[Autogenerated] let's take a look at the data that we're ingesting into the
Elastic Stack and see some visualizations we'll explore Kibana and the event
data that's coming in and see a few ways to use it.
Let's hop in.
All right,
welcome back to the lab and as we mentioned and this one
we're gonna be exploring that snort data in Kibana itself
so we can visualize it better.
So here we are in our Kibana instance on the global elastic
box that we have and this is where we were sending those
snort logs to using file beat.
Now the first step in making sure that the data is coming in properly is to
make sure that you have an index pattern defined here.
So we're going to navigate over to stack management
and then go to index patterns.
Now, as you can see, I have a couple different index patterns here,
but one of them is built specifically for file beat dash snort.
Now the file b dash snort,
that's part of the index parameter that we had being sent from our
Elasticsearch output portion of the configuration file for file
beat and then the star is a wild card meaning I don't care about
what day the data came in.
This index pattern will support all of it and then we can
control the date in the actual search parameters.
So let's check this out.
This index pattern specifically defines all of the fields and field
mapping is that we have available to us from the snort logs.
This is based on what Kibana knows and what is also seen coming
in and what's really cool about this is we can modify the fields
and have custom labels or custom formatting and there's even
advanced settings here, as I mentioned before.
If you need a refresher on the Elastic Stack Pluralsight has a
lot of course is dedicated to how to get this up and running very
quickly now that we saw some of the fields available and the
index pattern specifically, let's go search the data.
I'm gonna navigate over to the discover tab or the discovered dashboard
and this is where we search our data in this little drop-down I'm gonna
change the index pattern to our file beat Snort one just to make sure
that that's the data that we're pulling And we have all of our events now
my search defaulted to the last 15 minutes and as you can see we have 116
records here.
If we expand one of them we can see a lot of information and a lot of
those fields that we saw just now in the index patterns.
Our action for this one was lau we have our agent information from where
we got the data from which was the global p cap box.
We have our I.
P addresses and our Mac addresses for who transmitted the information,
we have the operating system type where the log came from and then
finally we have the log message itself with all of the information
and the field value pairs there.
We have a rule I.
D.
So this is the rule that was triggered.
We have our CID are VLAN number and that snort tag as well.
So there's a lot of information here.
It's really cool that we can look at this data and really
understand what was going on with it.
So being able to search the snort data in a visual
manner is an awesome capability.
So we can sift through the logs and identify specific events
that are happening in our environment.
And if you use the Elastic Stack or any other sim for log ingestion,
you can build in automation capabilities to define alerts for specific events,
you can tie it into an orchestration to allow yourself
remediation actions for specific events as well.
So tying snort into a sim and having those logs centrally available
and searchable is such a powerful capability and it's not just for
snore it's for any security product.
Having that information available is crucial to being able to
understand not only what happened but create the ability to
mitigate that moving forward.
We can also use kibana to visualize the information here.
So if we go to the visualization library we can pull up specific
visualizations that have been pre built for applications,
There's visualizations in here for snore,
there's ones for Apache for a sp .NET API servers so on and so forth.
There's a lot of built in visualizations but you can also create your
own and so I'm just going to create a quick lens one,
but you can add G o IP data and view maps with the
destination I PS at the source I PS of them,
you can create your custom visualizations or
aggregation based ones for the lens one.
We're just going to create a simple chart with some of the
data so I'm gonna switch that to snort and I want to search
for the host IP just as an example.
So I searched that in the search box and now I can just drag and drop the
field that I want to create a chart for straight over to this.
And as you can see we have two IPv4 addresses and two IPv6
addresses and these are for the same exact box,
we can change up the visualization and make them donuts or
make them a daily bar stacked chart and we can add additional
layers onto these visualizations.
So the visualization piece alone is a super powerful tool in
Kibana and this is just a very small example of it.
Now you might be thinking why is all of the data that we're
getting in from snort only about the snort box and not about
any of the hosts in the network.
Well it doesn't have a lot of rules configured for it to use yet,
there's only a couple and we haven't triggered them yet
and if we want to confirm what some of these fields are
that we're actually receiving, we can google the rule idea.
So 1 12 1 colon 11.
Let's go ahead and google that and we can pull that
straight up into the snort rule docks.
Just a normal art request that's unique cast.
Not broadcast.
What I really love about the ability to search the snort rule
docks though is the information that it provides.
This one's not giving us much because it's just an art message but
some of the other rules will have extensive documentation in here
and link to the miter attack framework.
Alright.
The last thing I want to show you is the security dashboard now,
this is really cool.
If you're using the Elastic Stack for security use cases,
if you're using it for snore or any other security platform,
you could actually create those detection rules and alerts that I was talking
about a couple of minutes ago and actually investigate any events that are
occurring on your network straight from in here.
Now, if your dad is not normalized,
you have to be careful because a lot of the capabilities in Kibana need some
sort of normalization in the BCS standard so keep that in mind,
you'll need to make sure that you have your data normalized to be able to
use some of these features but it's really cool because you can go in and
create alerts and also there's a whole bunch of rules pre configured for
tools like snore and stuff like that.
Right?
So we have rules defined for sport scanning and trace route and tell night.
So you have a lot of built in capabilities that you can use
straight out of the box right after you set it up.