-
Notifications
You must be signed in to change notification settings - Fork 521
Elastic
We are currently working on integrating Elasticsearch, Logstash, and Kibana!
In addition, we've added Docker containers for the following:
Curator
DomainStats
ElastAlert
FreqServer
You can get an idea what this might look like at a high-level by viewing our proposed architecture diagram.
For more information, please see:
http://blog.securityonion.net/2017/09/elastic-stack-alpha-release-and.html
Please note the following MINIMUM requirements for the Elastic stack:
- 2 CPU cores
- 8GB RAM
Our Elastic integration is currently in Alpha and so the usual warnings and disclaimers apply:
- Experimental Setup is ALPHA, BLEEDING EDGE, and TOTALLY UNSUPPORTED!
- If this breaks your system, you get to keep both pieces!
- This is a work in progress and is in constant flux.
- This is intended to build a quick prototype proof of concept so you can see what our ultimate Elastic configuration might look like. This configuration will change drastically over time leading up to the final release.
- Do NOT run this on a system that you care about!
- Do NOT run this on a system that has data that you care about!
- This should only be run on a TEST box with TEST data!
- Experimental Setup may result in nausea, vomiting, or a burning sensation.
The easiest way to try the new Elastic integration is using our 14.04.5.3 (or newer) ISO image: http://blog.securityonion.net/2017/09/elastic-stack-alpha-release-and.html
Alternatively, if you have an existing TEST installation or if you want to install using an ISO image other than our 14.04.5.3 (or newer), you can install the securityonion-elastic
package and then run so-elastic-download
as follows:
sudo soup
sudo apt install securityonion-elastic
sudo so-elastic-download
If you've already run Setup, you can then convert the box from ELSA to Elastic using so-elastic-configure:
sudo so-elastic-configure
If this is a fresh installation where you haven't run Setup yet, then you can instead run sosetup:
sudo sosetup
- Introduction
- Use Cases
- Hardware Requirements
- Release Notes
- Download/Install
- Booting Issues
- After Installation
- UTC and Time Zones
- Services
- VirtualBox Walkthrough
- VMWare Walkthrough
- Videos
- Architecture
- Cheat Sheet
- Conference
- Elastic Stack
- Elastic Architecture
- Elasticsearch
- Logstash
- Kibana
- ElastAlert
- Curator
- FreqServer
- DomainStats
- Docker
- Redis
- Data Fields
- Beats
- Pre-Releases
- ELSA to Elastic
- Network Configuration
- Proxy Configuration
- Firewall/Hardening
- Email Configuration
- Integrating with other systems
- Changing IP Addresses
- NTP
- Managing Alerts
- Managing Rules
- Adding Local Rules
- Disabling Processes
- Filtering with BPF
- Adjusting PF_RING for traffic
- MySQL Tuning
- Adding a new disk
- High Performance Tuning
- Trimming PCAPs