WEBVTT

00:00:01.550 --> 00:00:04.200
[Autogenerated] now that we've seen the integration with Pf sense.

00:00:04.200 --> 00:00:09.170
Let's talk about getting our data over to a sim snort

00:00:09.410 --> 00:00:11.190
being one of the most popular I.

00:00:11.190 --> 00:00:11.390
D.

00:00:11.390 --> 00:00:12.020
S I.

00:00:12.020 --> 00:00:12.230
P.

00:00:12.230 --> 00:00:17.190
S tools out there has robust integrations with many different sim providers.

00:00:18.020 --> 00:00:22.370
Let's talk about the popular open source tool or set of tools,

00:00:22.460 --> 00:00:27.820
the Elastic Stack This tool provides the ability to

00:00:27.820 --> 00:00:33.400
not only collect in stash logs, event data and telemetry from multiple sources,

00:00:33.930 --> 00:00:37.590
but it gives you the ability to visualize the data

00:00:37.810 --> 00:00:39.620
in many different ways as well.

00:00:40.840 --> 00:00:43.610
There's different components that you need to work with for this

00:00:43.870 --> 00:00:47.160
and the Elastic Stack encompasses many of them.

00:00:48.280 --> 00:00:52.740
Elasticsearch is the base of the ecosystem and serves

00:00:52.750 --> 00:00:54.770
as the search and analytics engine.

00:00:55.970 --> 00:01:01.940
Kibana is the front end web GUI that allows us to search and visualize the data.

00:01:02.760 --> 00:01:06.840
The visualizations are one of the cool things that this integration

00:01:06.840 --> 00:01:11.660
provides many people have created their own visualizations and you can

00:01:11.660 --> 00:01:13.360
find some of them out there on the web.

00:01:14.130 --> 00:01:17.720
You can also use some of the pre built visualizations that Kibana

00:01:17.720 --> 00:01:21.590
provides on top of these that we'll see in the next demo.

00:01:22.030 --> 00:01:26.340
You can also use the security dashboard in Kibana to use the snore

00:01:26.340 --> 00:01:29.340
alerts to assist with identifying specific events,

00:01:29.820 --> 00:01:35.220
create alerts and investigate the activity log stash,

00:01:35.220 --> 00:01:41.430
collects parses filters and normalizes the data for Elasticsearch to use,

00:01:42.320 --> 00:01:45.920
You can use log stash to collect the logs that snort generates,

00:01:46.240 --> 00:01:50.610
create configurations to rewrite fields filter the data

00:01:50.970 --> 00:01:52.750
and send it to the rest of the stack.

00:01:54.280 --> 00:02:00.100
The beats applications help us collect and normalize data and provides pre built

00:02:00.100 --> 00:02:03.360
modules to help us with this for their single source type.

00:02:04.050 --> 00:02:09.720
You can use file B to do the same as log stash for some applications and it

00:02:09.720 --> 00:02:12.560
has those pre built modules that I was talking about.

00:02:14.020 --> 00:02:17.400
There are so many benefits to using snort with a sim that is

00:02:17.410 --> 00:02:20.220
absolutely crucial in most production instances.

00:02:21.090 --> 00:02:24.400
These help us understand our deployments better and allow us

00:02:24.400 --> 00:02:26.790
to view the data in more efficient ways.

00:02:27.090 --> 00:02:31.060
Also, this gives us the ability to tune a bit better as well.

00:02:31.990 --> 00:02:35.550
Sims provide us with a lot of stats that are helpful with this.

00:02:36.460 --> 00:02:39.720
If you've ever set up the Elastic Stack you can get it set up

00:02:39.720 --> 00:02:42.550
quickly by using a few different methods,

00:02:43.130 --> 00:02:47.700
building your own machine and installing the tools and using the

00:02:47.700 --> 00:02:51.110
Elastic Stack Docker containers are two of those options.

00:02:52.100 --> 00:02:56.220
Check out the documentation for the tools to learn more about this.