{"id":92075,"date":"2020-08-22T19:42:03","date_gmt":"2020-08-22T17:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk"},"modified":"2020-08-22T19:42:03","modified_gmt":"2020-08-22T17:42:03","slug":"elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","title":{"rendered":"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V tomto p\u0159\u00edsp\u011bvku bude pops\u00e1na konfigurace vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK<br \/>\n\u010cl\u00e1nek je rozd\u011blen do n\u00e1sleduj\u00edc\u00edch sekc\u00ed:<\/p>\n<p><\/p>\n<p>1- P\u0159ehled ELK SIEM<br \/>\n2- V\u00fdchoz\u00ed panely<br \/>\n3- Vytvo\u0159en\u00ed prvn\u00edch panel\u016f<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Obsah v\u0161ech p\u0159\u00edsp\u011bvk\u016f.<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515576\/\">\u00davod. Nasazen\u00ed infrastruktury a technologi\u00ed pro SOC jako slu\u017ebu (SOCasS)<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515722\/\">ELK stack \u2013 instalace a konfigurace<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515920\/\">Proch\u00e1zka open Distro<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516050\/\">Vizualizace panel\u016f a ELK SIEM<\/a><\/noindex><\/li>\n<li>Integrace s WAZUH<\/li>\n<li>Upozorn\u011bn\u00ed (Alerting)<\/li>\n<li>Reporting<\/li>\n<li>Spr\u00e1va p\u0159\u00edpad\u016f<\/li>\n<\/ul>\n<p><\/p>\n<h3 id=\"1-obzor-elk-siem\">1-P\u0159ehled ELK SIEM<\/h3>\n<p><\/p>\n<p>ELK SIEM byl ned\u00e1vno p\u0159id\u00e1n do stacku elk ve verzi 7.2 z 25. \u010dervna 2019.<\/p>\n<p><\/p>\n<p>Toto SIEM \u0159e\u0161en\u00ed, kter\u00e9 vytvo\u0159il elastic.co, m\u00e1 usnadnit \u017eivot analytik\u016fm bezpe\u010dnosti a u\u010dinit ho m\u00e9n\u011b \u00fanavn\u00fdm.<\/p>\n<p><\/p>\n<p>Ve na\u0161\u00ed verzi pr\u00e1ce jsme se rozhodli vytvo\u0159it vlastn\u00ed SIEM a vybrat si vlastn\u00ed \u0159\u00eddic\u00ed panel.<\/p>\n<p><\/p>\n<p>Ale pova\u017eujeme za d\u016fle\u017eit\u00e9 nejprve prozkoumat ELK SIEM.<\/p>\n<p><\/p>\n<h4 id=\"11--razdel-host-events\">1.1- Sekce ud\u00e1lost\u00ed hostitel\u016f<\/h4>\n<p><\/p>\n<p>Nejprve se pod\u00edv\u00e1me na sekci hostitel\u016f. Sekce hostitele v\u00e1m umo\u017en\u00ed vid\u011bt ud\u00e1losti, kter\u00e9 se generuj\u00ed na samotn\u00e9m koncov\u00e9m bod\u011b.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/54ebe976e6479930ca8d20cfacdc0d8d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/e0862fafaa4ad1ba34714339a33c698f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Po stisknut\u00ed prohl\u00ed\u017ee\u010de hostitel\u016f byste m\u011bli z\u00edskat n\u011bco jako toto. Jak vid\u00edte, k tomuto po\u010d\u00edta\u010di jsou p\u0159ipojeny t\u0159i hostitel\u00e9:<\/p>\n<p><\/p>\n<p>1 Windows 10.<\/p>\n<p><\/p>\n<p>2 Server Ubuntu 18.04.<\/p>\n<p><\/p>\n<p>M\u00e1me n\u011bkolik zobrazen\u00fdch vizualizac\u00ed, z nich\u017e ka\u017ed\u00e1 zobrazuje r\u016fzn\u00e9 typy ud\u00e1lost\u00ed.<\/p>\n<p><\/p>\n<p>Nap\u0159\u00edklad ten, kter\u00fd je uprost\u0159ed, zobrazuje data o p\u0159ihl\u00e1\u0161en\u00ed na v\u0161ech t\u0159ech stroj\u00edch.