeek/ - Zeek has multiple configuration files stored here

    WARNING: Do not touch unless you really know what you are doing

  • SURICATA: /cvah/dmip/suricata/suricata.yaml - Suricata's configuration file

    WARNING: Do not touch unless you really know what you are doing

  • ARKIME: /cvah/dmip/arkime/config.ini - Arkime's configuration file

    WARNING: Do not touch unless you really know what you are doing

Elastic License​

info

The Elastic license used by Elasticsearch is copied from the DIP Controller (if it exists) to /cvah/dmip/license.json. To update the license, replace /cvah/dmip/license.json and restart the elasticsearch.service