{"id":54536,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-elastic-stack-analiz-security-logov-dashbordy"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"3-elastic-stack-analiz-security-logov-dashbordy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","title":{"rendered":"3. Elastic stack: anal\u00fdza bezpe\u010dnostn\u00edch log\u016f. Dashboardy","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"3.
\n
\nV p\u0159edchoz\u00edch \u010dl\u00e1nc\u00edch jsme se trochu sezn\u00e1mili se stakem ELK a nastaven\u00edm konfigura\u010dn\u00edho souboru Logstash pro parsov\u00e1n\u00ed log\u016f, v tomto \u010dl\u00e1nku se posuneme k tomu nejd\u016fle\u017eit\u011bj\u0161\u00edmu z pohledu anal\u00fdzy, co chcete od syst\u00e9mu vid\u011bt a pro\u010d bylo v\u0161e vytvo\u0159eno \u2014 jsou to grafy a tabulky spojen\u00e9 v dashboardy<\/b>. Dnes se bl\u00ed\u017ee sezn\u00e1m\u00edme se syst\u00e9mem vizualizace Kibana<\/b>, pod\u00edv\u00e1me se, jak vytv\u00e1\u0159et grafy, tabulky a v\u00fdsledkem bude jednoduch\u00fd dashboard zalo\u017een\u00fd na logech z firewallu Check Point.
\n<\/a><\/noindex>
\nPrvn\u00edm krokem p\u0159i pr\u00e1ci s Kibana je vytvo\u0159en\u00ed index pattern<\/b>, logicky, to je soubor index\u016f sdru\u017een\u00fdch podle ur\u010dit\u00e9ho principu. Samoz\u0159ejm\u011b, je to \u010dist\u011b nastaven\u00ed, kter\u00e9 usnad\u0148uje Kibana hled\u00e1n\u00ed informac\u00ed ve v\u0161ech indexech najednou. Je definov\u00e1no podle shody \u0159et\u011bzce, nap\u0159\u00edklad \u201echeckpoint-*\u201c a n\u00e1zvu indexu. Nap\u0159\u00edklad \u201echeckpoint-2019.12.05\u201c vyhovuje vzoru, ale prost\u011b \u201echeckpoint\u201c u\u017e ne. Zvl\u00e1\u0161\u0165 stoj\u00ed za zm\u00ednku, \u017ee nelze sou\u010dasn\u011b vyhled\u00e1vat informace podle r\u016fzn\u00fdch vzor\u016f index\u016f, pozd\u011bji v n\u00e1sleduj\u00edc\u00edch \u010dl\u00e1nc\u00edch uvid\u00edme, \u017ee API dotazy se prov\u00e1d\u011bj\u00ed bu\u010f podle n\u00e1zvu indexu, nebo pr\u00e1v\u011b podle jednoho \u0159et\u011bzce vzoru, obr\u00e1zek je klikac\u00ed:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

Po tom zkontrolujeme v menu Discover, \u017ee v\u0161echny logy jsou indexov\u00e1ny a spr\u00e1vn\u011b nastaven\u00fd parser. Pokud se objev\u00ed jak\u00e9koli nesrovnalosti, nap\u0159\u00edklad zm\u011bnit typ dat z \u0159et\u011bzce na cel\u00e9 \u010d\u00edslo, je t\u0159eba upravit konfigura\u010dn\u00ed soubor Logstash, v d\u016fsledku \u010deho\u017e budou nov\u00e9 logy zapisov\u00e1ny spr\u00e1vn\u011b. Aby star\u00e9 logy p\u0159ed zm\u011bnou p\u0159ijaly po\u017eadovan\u00fd form\u00e1t, pom\u00e1h\u00e1 pouze proces reindexace, kter\u00fd bude podrobn\u011bji probr\u00e1n v n\u00e1sleduj\u00edc\u00edch \u010dl\u00e1nc\u00edch. Ujist\u00edme se, \u017ee je v\u0161e v po\u0159\u00e1dku, obr\u00e1zek je klikac\u00ed:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

