WEBVTT 00:00:01.130 --> 00:00:01.850 [Autogenerated] Alright. 00:00:01.890 --> 00:00:03.730 Les slides more demos. 00:00:04.350 --> 00:00:08.270 Let's hop into the lab and check out those Elastic Stack configurations. 00:00:08.890 --> 00:00:12.220 Well look under the hood for this specific set up and see what our 00:00:12.220 --> 00:00:15.750 different options are for getting the data into the stack, 00:00:15.790 --> 00:00:23.530 normalizing it and viewing it alright and here we are back in the lab and as I 00:00:23.530 --> 00:00:28.260 just mentioned we're gonna be talking about the snore integration with the 00:00:28.260 --> 00:00:34.320 Elastic Stack Now when we're talking about getting our logs ingested into a sim 00:00:34.330 --> 00:00:37.470 or some sort of centralized logging server, 00:00:37.980 --> 00:00:41.180 there's a couple of different ways that we can typically do this 00:00:41.180 --> 00:00:44.920 with just about any vendors device that we have with the 00:00:44.920 --> 00:00:47.860 Elastic Stack we have a couple different options, 00:00:47.870 --> 00:00:50.830 we can have Snort sent syslog to something like log 00:00:50.830 --> 00:00:52.960 stash or file beat to collect it. 00:00:52.970 --> 00:00:57.260 We can also have file beat or log stash on the system itself that snort 00:00:57.260 --> 00:01:02.690 resides and processes the log file as snort creates it. 00:01:03.400 --> 00:01:06.860 And with both of those tools we have the capability to add, 00:01:06.860 --> 00:01:12.540 change or remove different fields and field values and we can manipulate 00:01:12.540 --> 00:01:15.730 the logs as we need to to help normalize the data. 00:01:16.280 --> 00:01:20.610 Now with file beats specifically we have the option to 00:01:20.610 --> 00:01:23.510 use either just a typical log source, 00:01:23.520 --> 00:01:28.700 like the log file or it comes with a module that's pre built that 00:01:28.710 --> 00:01:31.170 gives it additional processing capabilities. 00:01:31.860 --> 00:01:36.040 Now in this setup we can configure it both ways but file beats using the 00:01:36.040 --> 00:01:41.460 traditional log method to get the logs over to Elasticsearch in Kibana So 00:01:41.460 --> 00:01:46.430 let's check out some of these snort logs first and then we'll talk about the 00:01:46.430 --> 00:01:51.330 configurations for file beat and if you need additional information on how to 00:01:51.340 --> 00:01:53.490 get the Elastic Stack set up, 00:01:53.500 --> 00:01:55.650 Pluralsight has plenty of labs and courses 00:01:55.650 --> 00:01:57.290 available that you can check out here. 00:01:58.100 --> 00:02:04.290 So in my global p cap box I'm running snort and file beat to process those logs, 00:02:04.350 --> 00:02:07.160 I'm gonna tail just the snort logs real quick. 00:02:08.400 --> 00:02:11.690 Now we have just a traditional snort setup where my logs are going 00:02:11.690 --> 00:02:17.080 into a text file in JSON format as you can see we have all of our 00:02:17.090 --> 00:02:21.150 field value pairs and of course the readability is a little bit 00:02:21.150 --> 00:02:22.770 difficult in this format. 00:02:23.290 --> 00:02:28.330 So what I like to do is use a tool called JQ to print it a little bit 00:02:28.330 --> 00:02:35.700 prettier so we can also tell that and then pipe jake jake Hewitt and you 00:02:35.700 --> 00:02:38.360 see the logs are formatted a little bit better, 00:02:38.370 --> 00:02:40.310 gives you a little bit more readability. 00:02:40.910 --> 00:02:44.610 So here's our snort logs that we have and file Beat is 00:02:44.610 --> 00:02:48.510 going to be looking at these logs specifically and as each 00:02:48.510 --> 00:02:50.200 event gets logged into here, 00:02:50.210 --> 00:02:53.610 file beats going to process that and send it over to the Elastic Stack 00:02:53.620 --> 00:02:58.390 or the rest of the Elastic Stack now I'm gonna navigate over to my file 00:02:58.390 --> 00:03:03.450 Beat directory and it might help if I exited tail first so let's see 00:03:03.450 --> 00:03:05.770 the into slash etc slash file. 00:03:05.770 --> 00:03:06.100 Beat. 00:03:08.500 --> 00:03:14.050 And in file b we have two main configuration files. 00:03:14.060 --> 00:03:18.660 The first one is the file beat dot YAML here and then the second 00:03:18.660 --> 00:03:22.520 one is going to be if we're using a module, 00:03:22.530 --> 00:03:25.600 whatever the configuration for those modules are. 00:03:26.650 --> 00:03:29.670 Now, if you run a command like this after file beats installed, 00:03:30.630 --> 00:03:34.100 you have the ability to list all of the modules that are pre built. 