<\/p>\n<p><\/p>\n<p>Tento objem dat, kter\u00fd zde vid\u00edte, byl shrom\u00e1\u017ed\u011bn b\u011bhem p\u011bti dn\u016f. To vysv\u011btluje velk\u00e9 mno\u017estv\u00ed ne\u00fasp\u011b\u0161n\u00fdch a \u00fasp\u011b\u0161n\u00fdch p\u0159\u00edstup\u016f. Pravd\u011bpodobn\u011b budete m\u00edt men\u0161\u00ed mno\u017estv\u00ed protokol\u016f, tak\u017ee se nebojte.<\/p>\n<p><\/p>\n<h4 id=\"12--razdel-setevyh-sobytiy\">1.2- Sekce s\u00ed\u0165ov\u00fdch ud\u00e1lost\u00ed<\/h4>\n<p><\/p>\n<p>P\u0159ejdeme k sekci s\u00edt\u011b, m\u011bli byste z\u00edskat n\u011bco jako toto. Tato sekce v\u00e1m umo\u017en\u00ed pozorn\u011b sledovat v\u0161e, co se d\u011bje ve va\u0161\u00ed s\u00edti, od HTTP \/ TLS provozu po DNS provoz a extern\u00ed bezpe\u010dnostn\u00ed ud\u00e1losti.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/3ebae3d5e85dd84556eb26901c2fd519.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/344db7fac06acabaa011657debb52993.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h3 id=\"2--dashbordy-po-umolchaniyu\">2- V\u00fdchoz\u00ed panely<\/h3>\n<p><\/p>\n<p>Aby usnadnili \u017eivot u\u017eivatel\u016fm, v\u00fdvoj\u00e1\u0159i elastic.co vytvo\u0159ili v\u00fdchoz\u00ed \u0159\u00eddic\u00ed panel, ofici\u00e1ln\u011b podporovan\u00fd ELK. Na\u0161e bity nebyly v\u00fdjimkou. Zde budu br\u00e1t jako p\u0159\u00edklad v\u00fdchoz\u00ed panel Packetbeat.<\/p>\n<p><\/p>\n<p>Pokud jste spr\u00e1vn\u011b provedli krok druh\u00e9ho \u010dl\u00e1nku. M\u011bli byste m\u00edt nastaven\u00fd panel, kter\u00fd na v\u00e1s \u010dek\u00e1. Tak se do toho pus\u0165me.<\/p>\n<p><\/p>\n<p>Na lev\u00e9 z\u00e1lo\u017ece Kibana vyberte ikonu panela. To je t\u0159et\u00ed, pokud po\u010d\u00edt\u00e1te zhora.<\/p>\n<p><\/p>\n<p>Zadejte n\u00e1zev pod\u00edlu do vyhled\u00e1vac\u00edho pole<\/p>\n<p><\/p>\n<p>Pokud je v bite v\u00edce modul\u016f, bude vytvo\u0159ena \u0159\u00eddic\u00ed panel pro ka\u017ed\u00fd z nich. Ale pouze ten, u n\u011bho\u017e je modul aktivn\u00ed, bude zobrazovat nepr\u00e1zdn\u00e1 data.<\/p>\n<p><\/p>\n<p>Vyberte ten, kter\u00fd m\u00e1 n\u00e1zev va\u0161eho modulu.<\/p>\n<p><\/p>\n<p>Tohle je hlavn\u00ed \u0161ablona <strong>PacketBeat<\/strong>.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/f895c527f746c6df4c7e4e43c4eee802.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Toto je \u0159\u00eddic\u00ed panel s\u00ed\u0165ov\u00fdch tok\u016f. Informuje n\u00e1s o p\u0159\u00edchoz\u00edm a odchoz\u00edm paketu, zdroj\u00edch a c\u00edlov\u00fdch IP adres\u00e1ch a tak\u00e9 poskytne mnoho u\u017eite\u010dn\u00fdch informac\u00ed pro analytika bezpe\u010dnostn\u00edho centra.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/1d319ebf0865ea4ad18c9f1a10d6182d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/fb4f7078d667bc3c402198c2c58c293d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h3 id=\"3---sozdanie-vashih-pervyh-dashbordov\">3 \u2013 Vytv\u00e1\u0159en\u00ed va\u0161ich prvn\u00edch dashboard\u016f<\/h3>\n<p><\/p>\n<h4 id=\"31--osnovnye-ponyatiya\">3\u20131- Z\u00e1kladn\u00ed pojmy<\/h4>\n<p><\/p>\n<p><strong>A- Typy dashboard\u016f:<\/strong><\/p>\n<p><\/p>\n<p>To jsou r\u016fzn\u00e9 typy vizualizac\u00ed, kter\u00e9 m\u016f\u017eete pou\u017e\u00edt k zobrazen\u00ed va\u0161ich dat.