Logy se nach\u00e1zej\u00ed na m\u00edst\u011b, tak\u017ee m\u016f\u017eeme p\u0159istoupit k vytv\u00e1\u0159en\u00ed dashboard\u016f. Na z\u00e1klad\u011b anal\u00fdzy dashboard\u016f od produkt\u016f zabezpe\u010den\u00ed lze pochopit stav bezpe\u010dnosti v organizaci, n\u00e1le\u017eit\u011b vid\u011bt zraniteln\u00e1 m\u00edsta v aktu\u00e1ln\u00ed politice a n\u00e1sledn\u011b navrhnout zp\u016fsoby jejich odstran\u011bn\u00ed. Vytvo\u0159\u00edme mal\u00fd dashboard, kter\u00fd bude sest\u00e1vat z 5 komponent\u016f: <\/p>\n

    \n
  1. tabulku pro po\u010d\u00edt\u00e1n\u00ed celkov\u00e9ho po\u010dtu log\u016f podle blade<\/li>\n
  2. tabulku s kritick\u00fdmi signaturami IPS<\/li>\n
  3. kol\u00e1\u010dov\u00fd diagram ud\u00e1lost\u00ed Threat Prevention<\/li>\n
  4. diagram nejnav\u0161t\u011bvovan\u011bj\u0161\u00edch webov\u00fdch str\u00e1nek<\/li>\n
  5. diagram vyu\u017eit\u00ed nejnebezpe\u010dn\u011bj\u0161\u00edch aplikac\u00ed<\/li>\n<\/ol>\n

    \nPro vytvo\u0159en\u00ed vizualiza\u010dn\u00edch figur zkuste p\u0159ej\u00edt do menu Vizualizovat<\/b>, a vybrat po\u017eadovanou figuru, kterou chceme postavit! Poj\u010fme to vz\u00edt postupn\u011b.<\/p>\n

    Tabulka pro v\u00fdpo\u010det celkov\u00e9ho po\u010dtu log\u016f podle bled\u016f<\/h3>\n

    \nK tomu vybereme figuru Data Table<\/b>, p\u0159ejdeme do n\u00e1stroje pro vytv\u00e1\u0159en\u00ed graf\u016f, vlevo se nastavuj\u00ed parametry figury a vpravo je zobrazen\u00ed v aktu\u00e1ln\u00edm nastaven\u00ed. Nejprve uk\u00e1\u017eu, jak bude hotov\u00e1 tabulka vypadat, pot\u00e9 projdeme nastaven\u00edm, obr\u00e1zek je klikac\u00ed:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Podrobn\u011bj\u0161\u00ed nastaven\u00ed figury, obr\u00e1zek je klikac\u00ed:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Projdeme nastaven\u00ed.<\/p>\n

    Nejprve se nastavuje metrika<\/b>, co\u017e je hodnota, podle kter\u00e9 budou agregov\u00e1na v\u0161echna pole. Metriky se po\u010d\u00edtaj\u00ed na z\u00e1klad\u011b hodnot, kter\u00e9 byly z\u00edsk\u00e1ny r\u016fzn\u00fdmi zp\u016fsoby z dokument\u016f. Hodnoty se obvykle z\u00edsk\u00e1vaj\u00ed z pol\u00ed<\/b> dokumentu, ale tak\u00e9 mohou b\u00fdt generov\u00e1ny pomoc\u00ed skript\u016f. V tomto p\u0159\u00edpad\u011b nastav\u00edme Agregace: Po\u010det<\/b> celkov\u00fd po\u010det log\u016f).<\/p>\n

    Pot\u00e9 rozd\u011bl\u00edme tabulku podle segment\u016f (pol\u00ed), podle kter\u00fdch se bude po\u010d\u00edtat metrika. Tuto funkci vykon\u00e1v\u00e1 nastaven\u00ed Buckets, kter\u00e9 se skl\u00e1d\u00e1 ze 2 variant nastaven\u00ed: <\/p>\n

      \n
    1. split rows \u2014 p\u0159id\u00e1n\u00ed sloupc\u016f a n\u00e1sledn\u00e9 rozd\u011blen\u00ed tabulky na \u0159\u00e1dky<\/li>\n
    2. split table \u2014 rozd\u011blen\u00ed na n\u011bkolik tabulek podle hodnot ur\u010dit\u00e9ho pole. <\/li>\n<\/ol>\n

