Installation

---

note

Performing these procedures alone will configure Metasponse in a Standalone configuration that does not interact with the Metasponse Server.

---

Install Metasponse

1. Login to the Windows VM on the MIP
2. Transfer the latest Metasponse installer ZIP archive to it and unzip the archive (the default password is m3tasp0nse)
3. Run the installer as an administrator with its default install settings
4. At the end of the install, click Next, then Launch Settings Manager when presented and reconfigure the following settings: (don't forget to click the save icon for each change)

   • ⛭ Analysis Option Defaults

     Elasticsearch: Server URL elastic.url	https://elasticsearch.<KIT_DOMAIN>:9200
     Elasticsearch: Pipeline name elastic.pipeline	metasponse
     Elasticsearch: Export Data Model elastic.model	ecs
     Elasticsearch: Version elastic.version	ElasticSearch
     Mockingbird: URL mockingbird.url	http://mockingbird.<KIT_DOMAIN>:8090
     Mockingbird: Verify SSL Certificate mockingbird.ssl.verify	UNCHECKED (False)

   • ⛭ Authentication Option Defaults

     Elasticsearch: Username elastic.auth.user	metasponse
     Elasticsearch: Password elastic.auth.password	<KIT_PASSWORD>
     Elasticsearch: Verify SSL Certificate elastic.ssl.verify	UNCHECKED (False)

   • ⛭ Deployment Option Defaults

     Setting	Value
     Network Root job.netroot	\%WinDir%\Temp\262
     Physical Root job.phyroot	%WinDir%\Temp\262
     Unix Physical Root ssh.phyroot	/tmp/262
     Windows Physical Root ssh.win32.phyroot	C:\Windows\Temp\262

     NOTE: Changing the Network Root and Physical Root folders to a path with a known unique string will aid in whitelisting alerts that spawn from Metasponse activity

Elasticsearch 9 Compatability Fix

Elasticsearch 9 Compatability Fix

The following procedures must be accomplished to force Metasponse to allow data to be imported into Elasticsearch 9+. Failure to perform this step will prevent any Metasponse data from being imported into Elasticsearch 9+.

From an administrative PowerShell prompt, execute the following commands to patch the elastic.py script:

$File="C:\Program Files\Metasponse\Core\metasponse\data\elastic.py"

(gc $File) -replace 'major_version == 8','major_version > 7' | sc $File

Create an Elasticsearch user for Metasponse

note

This step is already accomplished if the Metasponse Server has already been setup IAW 262COS-DIP-SOP-001.

1. Using a web browser, navigate to Kibana and login via SSO as admin

2. Navigate to the (Management) Stack Management section of Kibana

3. Navigate to the (Security) Users sub-section within Management

4. Click on Create User, and enter:

   Username	metasponse
   Password	<KIT_PASSWORD>
   Confirm Password	<KIT_PASSWORD>
   Roles	superuser

5. Click on Create

Install custom plugins

1. Copy the contrib folder from \\fileserver\share\SCRIPTS\262COS-Metasponse_Plugins-PACKAGE-001\ to the Metasponse folder C:\Program Files\Metasponse\Core\
2. Restart Metasponse to view the loaded plugins

Semi-Centralized Configuration

Standalone vs. Semi-Centralized configuration

Stop here if you only wish to configure the MIP's Metasponse in a Standalone configuration, otherwise perform these additional procedures to use the Metasponse server as a central database for a Semi-Centralized configuration.

1. Open the MIP's Metasponse Web UI and navigate to ⛭ Settings
2. Reconfigure the following settings:
   • (🍂 Database Options) Address: metasponse

caution

The C:\Program Files\Metasponse\Core\.key file is used to encrypt and decrypt passwords within Metasponse – if all Metasponse instances sharing the same MongoDB do not have the same .key file, then job cloning will not clone any password fields and you will receive an error similar to: failed to decrypt option job.password

3. Sync encryption keys with the Metasponse server by copying the C:\Program Files\Metasponse\Core\.key file from the Metasponse Server Windows Server 2019 VM and replacing the MIP's Windows VM C:\Program Files\Metasponse\Core\.key file
4. Restart Metasponse

---

Metasponse v1.6.4.6464 Elastic Bug Fix

The following procedures fix a bug specific to Metasponse v1.6.4.6464 that prevents data from being imported into Elasticsearch 8+.

From an administrative PowerShell prompt, execute the following commands to patch the elastic.py script:

$File="C:\Program Files\Metasponse\Core\metasponse\data\elastic.py"

(gc $File) -replace 'yyyy-MM-ddTHH:mm:ss', 'yyyy-MM-dd\\''T\\''HH:mm:ss' | sc $File
(gc $File) -replace 'major_version == 7','major_version > 6' | sc $File

---