[Autogenerated] Alright.
Les slides more demos.
Let's hop into the lab and check out those Elastic Stack configurations.
Well look under the hood for this specific set up and see what our
different options are for getting the data into the stack,
normalizing it and viewing it alright and here we are back in the lab and as I
just mentioned we're gonna be talking about the snore integration with the
Elastic Stack Now when we're talking about getting our logs ingested into a sim
or some sort of centralized logging server,
there's a couple of different ways that we can typically do this
with just about any vendors device that we have with the
Elastic Stack we have a couple different options,
we can have Snort sent syslog to something like log
stash or file beat to collect it.
We can also have file beat or log stash on the system itself that snort
resides and processes the log file as snort creates it.
And with both of those tools we have the capability to add,
change or remove different fields and field values and we can manipulate
the logs as we need to to help normalize the data.
Now with file beats specifically we have the option to
use either just a typical log source,
like the log file or it comes with a module that's pre built that
gives it additional processing capabilities.
Now in this setup we can configure it both ways but file beats using the
traditional log method to get the logs over to Elasticsearch in Kibana So
let's check out some of these snort logs first and then we'll talk about the
configurations for file beat and if you need additional information on how to
get the Elastic Stack set up,
Pluralsight has plenty of labs and courses
available that you can check out here.
So in my global p cap box I'm running snort and file beat to process those logs,
I'm gonna tail just the snort logs real quick.
Now we have just a traditional snort setup where my logs are going
into a text file in JSON format as you can see we have all of our
field value pairs and of course the readability is a little bit
difficult in this format.
So what I like to do is use a tool called JQ to print it a little bit
prettier so we can also tell that and then pipe jake jake Hewitt and you
see the logs are formatted a little bit better,
gives you a little bit more readability.
So here's our snort logs that we have and file Beat is
going to be looking at these logs specifically and as each
event gets logged into here,
file beats going to process that and send it over to the Elastic Stack
or the rest of the Elastic Stack now I'm gonna navigate over to my file
Beat directory and it might help if I exited tail first so let's see
the into slash etc slash file.
Beat.
And in file b we have two main configuration files.
The first one is the file beat dot YAML here and then the second
one is going to be if we're using a module,
whatever the configuration for those modules are.
Now, if you run a command like this after file beats installed,
you have the ability to list all of the modules that are pre built.
That file be has.
As you can see it's quite a few.
We can also check that out by looking at the configuration files
in the modules dot d folder and as you can see,
we have my snort one enabled.
So let's check out that configuration file,
there's not much to it, but as you can see we're using the log source,
it's enabled,
our input instead of it being UdP or TCP is a file and then we have
our bar path defined here that tells it where to look for the log
file that starts generating and that's it.
The Elastic Stack documentation for file Beat has all of the different variables
and options that you can set to customize your environment,
how you see fit.
But from a basic setup perspective, this is all you need to get started.
If you're using the file module to enable it,
all you would have to do is run a command like this
pseudo file Beat modules enable snort Now,
since it's already enabled, we're not going to run it.
Let's go check out that file Beat configuration too.
And for this one we're gonna use more and we need sudo for this one
because of the way I have file Beat installed.
So here's the configuration.
Example for file Beat and as you can see here we have the log source setting
enabled for it instead of any other input source and we have the same
directory that's defined here as we do in the module.
So either way you can figure this, it'll work and like I said,
the modules provide us such an easier time with
normalizing the data and getting it in properly.
We're not using the file stream option for input either.
Right here in the file beat dot YAML file we have our modules
configuration and as you can see here we have it set to reload
automatically if it detects a configuration change.
That's a really cool feature that I love about the
Elastic Stack we're tagging all of our events as snort.
We have our Elastic Stack output and let me scroll back up to
that one so we can see it a little bit better.
There we go.
We have our Elastic Stack output that defines the index that we're using,
tells us where to send the data to gives us our credentials for actually
setting up the secure connection so on and so forth.
All right,
and that's it for the configuration on the snort and file Beat side
in the next module and demo we're gonna hop into Kibana and actually
see the data and see what we can do with it as it's coming into the
Elastic Stack So stay with me.
I'm glad we were able to go over all of those configurations.
We'll need to check out the results of them in the next module.
Before we close this one up, let's see what we covered in it.
We learned about some of the expansion capabilities of snort.
After this we dove into the integration with PF Sense and saw
how it can be configured in that environment.
We then talked about the ability to send snort logs and
event data to a sim highlighting the Elastic Stack and its
configuration surrounding it.
You saw them in a lab as well.
In the next module we'll dive deeper into the Snort integrations and see
the snore event data in the Elastic Stack as well as dive into house nor
integrates with Cisco's secure firewall solution.
Join me there.