      \nV buckets<\/b> m\u016f\u017eete p\u0159idat n\u011bkolik d\u011blen\u00ed pro vytvo\u0159en\u00ed n\u011bkolika sloupc\u016f nebo tabulek, omezen\u00ed zde jsou sp\u00ed\u0161e logick\u00e1. V agregaci si m\u016f\u017eete vybrat, jak\u00fdm zp\u016fsobem dojde k d\u011blen\u00ed na segmenty: ipv4 range, date range, Terms atd. Nejpoutav\u011bj\u0161\u00edm v\u00fdb\u011brem je pr\u00e1v\u011b Terms<\/b> a Significant Terms<\/b>, d\u011blen\u00ed na segmenty se prov\u00e1d\u00ed podle hodnot ur\u010dit\u00e9ho pole indexu, rozd\u00edl mezi nimi spo\u010d\u00edv\u00e1 v po\u010dtu vr\u00e1cen\u00fdch hodnot a jejich zobrazen\u00ed. Proto\u017ee chceme rozd\u011blit tabulku podle n\u00e1zvu bled\u016f, vybereme pole \u2014 product.keyword<\/b> a nastav\u00edme velikost na 25 vracen\u00fdch hodnot. <\/p>\n

      M\u00edsto \u0159\u00e1dk\u016f se v elasticsearch pou\u017e\u00edvaj\u00ed 2 typy dat \u2014 text<\/b> a keyword<\/b>. Pokud chcete prov\u00e1d\u011bt fulltextov\u00e9 vyhled\u00e1v\u00e1n\u00ed, mus\u00edte pou\u017e\u00edt typ text, co\u017e je velmi praktick\u00e1 funkce p\u0159i vytv\u00e1\u0159en\u00ed vlastn\u00edho vyhled\u00e1vac\u00edho servisu, nap\u0159\u00edklad hled\u00e1te zm\u00ednku slova v konkr\u00e9tn\u00ed hodnot\u011b pole (textu). Pokud chcete pouze p\u0159esnou shodu, mus\u00edte pou\u017e\u00edt typ keyword. Tento datov\u00fd typ byste m\u011bli tak\u00e9 pou\u017e\u00edt pro pole, kter\u00e1 vy\u017eaduj\u00ed \u0159azen\u00ed nebo agregaci, tedy v na\u0161em p\u0159\u00edpad\u011b.<\/p>\n

      V\u00fdsledkem Elasticsearch je po\u010det log\u016f za ur\u010dit\u00e9 obdob\u00ed s agregac\u00ed podle hodnoty v poli product. V Custom Label nastavujeme n\u00e1zev sloupce, kter\u00fd se zobraz\u00ed v tabulce, ur\u010dujeme \u010das, za kter\u00fd sb\u00edr\u00e1me logy, spou\u0161t\u00edme vykreslen\u00ed \u2014 Kibana pos\u00edl\u00e1 dotaz do elasticsearch, \u010dek\u00e1 na odpov\u011b\u010f a pot\u00e9 vizualizuje z\u00edskan\u00e1 data. Tabulka je hotov\u00e1!<\/p>\n

      Kol\u00e1\u010dov\u00fd graf ud\u00e1lost\u00ed Threat Prevention<\/h3>\n

      \nZvl\u00e1\u0161tn\u00ed z\u00e1jem vzbuzuj\u00ed informace, kolik vlastn\u011b v procentu\u00e1ln\u00edm pom\u011bru reakc\u00ed detect<\/b> a prevent<\/b> na incidenty IT bezpe\u010dnosti v aktu\u00e1ln\u00ed bezpe\u010dnostn\u00ed politice. V takov\u00e9m p\u0159\u00edpad\u011b je vhodn\u00e9 pou\u017e\u00edt kol\u00e1\u010dov\u00fd graf. Vyberte v Visualize \u2014 Pie chart<\/b>. V metrice tak\u00e9 nastavujeme agregaci podle po\u010dtu log\u016f. V buckets nastav\u00edme Terms => action. <\/p>\n

