Elastic Stack 6 : Install Auditbeat2018/02/12 |
Install Auditbeat that can monitor Audit actions.
|
|
[1] | Install Auditbeat. Configure Elasticsearch repository before it. |
[root@dlp ~]# yum -y install auditbeat
|
[2] | Configure basic settings and start Auditbeat. |
[root@dlp ~]#
vi /etc/auditbeat/auditbeat.yml # line 13: set Audit action (way of writing rules is the same with auditctl) - module: auditd audit_rules: | ## Define audit rules here. ## Create file watches (-w) or syscall audits (-a or -A). Uncomment these ## examples or add your own rules. ## If you are on a 64 bit platform, everything should be running ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls ## because this might be a sign of someone exploiting a hole in the 32 ## bit API. #-a always,exit -F arch=b32 -S all -F key=32bit-abi ## Executions. #-a always,exit -F arch=b64 -S execve,execveat -k exec ## External access (warning: these can be expensive to audit). #-a always,exit -F arch=b64 -S accept,bind,connect -F key=external-access ## Identity changes. #-w /etc/group -p wa -k identity #-w /etc/passwd -p wa -k identity #-w /etc/gshadow -p wa -k identity ..... ..... # line 88: if use Kibana, uncomment and specify output host # if SSL is enabled on Kibana, hostname should be the same with the hostname in certs
setup.kibana:
.....
host: "https://dlp.srv.world:5601"
# line 114: specify output host # the default is localhost's Elasticsearch # if output to Logstash, comment out Elasticsearch and uncomment logstash lines output.elasticsearch: # Array of hosts to connect to.l hosts: ["localhost:9200"] ..... ..... #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"]
[root@dlp ~]#
vi /etc/auditbeat/auditbeat.reference.yml # line 34: basic settings for auditd module - module: auditd resolve_ids: true failure_mode: silent backlog_limit: 8196 rate_limit: 0 include_raw_message: false include_warnings: false audit_rules: | ..... .....[root@dlp ~]# systemctl start auditbeat [root@dlp ~]# systemctl enable auditbeat
|
[3] | Make sure the data has been collected normally. |
# index list [root@dlp ~]# curl localhost:9200/_cat/indices?v health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open filebeat-6.2.1-2018.02.14 uzqg8... 3 1 30107 0 4mb 4mb yellow open sshd_fail-2018.02 ghhQe... 5 1 69 0 265.9kb 265.9kb yellow open packetbeat-6.2.1-2018.02.14 -O8vG... 3 1 8182 0 2.1mb 2.1mb green open .kibana sV0Ds... 1 0 412 0 497.1kb 497.1kb yellow open auditbeat-6.2.1-2018.02.14 aECFl... 3 1 1384 0 734.7kb 734.7kb yellow open test_index CIPjY... 5 1 1 0 6kb 6kb yellow open heartbeat-6.2.1-2018.02.14 29OqT... 1 1 206 0 126.6kb 126.6kb yellow open metricbeat-6.2.1-2018.02.14 OhrZT... 1 1 32561 0 5.9mb 5.9mb # document list on the index [root@dlp ~]# curl localhost:9200/auditbeat-6.2.1-2018.02.14/_search?pretty { "took" : 4, "timed_out" : false, "_shards" : { "total" : 3, "successful" : 3, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 1384, "max_score" : 1.0, "hits" : [ { "_index" : "auditbeat-6.2.1-2018.02.14", "_type" : "doc", ..... ..... |
[4] | If Kibana is running, it's possible to import data to sample Dashboards. |
[root@dlp ~]# auditbeat setup --dashboards Loaded dashboards |
Sponsored Link |