{"id":54536,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-elastic-stack-analiz-security-logov-dashbordy"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"3-elastic-stack-analiz-security-logov-dashbordy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","title":{"rendered":"3. Elastic stack: security logide anal\u00fc\u00fcs. Armatuurlaud","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"3.
\n
\nEelnevates artiklites tutvusime veidi ELK-riistakiga ja Logstashi konfiguratsioonifaili seadistamisega logide anal\u00fc\u00fcsiks. K\u00e4esolevas artiklis liikume edasi k\u00f5ige olulisema poole, mida anal\u00fc\u00fctika seisukohalt soovite s\u00fcsteemist n\u00e4ha ja mille jaoks k\u00f5ike loodi \u2014 graafikud ja tabelid, mis on \u00fchendatud dashboordides<\/b>. T\u00e4na vaatame l\u00e4hemalt visualiseerimiss\u00fcsteemi Kibana<\/b>, uurime, kuidas luua graafikuid ja tabeleid ning l\u00f5puks koostame lihtsa dashboordi Check Pointi tulem\u00fc\u00fcriga seotud logide p\u00f5hjal.
\n<\/a><\/noindex>
\nKibana-ga t\u00f6\u00f6tamise esimene samm on indeksimuster<\/b>, \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438, \u044d\u0442\u043e \u0431\u0430\u0437\u0430 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u0435\u0434\u0438\u043d\u044b\u0445 \u043f\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443. \u0420\u0430\u0437\u0443\u043c\u0435\u0435\u0442\u0441\u044f, \u044d\u0442\u043e \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b Kibana \u0431\u043e\u043b\u0435\u0435 \u0443\u0434\u043e\u0431\u043d\u043e \u0438\u0441\u043a\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e \u0432\u0441\u0435\u043c \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u043c \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e. \u0417\u0430\u0434\u0430\u0435\u0442\u0441\u044f \u043e\u043d\u0430 \u043f\u043e \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0441\u0442\u0440\u043e\u043a\u0438, \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c \u201ccheckpoint-*\u201d \u0438 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0434\u0435\u043a\u0441\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u00abcheckpoint-2019.12.05 \u00bb \u043f\u043e\u0434\u043e\u0439\u0434\u0435\u0442 \u043f\u043e\u0434 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0430 \u043f\u0440\u043e\u0441\u0442\u043e \u00abcheckpoint\u00bb \u0443\u0436\u0435 \u043d\u0435\u0442. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f, \u0447\u0442\u043e \u0432 \u043f\u043e\u0438\u0441\u043a\u0435 \u0438\u0441\u043a\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e \u0440\u0430\u0437\u043d\u044b\u043c \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u0430\u043c \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0435\u043b\u044c\u0437\u044f, \u0447\u0443\u0442\u044c \u043f\u043e\u0437\u0436\u0435 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u0443\u0432\u0438\u0434\u0438\u043c \u0447\u0442\u043e API \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u043b\u0438\u0431\u043e \u043f\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u0438\u043d\u0434\u0435\u043a\u0441\u0430, \u043b\u0438\u0431\u043e \u043a\u0430\u043a \u0440\u0430\u0437 \u043f\u043e \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u0447\u043a\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u0443, \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0430 \u043a\u043b\u0438\u043a\u0430\u0431\u0435\u043b\u044c\u043d\u0430:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

P\u00e4rast seda kontrollime men\u00fc\u00fcs Discover, et k\u00f5ik logid indekseeritakse ja \u00f5ige parser on seadistatud. Kui ilmnevad mingid lahknevused, n\u00e4iteks andmet\u00fc\u00fcbi muutmine stringilt t\u00e4isarvuks, tuleb redigeerida Logstashi konfiguratsioonifaili, et uued logid salvestataks \u00f5igesti. Et vanad logid muudatuse eest sobivasse vormingusse viia, aitab ainult reindekseerimise protsess, mida k\u00e4sitletakse tulevastes artiklites \u00fcksikasjalikumalt. Veendume, et k\u00f5ik on korras, pilt on klikitav:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

