-
Notifications
You must be signed in to change notification settings - Fork 521
Elastic RC1
Our Elastic integration is still considered experimental and so the usual warnings and disclaimers apply:
Experimental Setup is BLEEDING EDGE and TOTALLY UNSUPPORTED!
- If this breaks your system, you get to keep both pieces!
- This is a work in progress and is in constant flux.
- This is intended to build a quick prototype proof of concept so you can see what our ultimate Elastic configuration might look like. This configuration will change drastically over time leading up to the final release.
- Do NOT run this on a system that you care about!
- Do NOT run this on a system that has data that you care about!
- This should only be run on a TEST box with TEST data!
- Experimental Setup may result in nausea, vomiting, or a burning sensation.
Performing an in-place upgrade from previous Alpha/Beta releases to the current Release Candidate is NOT officially supported, but here are the steps you can try. If you encounter any issues, please perform a fresh installation of the current Release Candidate.
If you're just upgrading a single standalone box, start with updating to the latest packages:
sudo soup
Then delete the Kibana index and index template and reconfigure Kibana:
curl -XDELETE http://localhost:9200/_template/kibana
curl -XDELETE http://localhost:9200/.kibana
sudo so-elastic-configure-kibana
Finally, delete ElastAlert indices and template and restart ElastAlert:
sudo docker stop so-elastalert
curl -XDELETE http://localhost:9200/elastalert_status
curl -XDELETE http://localhost:9200/elastalert_status_silence
curl -XDELETE http://localhost:9200/elastalert_status_error
curl -XDELETE http://localhost:9200/elastalert_status_status
curl -XDELETE http://localhost:9200/elastalert_status_past
curl -XDELETE http://localhost:9200/_template/elastalert
sudo docker start so-elastalert
If you're upgrading a distributed deployment, please perform the following steps on the master server before upgrading any sensors.
First, update all packages:
sudo soup
Then delete the Kibana index and index template and reconfigure Kibana:
curl -XDELETE http://localhost:9200/_template/kibana
curl -XDELETE http://localhost:9200/.kibana
sudo so-elastic-configure-kibana
Finally, delete ElastAlert indices and template and restart ElastAlert:
sudo docker stop so-elastalert
curl -XDELETE http://localhost:9200/elastalert_status
curl -XDELETE http://localhost:9200/elastalert_status_silence
curl -XDELETE http://localhost:9200/elastalert_status_error
curl -XDELETE http://localhost:9200/elastalert_status_status
curl -XDELETE http://localhost:9200/elastalert_status_past
curl -XDELETE http://localhost:9200/_template/elastalert
sudo docker start so-elastalert
Once the master is updated, then perform the following steps on each sensor.
First, update all packages:
sudo soup
Then delete the Kibana index and index template:
curl -XDELETE http://localhost:9200/_template/kibana
curl -XDELETE http://localhost:9200/.kibana
Finally, delete ElastAlert indices and template and disable ElastAlert:
sudo docker stop so-elastalert
curl -XDELETE http://localhost:9200/elastalert_status
curl -XDELETE http://localhost:9200/elastalert_status_silence
curl -XDELETE http://localhost:9200/elastalert_status_error
curl -XDELETE http://localhost:9200/elastalert_status_status
curl -XDELETE http://localhost:9200/elastalert_status_past
curl -XDELETE http://localhost:9200/_template/elastalert
sudo sed -i 's|ELASTALERT_ENABLED="yes"|ELASTALERT_ENABLED="no"|g' /etc/nsm/securityonion.conf
- Introduction
- Use Cases
- Hardware Requirements
- Release Notes
- Download/Install
- Booting Issues
- After Installation
- UTC and Time Zones
- Services
- VirtualBox Walkthrough
- VMWare Walkthrough
- Videos
- Architecture
- Cheat Sheet
- Conference
- Elastic Stack
- Elastic Architecture
- Elasticsearch
- Logstash
- Kibana
- ElastAlert
- Curator
- FreqServer
- DomainStats
- Docker
- Redis
- Data Fields
- Beats
- Pre-Releases
- ELSA to Elastic
- Network Configuration
- Proxy Configuration
- Firewall/Hardening
- Email Configuration
- Integrating with other systems
- Changing IP Addresses
- NTP
- Managing Alerts
- Managing Rules
- Adding Local Rules
- Disabling Processes
- Filtering with BPF
- Adjusting PF_RING for traffic
- MySQL Tuning
- Adding a new disk
- High Performance Tuning
- Trimming PCAPs