      Vypad\u00e1 to spr\u00e1vn\u011b, ale v\u00fdsledkem se zobrazuj\u00ed hodnoty ze v\u0161ech blade\u016f, je t\u0159eba filtrovat pouze podle t\u011bch blade\u016f, kter\u00e9 pracuj\u00ed v r\u00e1mci Threat Prevention. Proto je nutn\u00e9 nastavit filtr<\/b> , aby se informace hledaly pouze podle blade\u016f odpov\u00eddaj\u00edc\u00edch za incidenty IT bezpe\u010dnosti \u2014 product: (\u201eAnti-Bot\u201c NEBO \u201eNov\u00fd Anti-Virus\u201c NEBO \u201eDDoS Protector\u201c NEBO \u201eSmartDefense\u201c NEBO \u201eThreat Emulation\u201c). Obr\u00e1zek je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      A podrobn\u011bj\u0161\u00ed nastaven\u00ed, obr\u00e1zek je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Tabulka ud\u00e1lost\u00ed IPS<\/h3>\n

      \nDal\u0161\u00edm velmi d\u016fle\u017eit\u00fdm z hlediska IT bezpe\u010dnosti je p\u0159ehled a kontrola ud\u00e1lost\u00ed podle bladeu IPS<\/b> a Threat Emulation<\/b>, kter\u00e9 nejsou blokov\u00e1ny<\/b> aktu\u00e1ln\u00ed politikou, abychom toto n\u00e1sledn\u011b bu\u010f p\u0159evedli signaturu na prevent, nebo pokud je provoz platn\u00fd \u2014 signaturu nekontrolovali. Tabulku vytv\u00e1\u0159\u00edme stejn\u011b jako v prvn\u00edm p\u0159\u00edkladu, pouze s t\u00edm rozd\u00edlem, \u017ee vytv\u00e1\u0159\u00edme n\u011bkolik sloupc\u016f: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Ur\u010dit\u011b nastav\u00edme filtr, abychom hledali informace pouze podle blade\u016f odpov\u00eddaj\u00edc\u00edch za incidenty IT bezpe\u010dnosti \u2014 product: ( \u201eSmartDefense\u201c NEBO \u201eThreat Emulation\u201c). Obr\u00e1zek je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Podrobn\u011bj\u0161\u00ed nastaven\u00ed, obr\u00e1zek je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Grafy nejpopul\u00e1rn\u011bj\u0161\u00edch nav\u0161t\u011bvovan\u00fdch webov\u00fdch str\u00e1nek<\/h3>\n

      \nK tomu vytvo\u0159\u00edme objekt \u2014 Vertik\u00e1ln\u00ed sloupec<\/b>. Pro metriku tak\u00e9 pou\u017eijeme count (osa Y) a na ose X jako hodnoty pou\u017eijeme n\u00e1zvy nav\u0161t\u00edven\u00fdch web\u016f \u2014 \u201cappi_name\u201d. Je zde mal\u00fd trik, pokud spust\u00edme nastaven\u00ed v aktu\u00e1ln\u00ed variant\u011b, v\u0161echny weby budou na grafu ozna\u010deny jednou barvou, abychom je ud\u011blali r\u016fznobarevn\u00fdmi, pou\u017eijeme dal\u0161\u00ed nastaven\u00ed \u2014 \u201csplit series\u201d, kter\u00e9 umo\u017e\u0148uje rozd\u011blit ji\u017e hotov\u00fd sloupec na dal\u0161\u00ed hodnoty, v z\u00e1vislosti na zvolen\u00e9m poli, samoz\u0159ejm\u011b! Toto rozd\u011blen\u00ed lze bu\u010f pou\u017e\u00edt jako jeden r\u016fznobarevn\u00fd sloupec podle hodnot v re\u017eimu stacked, nebo v norm\u00e1ln\u00edm re\u017eimu pro vytvo\u0159en\u00ed n\u011bkolika sloupc\u016f podle ur\u010dit\u00e9 hodnoty na ose X. V tomto p\u0159\u00edpad\u011b zde pou\u017e\u00edv\u00e1me stejnou hodnotu, jakou m\u00e1me na ose X, co\u017e umo\u017e\u0148uje ud\u011blat v\u0161echny sloupce r\u016fznobarevn\u00e9, zprava naho\u0159e budou vyzna\u010deny barvami. Ve filtru nastavujeme \u2014 product:\u201eURL Filtering\u201c, abychom vid\u011bli informace pouze o nav\u0161t\u011bvovan\u00fdch webech, obr\u00e1zek je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Nastaven\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Graf o pou\u017e\u00edv\u00e1n\u00ed nejnebezpe\u010dn\u011bj\u0161\u00edch aplikac\u00ed<\/h3>\n