Logid on kohal, seega saame alustada juhtpaneelide koostamist. Anal\u00fc\u00fctika p\u00f5hjal, mis on saadud turvatooteid k\u00e4sitlevatelt juhtpaneelidelt, on v\u00f5imalik aru saada organisatsiooni Infotehnoloogia seisundist, visuaalselt n\u00e4ha hetkelisi n\u00f5rkusi poliitikas ja tulevikus v\u00e4lja t\u00f6\u00f6tada viise nende k\u00f5rvaldamiseks. Loome v\u00e4ikese juhtpaneeli, kasutades mitmeid visualiseerimisvahendeid. Juhtpaneel koosneb viiest komponendist: <\/p>\n

    \n
  1. tabel logide koguarvu loendamiseks blade'ide kaupa<\/li>\n
  2. tabel kriitiliste IPS signatuuride jaoks<\/li>\n
  3. ringdiagramm Threat Preventioni s\u00fcndmustest<\/li>\n
  4. diagram populaarseimate k\u00fclastatud veebisaitide kohta<\/li>\n
  5. diagram ohtlike rakenduste kasutamise kohta<\/li>\n<\/ol>\n

    \nVisuaalide kujundamiseks tuleb minna men\u00fc\u00fcsse Visualiseerida<\/b>, ja valida soovitud kujund, mida soovime luua! Alustame j\u00e4rjestikku.<\/p>\n

    Tabel logide koguarvu arvestamiseks bleepide p\u00f5hjal<\/h3>\n

    \nSelleks valime kujundi Andmete tabel<\/b>, sukeldume graafikute loomise t\u00f6\u00f6riista, vasakul on kujundi seaded, paremal see, kuidas see praegustes seadetes v\u00e4lja n\u00e4eb. K\u00f5igepealt n\u00e4itan, kuidas valminud tabel v\u00e4lja n\u00e4eb, seej\u00e4rel l\u00e4heme seadete juurde, pilt on klikatav:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Kuna tahame muuta kujundi seadeid, on pilt klikatav:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Vaatame seadmeid.<\/p>\n

    Esmalt seadistatakse metrika<\/b>, see on v\u00e4\u00e4rtus, mille alusel k\u00f5iki valasid kokku kogutakse. N\u00e4idud arvutatakse dokumentidest mingil viisil v\u00e4lja toodud v\u00e4\u00e4rtuste p\u00f5hjal. V\u00e4\u00e4rtused eraldatakse tavaliselt v\u00e4ljadest<\/b> dokument, kuid need v\u00f5idakse ka skriptide abil genereerida. Antud juhul seab Kogumine: Arv<\/b> (logide koguarvu).<\/p>\n

    Seej\u00e4rel jagame tabeli segmentideks (v\u00e4ljadeks), mille alusel m\u00f5\u00f5dikut arvutatakse. Seda funktsiooni t\u00e4idab seadistus Buckets, mis omakorda koosneb kahest seadistuse variandist: <\/p>\n

      \n
    1. split rows \u2014 veergude lisamine ja hilisem tabeli jagamine ridadeks<\/li>\n
    2. split table \u2014 jagamine mitmeks tabeliks teatud v\u00e4lja v\u00e4\u00e4rtuste alusel. <\/li>\n<\/ol>\n

      \nV buckets<\/b> Saame lisada mitu jagamist, et luua mitmeid veerge v\u00f5i tabeleid, piire on pigem loogilised. Aggregeerimise korral saab valida, millise meetodi alusel jagamine toimub: ipv4 vahemik, kuup\u00e4eva vahemik, Terms jne. Huvi pakkuv valik on just Terms<\/b> ja Significant Terms<\/b>, jagamine toimub teatud indeksiv\u00e4lja v\u00e4\u00e4rtuste alusel, nende vahel on erinevus tagastatavate v\u00e4\u00e4rtuste arvus ja nende kuvamises. Kuna soovime jagada tabelit bleytide nimede alusel, valime v\u00e4lja \u2014 product.keyword<\/b> ja m\u00e4\u00e4rame suuruse 25 tagastatava v\u00e4\u00e4rtuse arvu kaupa. <\/p>\n