<\/p>\n<p><\/p>\n<p>nap\u0159\u00edklad m\u00e1me:<\/p>\n<p><\/p>\n<ul>\n<li>Sloupcov\u00fd graf<\/li>\n<li>Mapa<\/li>\n<li>Markdown widget<\/li>\n<li>Kol\u00e1\u010dov\u00fd graf<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/63a8cbb26fe1caa4c224fffca02a58ad.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>B- KQL (dotazovac\u00ed jazyk Kibana):<\/strong><\/p>\n<p><\/p>\n<p>To je jazyk pou\u017e\u00edvan\u00fd v Kibana pro pohodln\u00e9 hled\u00e1n\u00ed v datech. Umo\u017e\u0148uje v\u00e1m zkontrolovat, zda ur\u010dit\u00e1 data existuj\u00ed, a mnoho dal\u0161\u00edch u\u017eite\u010dn\u00fdch funkc\u00ed. Chcete-li se dozv\u011bd\u011bt v\u00edce, m\u016f\u017eete si prostudovat informace na tomto odkazu<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/kuery-query.html\">https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/kuery-query.html<\/a><\/noindex><\/p>\n<p><\/p>\n<p>Toto je p\u0159\u00edklad dotazu na vyhled\u00e1v\u00e1n\u00ed hostitele s Windows 10 pro.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/2785f9afe1dfe463ad6b56febcfa04b8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>C- Filtry:<\/strong><\/p>\n<p><\/p>\n<p>Tato funkce v\u00e1m umo\u017en\u00ed filtrovat ur\u010dit\u00e9 parametry, nap\u0159\u00edklad n\u00e1zev hostitele, k\u00f3d nebo identifik\u00e1tor ud\u00e1losti atd. Filtry podstatn\u011b zlep\u0161\u00ed f\u00e1zi vy\u0161et\u0159ov\u00e1n\u00ed z hlediska \u010dasu a \u00fasil\u00ed vynalo\u017een\u00e9ho na hled\u00e1n\u00ed d\u016fkaz\u016f.<\/p>\n<p><\/p>\n<p><strong>D- Prvn\u00ed vizualizace:<\/strong><\/p>\n<p><\/p>\n<p>Vytvo\u0159\u00edme vizualizaci pro MITER ATT &amp; CK.<\/p>\n<p><\/p>\n<p>Nejd\u0159\u00edve se mus\u00edme dostat do <strong>Dashboard \u2192 Vytvo\u0159it nov\u00fd dashboard \u2192 vytvo\u0159it nov\u00fd \u2192 Kol\u00e1\u010dov\u00fd dashboard<\/strong><\/p>\n<p><\/p>\n<p>Nastavte typ pro vzor indexu, pot\u00e9 se dotkn\u011bte n\u00e1zvu va\u0161eho bitu.<\/p>\n<p><\/p>\n<p>Stiskn\u011bte Enter. V tuto chv\u00edli byste m\u011bli vid\u011bt zelen\u00fd donut.<\/p>\n<p><\/p>\n<p>Na kart\u011b Buckets naleznete:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/432dd674f142ee33b4e248621638b9e8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p> \u2014 Split slices rozd\u011bl\u00ed donut na r\u016fzn\u00e9 \u010d\u00e1sti podle rozpt\u00fdlen\u00ed dat.<\/p>\n<p><\/p>\n<p> \u2014 Split Chart vytvo\u0159\u00ed dal\u0161\u00ed donut vedle tohoto. <\/p>\n<p><\/p>\n<p>Budeme pou\u017e\u00edvat rozd\u011blen\u00e9 pl\u00e1tky.<\/p>\n<p><\/p>\n<p>Budeme vizualizovat na\u0161e data v z\u00e1vislosti na term\u00ednu, kter\u00fd jsme vybrali. V tomto p\u0159\u00edpad\u011b se term\u00edn vztahuje na MITER ATT &amp; CK.