DShield SIEM Docker Updates – SANS Internet Storm Center

Date:

Share post:

Over the past several weeks, I have been testing various enhancements to the DShield SIEM, to process DShield sensor log from local and cloud sensors with Filebeat and Filebeat modules to easily send Zeek and NetFlow logs back to a local network ELK stack via home router natting. This is a list of updates and enhancements:

– Upgrade to the current version of Elastic 8.17.2

– A single script to configure the base configuration of all the docker files (change_perms.sh)

– Addition of docker filebeat for cloud DShield sensor collection (Cowrie, Zeek & NetFlow logs)

– Second filebeat to ingest ISC & Rosti Threat Intel IP data [3]

– Separation of GitHub DShield SIEM & DShield sensor scripts

– Addition to docker Metricbeat for ELK Stack metric information

– Updated dashboard that includes Zeek in the tab lists

– Query in one dashboard is linked to the others

– Tested the ELK Stack in a LXC Proxmox container [4]

– The addition of ELK Stack monitoring of all the Beats and Logstash

– Configured Logstash to parse logs with Beats pipelines (Zeek & NetFlow)

– Removed and merged multiple steps to simplify the installation (change_perms.sh)

– Updated some sections of the Troubleshooting document [5]

– Updated some sections of the docker useful commands [6]

– Updated the DShield SIEM network flow [7]

– Docker update steps to current version [8]

DShield SIEM Main Dashboard

[1] https://github.com/bruneaug/DShield-SIEM/tree/main

[2] https://github.com/bruneaug/DShield-Sensor

[3] https://github.com/bruneaug/DShield-SIEM/blob/main/AddOn/ISC_threatintel.md

[4] https://github.com/bruneaug/DShield-SIEM/blob/main/AddOn/LXC_Container_DShield-SIEM.md

[5] https://github.com/bruneaug/DShield-SIEM/blob/main/Troubleshooting/Troubleshooting_SIEM_and_Sensor.md

[6] https://github.com/bruneaug/DShield-SIEM/blob/main/Troubleshooting/docker_useful_commands..md

[7] https://github.com/bruneaug/DShield-SIEM/blob/main/Troubleshooting/DShield-SIEM-Flow.png

[8] https://github.com/bruneaug/DShield-SIEM/blob/main/Troubleshooting/docker_useful_commands..md#update-dshield-elk-to-the-latest-version

[9] https://www.elastic.co/guide/en/elasticsearch/reference/current/release-notes-8.17.2.html

———–

Guy Bruneau IPSS Inc.

My GitHub Page

Twitter: GuyBruneau

gbruneau at isc dot sans dot edu



Source link

spot_img

Related articles

Scans for Ichano AtHome IP Cameras

Ichano's "AtHome Camera" is a bit of a different approach to home surveillance cameras . Instead of a...

Nephew of the ZX Spectrum inventor has created a handheld Raspberry Pi console the size of a gift card — GamerCard features 4-inch square...

Retro gaming's resurgence in recent years has led to some of the coolest devices that have made the...

Unify Fragmented Data with Gevme Platform

Step into most post-event debriefs and you’ll hear it: “Our numbers don’t match theirs.” Sales pulls one report....