      Elasticsearchis kasutatakse ridade asemel 2 andmet\u00fc\u00fcpi \u2014 text<\/b> ja keyword<\/b>. Kui soovite teha t\u00e4isteksti otsingut, peate kasutama t\u00fc\u00fcpi text, mis on v\u00e4ga mugav oma otsinguteenuse kirjutamisel, n\u00e4iteks otsides s\u00f5na mainimist konkreetse v\u00e4lja (teksti) t\u00e4henduses. Kui soovite ainult t\u00e4pset vastet, peate kasutama t\u00fc\u00fcpi keyword. Samuti tuleb andmet\u00fc\u00fcpi keyword kasutada v\u00e4ljadele, mis vajavad sorteerimist v\u00f5i agregatsiooni, st meie puhul.<\/p>\n

      Tulemuseks on, et Elasticsearch loendab logisid teatud aja jooksul, gruppeerides neid v\u00e4ljav\u00e4\u00e4rtuse j\u00e4rgi. Custom Label'is m\u00e4\u00e4rame veeru nime, mis kuvatakse tabelis, m\u00e4\u00e4rame aja, mille jooksul kogume logisid, k\u00e4ivitame visualiseerimise \u2014 Kibana saadab p\u00e4ringu Elasticsearchile, ootab vastust ja visualizeerib saadud andmed. Tabel on valmis!<\/p>\n

      Sisekaitse s\u00fcndmuste ringdiagramm<\/h3>\n

      \nTeave selle kohta, kui palju on reaktsioonide protsentuaalne suhe, on kindlasti huvitav. detect<\/b> ja prevent<\/b> turbeintsidentide suhtes praeguses turvapoliitikas. Selliste juhtumite jaoks sobib h\u00e4sti ringdiagramm. Valime Visualize \u2014 Ringdiagramm<\/b>. Samuti m\u00e4\u00e4rame m\u00f5\u00f5dikus logide arvu p\u00f5hjal agregatsiooni. Buckets'is seadistame Terms => action. <\/p>\n

      Tundub, et k\u00f5ik on \u00f5igesti, kuid tulemuseks on v\u00e4\u00e4rtused k\u00f5igi blade'ide kohta, tuleb filtreerida ainult neid blade'e, mis t\u00f6\u00f6tavad Threat Prevention raames. Seega seame kindlasti filtri<\/b> et otsida teavet ainult nende blade'ide kohta, mis vastutavad IT intsidentide eest \u2014 product: (\"Anti-Bot\" OR \"New Anti-Virus\" OR \"DDoS Protector\" OR \"SmartDefense\" OR \"Threat Emulation\"). Pilt on klikatav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Ja t\u00e4iendavad seaded, pilt on klikatav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      IPS s\u00fcndmuste tabel<\/h3>\n

      \nEdasi on v\u00e4ga oluline vaadata ja kontrollida s\u00fcndmusi blade'i j\u00e4rgi IPS<\/b> ja Ohuteemaline emulatsioon<\/b>, kes ei blokeerita<\/b> praeguse poliitikaga, et hiljem kas muuta signatuur prevent-ks v\u00f5i kui liiklus on valideeritud \u2014 mitte kontrollida signatuuri. Tabeli loome sama moodi nagu esimeses n\u00e4ites, ainult erinevusega, et loome mitu veergu: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Kindlasti seadistame filtri, et otsida teavet ainult nende blade'ide kohta, mis vastutavad IT intsidentide eest \u2014 product: (\"SmartDefense\" OR \"Threat Emulation\"). Pilt on klikatav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      \u00dcksikasjalikud seadistused, pilt on klikkitav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Diagrammid k\u00f5ige populaarsemate k\u00fclastatavate saadete jaoks<\/h3>\n