<\/p>\n<p><\/p>\n<p>V Winlogbeat se pole, kter\u00e9 n\u00e1m tyto informace poskytne, naz\u00fdv\u00e1:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">winlog.event_data.RuleName<\/code><\/pre>\n<p><\/p>\n<p><strong>Nastav\u00edme metodu po\u010d\u00edt\u00e1n\u00ed pro uspo\u0159\u00e1d\u00e1n\u00ed ud\u00e1lost\u00ed podle po\u010dtu jejich v\u00fdskyt\u016f.<\/strong><\/p>\n<p><\/p>\n<p>Povolit funkci 'Seskupit ostatn\u00ed hodnoty do samostatn\u00e9ho segmentu'.<\/p>\n<p><\/p>\n<p>Bude to u\u017eite\u010dn\u00e9, pokud vybran\u00e9 term\u00edny maj\u00ed mnoho r\u016fzn\u00fdch v\u00fdznam\u016f vych\u00e1zej\u00edc\u00edch z rytmu. Pom\u00e1h\u00e1 to vizualizovat ostatn\u00ed data jako celek. Poskytne v\u00e1m to p\u0159edstavu o procentu ostatn\u00edch ud\u00e1lost\u00ed.<\/p>\n<p><\/p>\n<p>Nyn\u00ed, kdy\u017e jsme dokon\u010dili nastaven\u00ed tabulky dat, p\u0159ejdeme k z\u00e1lo\u017ece parametr\u016f.<\/p>\n<p><\/p>\n<p>Mus\u00edte ud\u011blat n\u00e1sleduj\u00edc\u00ed:<\/p>\n<p><\/p>\n<p>** Odstra\u0148te donutov\u00fd formul\u00e1\u0159, aby se na vizualizaci objevil cel\u00fd kruh.<\/p>\n<p><\/p>\n<p>** Vyberte si pozici legendy, kter\u00e1 se v\u00e1m l\u00edb\u00ed. V tomto p\u0159\u00edpad\u011b je um\u00edst\u00edme vpravo.<\/p>\n<p><\/p>\n<p>** Nastavte hodnoty zobrazen\u00ed, aby se zobrazovaly vedle jejich fragmentu pro usnadn\u011bn\u00ed \u010dten\u00ed, ostatn\u00ed ponechte jako v\u00fdchoz\u00ed.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/9b2e230247a5277c198f196e96e5f6da.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>O\u0159\u00edznut\u00ed ur\u010duje, kolik chcete zobrazit z n\u00e1zvu ud\u00e1losti.<\/strong><\/p>\n<p><\/p>\n<p>Nastavte \u010das, od kter\u00e9ho by m\u011bla vizualizace za\u010d\u00ednat, a pot\u00e9 klikn\u011bte na modr\u00fd \u010dtverec.<\/p>\n<p><\/p>\n<p>M\u011bli byste dostat n\u011bco jako toto:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/b89f5bf6aee38ff9019540b5f72b6c4c.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>M\u016f\u017eete tak\u00e9 p\u0159idat filtr k va\u0161\u00ed vizualizaci, abyste filtrovali konkr\u00e9tn\u00ed hostitele, kter\u00e9ho chcete zkontrolovat, nebo jak\u00e9koli parametry, kter\u00e9 pova\u017eujete za u\u017eite\u010dn\u00e9 pro v\u00e1\u0161 c\u00edl. Vizualizace bude zobrazovat pouze data odpov\u00eddaj\u00edc\u00ed pravidlu um\u00edst\u011bn\u00e9mu ve filtru. V tomto p\u0159\u00edpad\u011b budeme zobrazovat data MITER ATT &amp; CK, kter\u00e1 poch\u00e1zej\u00ed pouze z hostitele s n\u00e1zvem win10.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/aa6b4716d7e2cd27c9cc6b1a4acb25ae.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h4 id=\"32--sozdanie-vashey-pervoy-informacionnoy-paneli\">3\u20132- Vytvo\u0159en\u00ed va\u0161eho prvn\u00edho informa\u010dn\u00edho panelu:<\/h4>\n<p><\/p>\n<p>Informa\u010dn\u00ed panel je soubor mnoha vizualizac\u00ed. Va\u0161e panely by m\u011bly b\u00fdt jasn\u00e9, srozumiteln\u00e9 a obsahovat u\u017eite\u010dn\u00e9 a determinovan\u00e9 \u00fadaje. Zde je p\u0159\u00edklad panel\u016f, kter\u00e9 jsme vytvo\u0159ili od nuly pro winlogbeat.