00:03:34.100 --> 00:03:35.080 That file be has. 00:03:35.090 --> 00:03:36.410 As you can see it's quite a few. 00:03:37.770 --> 00:03:41.310 We can also check that out by looking at the configuration files 00:03:41.320 --> 00:03:44.660 in the modules dot d folder and as you can see, 00:03:44.660 --> 00:03:46.060 we have my snort one enabled. 00:03:46.070 --> 00:03:48.430 So let's check out that configuration file, 00:03:48.440 --> 00:03:53.410 there's not much to it, but as you can see we're using the log source, 00:03:53.420 --> 00:03:54.380 it's enabled, 00:03:55.490 --> 00:04:01.520 our input instead of it being UdP or TCP is a file and then we have 00:04:01.520 --> 00:04:05.310 our bar path defined here that tells it where to look for the log 00:04:05.310 --> 00:04:08.050 file that starts generating and that's it. 00:04:08.200 --> 00:04:13.230 The Elastic Stack documentation for file Beat has all of the different variables 00:04:13.230 --> 00:04:16.060 and options that you can set to customize your environment, 00:04:16.060 --> 00:04:17.070 how you see fit. 00:04:17.089 --> 00:04:20.760 But from a basic setup perspective, this is all you need to get started. 00:04:20.779 --> 00:04:24.240 If you're using the file module to enable it, 00:04:24.250 --> 00:04:26.810 all you would have to do is run a command like this 00:04:26.810 --> 00:04:33.320 pseudo file Beat modules enable snort Now, 00:04:33.330 --> 00:04:35.890 since it's already enabled, we're not going to run it. 00:04:36.960 --> 00:04:39.540 Let's go check out that file Beat configuration too. 00:04:40.640 --> 00:04:44.890 And for this one we're gonna use more and we need sudo for this one 00:04:44.900 --> 00:04:47.100 because of the way I have file Beat installed. 00:04:47.110 --> 00:04:49.010 So here's the configuration. 00:04:49.010 --> 00:04:55.150 Example for file Beat and as you can see here we have the log source setting 00:04:55.150 --> 00:04:59.850 enabled for it instead of any other input source and we have the same 00:04:59.850 --> 00:05:03.500 directory that's defined here as we do in the module. 00:05:04.540 --> 00:05:09.340 So either way you can figure this, it'll work and like I said, 00:05:09.350 --> 00:05:12.540 the modules provide us such an easier time with 00:05:12.540 --> 00:05:15.580 normalizing the data and getting it in properly. 00:05:16.580 --> 00:05:19.240 We're not using the file stream option for input either. 00:05:20.460 --> 00:05:24.130 Right here in the file beat dot YAML file we have our modules 00:05:24.130 --> 00:05:28.700 configuration and as you can see here we have it set to reload 00:05:28.710 --> 00:05:31.900 automatically if it detects a configuration change. 00:05:31.930 --> 00:05:33.820 That's a really cool feature that I love about the 00:05:33.820 --> 00:05:38.430 Elastic Stack we're tagging all of our events as snort. 00:05:40.040 --> 00:05:43.190 We have our Elastic Stack output and let me scroll back up to 00:05:43.190 --> 00:05:44.730 that one so we can see it a little bit better. 00:05:46.330 --> 00:05:46.790 There we go. 00:05:46.790 --> 00:05:50.840 We have our Elastic Stack output that defines the index that we're using, 00:05:50.850 --> 00:05:55.560 tells us where to send the data to gives us our credentials for actually 00:05:55.560 --> 00:05:58.440 setting up the secure connection so on and so forth. 00:06:00.000 --> 00:06:00.680 All right, 00:06:01.260 --> 00:06:05.730 and that's it for the configuration on the snort and file Beat side 00:06:05.740 --> 00:06:10.930 in the next module and demo we're gonna hop into Kibana and actually 00:06:10.930 --> 00:06:13.990 see the data and see what we can do with it as it's coming into the 00:06:13.990 --> 00:06:16.610 Elastic Stack So stay with me. 00:06:17.720 --> 00:06:21.250 I'm glad we were able to go over all of those configurations. 00:06:21.870 --> 00:06:24.740 We'll need to check out the results of them in the next module. 00:06:25.000 --> 00:06:28.560 Before we close this one up, let's see what we covered in it. 00:06:29.290 --> 00:06:32.640 We learned about some of the expansion capabilities of snort. 00:06:33.650 --> 00:06:38.250 After this we dove into the integration with PF Sense and saw 00:06:38.250 --> 00:06:40.290 how it can be configured in that environment. 00:06:41.200 --> 00:06:44.550 We then talked about the ability to send snort logs and 00:06:44.550 --> 00:06:49.140 event data to a sim highlighting the Elastic Stack and its 00:06:49.140 --> 00:06:50.570 configuration surrounding it. 00:06:51.770 --> 00:06:53.640 You saw them in a lab as well. 00:06:54.590 --> 00:06:59.380 In the next module we'll dive deeper into the Snort integrations and see 00:06:59.380 --> 00:07:04.710 the snore event data in the Elastic Stack as well as dive into house nor 00:07:04.720 --> 00:07:07.680 integrates with Cisco's secure firewall solution. 00:07:08.410 --> 00:07:09.450 Join me there.