      \nSelleks loome kujundi \u2014 Vertikaalne baar<\/b>. Me kasutame ka m\u00f5\u00f5dikut count (Y-telg) ja X-teljel v\u00e4\u00e4rtustena k\u00fclastatud saitide nimesid \u2014 \u201cappi_name\u201d. Siin on v\u00e4ike nipp: kui k\u00e4ivitada seadistused praeguses variandis, siis kuvatakse k\u00f5ik saidid graafikul \u00fche v\u00e4rviga. Selleks, et need oleksid mitmev\u00e4rvilised, kasutame t\u00e4iendavat seadistust \u2014 \u201csplit series\u201d, mis v\u00f5imaldab jagada juba olemasolevat veergu veel mitmeks v\u00e4\u00e4rtuseks, s\u00f5ltuvalt valitud valdkonnast! Selle jagamist saab kasutada kas \u00fche mitmev\u00e4rvilise veeru loomiseks v\u00e4\u00e4rtuste j\u00e4rgi kokkusurutud re\u017eiimis (stacked) v\u00f5i normaalses re\u017eiimis, et luua mitu veergu vastavalt X-telje teatud v\u00e4\u00e4rtusele. Antud juhul kasutame sama v\u00e4\u00e4rtust, mis on X-teljel, see v\u00f5imaldab k\u00f5ik veerud muuta mitmev\u00e4rviliseks, paremal \u00fclal nendega t\u00e4histatakse v\u00e4rvidega. Filtris m\u00e4\u00e4rame \u2014 product: \u00abURL Filtering\u00bb, et n\u00e4ha teavet ainult k\u00fclastatud saitide kohta, pilt on klikkitav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Seadistused:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Diagram o k\u00f5ige ohtlikumate rakenduste kasutamisest<\/h3>\n

      \nSelle jaoks loome kuju \u2014 Vertikaalne tulp. Kasutame m\u00f5\u00f5tikut count (Y-teljel) ning X-telje v\u00e4\u00e4rtustena rakenduste nimetust \u2014 \"appi_name\". K\u00f5ige olulisem on filter m\u00e4\u00e4rata \u2014 product: \"Application Control\" AND app_risk: (4 OR 5 OR 3) AND action: \"accept\". Filtreerime logid Application Control'i bladi j\u00e4rgi, valime ainult need saidid, mis on kategoriseeritud kui kriitilise, k\u00f5rge v\u00f5i keskmise riskiga saidid ning ainult juhul, kui juurdep\u00e4\u00e4s nendele saitidele on lubatud. Pilt on klikatav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Seaded, klikatav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Armatuurlaud<\/h3>\n

      \nArmatuurlaudade vaatamine ja loomine toimub eraldi men\u00fc\u00fcs \u2014 Armatuurlauale<\/b>. Siin on k\u00f5ik lihtne, luuakse uus armatuurlaud, lisatakse visualiseerimine, paigutatakse kohale ja k\u00f5ik!<\/p>\n

      Loome armatuurlauda, mille kaudu saab m\u00f5ista, mis on organisatsiooni IS olukord, selgelt, ainult Check Pointi tasemel, pilt on klikatav:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Toetudes nendele graafikutele, saame m\u00f5ista, millised kriitilised allkirjad ei blokeeru tulem\u00fc\u00fcris, kuhu kasutajad v\u00e4lja p\u00e4\u00e4sevad, milliseid k\u00f5ige ohtlikumaid rakendusi nad kasutavad.<\/p>\n

      Kokkuv\u00f5te<\/h3>\n

      \nOleme uurinud Kibana p\u00f5hivisualiseerimise v\u00f5imalusi ning loonud armatuurlaua, kuid see on vaid v\u00e4ike osa. Edasi kursusel vaatame eraldi kaardiseadet, t\u00f6\u00f6tamist Elasticsearchi s\u00fcsteemiga, tutvume API p\u00e4ringutega, automatiseerimisega ja paljuga muuga!<\/p>\n

      Nii et j\u00e4lgige uuendusi (Telegram<\/a><\/noindex>, Facebook<\/a><\/noindex>, VK<\/a><\/noindex>, TS Solution Blog<\/a><\/noindex>), Yandex.Dzen<\/a><\/noindex>.
      \n
      Allikas:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54536","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Elastic stack: turvalogide anal\u00fc\u00fcs. Armatuurlauad | ProHoster","description":"Eelmistes artiklites tutvusime veidi elk virna ja Logstashi konfiguratsioonifaili seadistamisega logide anal\u00fc\u00fcsiks, k\u00e4esolevas artiklis liigume edasi k\u00f5ige olulisema juurde anal\u00fc\u00fcsi seisukohalt \u2013 see, mida soovite s\u00fcsteemist n\u00e4ha ja mille nimel k\u00f5ik loodi \u2013 need on graafikud ja tabelid, mis on \u00fchendatud armatuurlauaks. T\u00e4na tutvume l\u00e4hemalt visuaaliseerimiss\u00fcsteemiga.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54536","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=54536"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54536\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=54536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=54536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=54536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}