Skip to main content

OPERATION: *Beat Log Ingest

1. Start Elastic + supporting services​

  1. Ensure the Elastic and support services (kibana, elasticsearch, logstash, filebeat, arkime-viewer) are started:

    sudo systemctl start elastic.target

    NOTE: These services are set to auto-start on boot due to systemctl enable elastic.target being ran during installation

  2. You can also verify by accessing the web interfaces of Kibana (https://localhost:5601) and Arkime (https://localhost:8005)

    NOTE: Username: assessor | Password: elastic

2. Configure *Beat agent configs (pre-deployment)​

info

Logstash is configured to recieve Winlogbeat, Auditbeat, and Filebeat logs at 0.0.0.0:5045

NOTE: For deployed *beats agents, you would configure output.logstash.hosts: ["<MIP_IP>:5045"] within the respective *beats agent's .yml config to point to the MIP's routable IP (MIP_IP)

An example winlogbeat.yml would look like such:

NOTE: ssl.enabled: true and ssl.verification_mode: "none" are required to properly communicate with the MIP's Logstash.

winlogbeat.event_logs:
  - name: "Application"
    ignore_older: "168h"
  - name: "System"
    ignore_older: "168h"
  - name: "Security"
    ignore_older: "168h"
    event_id: -4703
  - name: "Microsoft-Windows-Sysmon/Operational"
    ignore_older: "168h"
  - name: "Microsoft-Windows-Bits-Client/Operational"
    ignore_older: "168h"
    event_id: 3,4,59,60
  - name: "Microsoft-Windows-Windows Defender/Operational"
    ignore_older: "168h"
  - name: "Microsoft-Windows-WinRM/Operational"
    ignore_older: "168h"
    event_id: -254,-145,-132,-10
  - name: "Microsoft-Windows-PowerShell/Operational"
    ignore_older: "168h"
    event_id: -8193,-8194,-8195,-8196,-8197,-12039
  - name: "Microsoft-Windows-TaskScheduler/Operational"
    ignore_older: "168h"
  - name: "Microsoft-Windows-WMI-Activity/Operational"
    ignore_older: "168h"
    event_id: -5857,-5858
  - name: "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
    ignore_older: "168h"
  - name: "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
    ignore_older: "168h"
  - name: "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
    ignore_older: "168h"
  - name: "Windows PowerShell"
    ignore_older: "168h"
  - name: "ForwardedEvents"
    ignore_older: "168h"
    tags: ["forwarded"]

output.logstash:
  hosts: ["<MIP_IP>:5045"]
  ssl.enabled: true
  ssl.verification_mode: "none"

processors:
  - add_host_metadata:
      when.not.contains.tags: "forwarded"
  - add_cloud_metadata: ~

3. Deploy host agents​

Deploy agents roughly IAW 262COS-HA-SOP-002 - CVAH Host Agent Deployment, remembering to modify the .yml files via the previous step.

4. Add firewall rule(s) to allow inbound logs to Logstash​

info

Logstash is configured to recieve Winlogbeat, Auditbeat, and Filebeat logs at 0.0.0.0:5045

Add firewall rules to allow inbound connections to TCP/5045 (Logstash) from the specific networks/IPs. This is an example command:

nft add rule ip filter INPUT ip saddr <NETWORK/IP_ADDRESS> tcp dport 5045 accept
tip

To delete the specific rule, you would need to run the following (its just the same command, just swap add for delete):

nft delete rule ip filter INPUT ip saddr <NETWORK/IP_ADDRESS> tcp dport 5045 accept

5. Connect the MIP to the network​

If not done already, connect the MIP to a network that enables the deployed *Beats agents to ship logs to the MIP.

6. Monitor in Kibana / Arkime​

Access the web interfaces of Kibana (https://localhost:5601) and Arkime (https://localhost:8005)

NOTE: Username: assessor | Password: elastic