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK\" src=\"\/wp-content\/uploads\/2020\/08\/d2da07c7fce7a96fa754c709bdedb8a0.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>D\u011bkujeme, \u017ee jste si na\u0161li \u010das. Douf\u00e1me, \u017ee v\u00e1m tento \u010dl\u00e1nek byl u\u017eite\u010dn\u00fd. Pokud chcete z\u00edskat podrobn\u011bj\u0161\u00ed informace k dan\u00e9mu t\u00e9matu, doporu\u010dujeme v\u00e1m nav\u0161t\u00edvit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/tutorial-visualizing.html\">ofici\u00e1ln\u00ed web<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p>Telegram chat k Elasticsearch: <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/elasticsearch_ru\">https:\/\/t.me\/elasticsearch_ru<\/a><\/noindex><\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516050\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445 \u043f\u0435\u0440\u0432\u044b\u0445 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432 \u041e\u0433\u043b\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u0441\u0442\u043e\u0432. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435. \u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 \u0434\u043b\u044f SOC \u043a\u0430\u043a Service (SOCasS) ELK stack \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u041f\u0440\u043e\u0433\u0443\u043b\u043a\u0430 \u043f\u043e open Distro [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92076,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92075","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47ELK SIEM Open Distro: \u0412\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-22T17:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-22T17:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47ELK SIEM Open Distro: Vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK | ProHoster","description":"V tomto p\u0159\u00edsp\u011bvku bude pops\u00e1na konfigurace vizualizace informa\u010dn\u00edch panel\u016f ELK a SIEM v ELK. \u010cl\u00e1nek je rozd\u011blen na n\u00e1sleduj\u00edc\u00ed \u010d\u00e1sti: 1- P\u0159ehled ELK SIEM 2- V\u00fdchoz\u00ed panely 3- Vytvo\u0159en\u00ed va\u0161ich.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ELK SIEM Open Distro: \u0412\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK | ProHoster","og:description":"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-22T17:42:03+00:00","article:modified_time":"2020-08-22T17:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92075","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:15:36","updated":"2022-09-27 16:41:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=92075"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92075\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/92076"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=92075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=92075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=92075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}