      \nK tomu vytvo\u0159\u00edme objekt \u2014 Vertik\u00e1ln\u00ed sloupec. Pro metriku tak\u00e9 pou\u017eijeme count (osa Y) a na ose X jako hodnoty pou\u017eijeme n\u00e1zvy pou\u017e\u00edvan\u00fdch aplikac\u00ed \u2014 \u201cappi_name\u201d. Nejpodstatn\u011bj\u0161\u00ed je zad\u00e1n\u00ed filtru \u2014 product: \u201eApplication Control\u201c AND app_risk: (4 OR 5 OR 3) AND action:\u201eaccept\u201c. Filtrujeme logy podle Blade Application Control, bereme pouze ty weby, kter\u00e9 jsou kategorizov\u00e1ny jako weby s rizikem Critical, High, Medium a pouze v p\u0159\u00edpad\u011b, \u017ee je na tyto weby povolen\u00fd p\u0159\u00edstup. Obr\u00e1zek je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Nastaven\u00ed, klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Dashboard<\/h3>\n

      \nZobrazen\u00ed a vytv\u00e1\u0159en\u00ed dashboard\u016f se nach\u00e1z\u00ed v samostatn\u00e9 polo\u017ece menu \u2014 Dashboard<\/b>. Zde je to jednoduch\u00e9, vytvo\u0159\u00ed se nov\u00fd dashboard, p\u0159id\u00e1 se vizualizace, usad\u00ed se na m\u00edsta a hotovo!<\/p>\n

      Vytvo\u0159\u00edme dashboard, podle kter\u00e9ho bude mo\u017en\u00e9 pochopit z\u00e1kladn\u00ed situaci v oblasti IT bezpe\u010dnosti v organizaci, samoz\u0159ejm\u011b pouze na \u00farovni Check Point, obr\u00e1zek je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Na z\u00e1klad\u011b t\u011bchto graf\u016f m\u016f\u017eeme pochopit, kter\u00e9 kritick\u00e9 signatury nejsou blokov\u00e1ny na firewallu, kam u\u017eivatel\u00e9 chod\u00ed a kter\u00e9 nejnebezpe\u010dn\u011bj\u0161\u00ed aplikace pou\u017e\u00edvaj\u00ed.<\/p>\n

      Z\u00e1v\u011br<\/h3>\n

      \nProzkoumali jsme mo\u017enosti z\u00e1kladn\u00ed vizualizace v Kibana a vytvo\u0159ili dashboard, ale to je pouze mal\u00e1 \u010d\u00e1st. D\u00e1le v kurzu se podrobn\u011bji zam\u011b\u0159\u00edme na nastaven\u00ed map, pr\u00e1ci se syst\u00e9mem Elasticsearch, sezn\u00e1m\u00edme se s API dotazy, automatizac\u00ed a mnoha dal\u0161\u00edmi t\u00e9maty!<\/p>\n

      Tak sledujte aktualizace (Telegram<\/a><\/noindex>, Facebook<\/a><\/noindex>, VK<\/a><\/noindex>, TS Solution Blog<\/a><\/noindex>), Yandex.Zen<\/a><\/noindex>.
      \n
      Zdroj:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54536","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Elastic stack: anal\u00fdza bezpe\u010dnostn\u00edch log\u016f. Dashboardy | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54536","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/54536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=54536"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/54536\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=54536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=54536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=54536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}