{"id":54536,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-elastic-stack-analiz-security-logov-dashbordy"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"3-elastic-stack-analiz-security-logov-dashbordy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","title":{"rendered":"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/703e366b85e1c67018387e2f2a807f1b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVarasemates artiklites tutvusime veidi ELK-stakiga ja Logstashi konfiguratsioonifaili seadistamisega logifailide anal\u00fc\u00fcsiks. K\u00e4esolevas artiklis liikume edasi selle k\u00f5ige olulisema juurde, mida soovite s\u00fcsteemilt n\u00e4ha ja mille nimel k\u00f5ik loodi \u2014 see on graafikud ja tabelid, mis on koondatud <b>juhtpaneelideks<\/b>. T\u00e4na tutvume l\u00e4hemalt visualiseerimiss\u00fcsteemiga <b>Kibana<\/b>, vaatame, kuidas luua graafikuid ja tabeleid ning l\u00f5puks koostame lihtsa juhtpaneeli Check Pointi tulem\u00fc\u00fcri logide p\u00f5hjal.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nKibana kasutamise esimene samm on <b>indeksi mustri<\/b>, mis on loogiliselt \u00f6eldes \u00fchtse indekseerimise aluseks vastavalt teatud p\u00f5him\u00f5ttele. Loomulikult on see h\u00e4\u00e4lestus, et Kibana saaks mugavamalt otsida teavet k\u00f5igis indeksites korraga. See m\u00e4\u00e4ratakse vastavalt stringile, n\u00e4iteks \u201ccheckpoint-*\u201d ja indeksi nimetusele. N\u00e4iteks sobib \u201ccheckpoint-2019.12.05\u201d selle mustriga, kuid lihtsalt \u201ccheckpoint\u201d ei sobi. eraldi tuleb m\u00e4rkida, et otsingus ei ole v\u00f5imalik korraga otsida teavet erinevate indeksimustrite j\u00e4rgi; hiljem artiklites n\u00e4eme, et API-p\u00e4ringud tehakse kas indeksi nime j\u00e4rgi v\u00f5i just \u00fche mustri j\u00e4rgi, pilt on klikkitav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/64\/nm\/tb\/64nmtbsfwl-qfysx5n6km6iwr3m.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/d84ad30d2ee921b7f76a8224cfad5029.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>P\u00e4rast seda kontrollime men\u00fc\u00fcs Discover, et k\u00f5ik logid indekseeritakse ja \u00f5ige parser on seadistatud. Kui leitakse mingeid vastuolusid, n\u00e4iteks andmet\u00fc\u00fcbi muutmine stringilt t\u00e4isarvuks, tuleb Logstashi konfiguratsioonifaili redigeerida, et uued logid salvestataks \u00f5igesti. Et vanad logid enne muutmist saaks vajalikku vormi, aitab ainult reindekseerimisprotsess; hiljem artiklites k\u00e4sitleme seda toimingut l\u00e4hemalt. Veendume, et k\u00f5ik on korras, pilt on klikkitav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/y1\/-h\/jk\/y1-hjkcxrtdpuufzqxqdpqhlvha.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/c704b83f68de588b612a97cb92fa0433.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Logid on kohal, mis t\u00e4hendab, et n\u00fc\u00fcd saab alustada juhtpaneelide loomist. Turvatuote anal\u00fc\u00fcsijuhendite p\u00f5hjal saab aru, kui hea on organisatsiooni teabe turvalisus, visuaalselt on n\u00e4htavad hetked, kus poliitikaga on probleeme, ja hiljem saab leida viise nendest probleemidest \u00fcle saamiseks. Loome v\u00e4ikese juhtpaneeli, kasutades mitmeid visualiseerimisvahendeid. Juhtpaneel koosneb viiest komponendist: <\/p>\n<ol>\n<li>tabel, mis arvutab kokku logide arvu blade'ide j\u00e4rgi<\/li>\n<li>tabel kriitiliste IPS-signatuuride jaoks<\/li>\n<li>ringdiagramm Threat Prevention s\u00fcndmuste kohta<\/li>\n<li>diagram populaarsem k\u00fclastatavatele saitidele<\/li>\n<li>diagram ohtlikumate rakenduste kasutamisest<\/li>\n<\/ol>\n<p>\nVisualiseerimise figuuride loomiseks tuleb minna men\u00fc\u00fcsse <b>Visualize<\/b>, ja valida vajalik figuur, mida soovime joonistada! Liigume samm-sammult edasi.<\/p>\n<h3>Kokku logide arvu loendamise tabel<\/h3>\n<p>\nSelleks valime figuuri <b>Data Table<\/b>, s\u00fcveneme diagrammide loomise t\u00f6\u00f6riista, vasakul on figuuri seaded, paremal see, kuidas see praegustes seadetes v\u00e4lja n\u00e4eb. Esiteks n\u00e4itan, kuidas n\u00e4eb v\u00e4lja valmis tabel, p\u00e4rast seda vaatame seadistusi, pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/h6\/qh\/zs\/h6qhzsfawr4qslqtdfybm3zvzsw.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/cd0d023ad12db5bbfe2dcc51823fb459.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00dcksikasjalikud figuuri seaded, pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/pe\/2j\/d2\/pe2jd28os3xkfs70wi9jl--0kcc.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/4e3ca27ef051e2ab86d5006c83b0ad98.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Vaatame seadistusi.<\/p>\n<p>Esmalt seadistatakse <b>metrika<\/b>, see on v\u00e4\u00e4rtus, mille alusel koondatakse k\u00f5ik v\u00e4ljaanded. Metriigid arvutatakse v\u00e4\u00e4rtuste p\u00f5hjal, mis on mingil viisil dokumentidest v\u00e4lja v\u00f5etud. V\u00e4\u00e4rtused v\u00e4ljastatakse tavaliselt <b>v\u00e4ljadest<\/b> dokumendis, kuid neid v\u00f5ib ka genereerida skriptide abil. Antud juhul paneme <b>Kogumine: Arv<\/b> (logide koguarv).<\/p>\n<p>P\u00e4rast seda jagame tabeli segmentide (v\u00e4ljade) kaupa, mille alusel metrikat arvestatakse. Seda funktsiooni t\u00e4idab Buckets seade, mis koosneb omakorda 2 seadistuse variandist: <\/p>\n<ol>\n<li>jaga ridade kaupa \u2014 veergude lisamine ja seej\u00e4rel tabeli jagamine ridadeks<\/li>\n<li>jaga tabel \u2014 tabelite jagamine teatud v\u00e4lja v\u00e4\u00e4rtuste p\u00f5hjal. <\/li>\n<\/ol>\n<p>\nUues <b>buckets<\/b> saab lisada mitu jagamist, et luua mitu veergu v\u00f5i tabelit, siin on piiranguks pigem loogilised reeglid. Kogumisel saab valida, millise meetodi alusel jagamine toimub: ipv4 vahemik, kuup\u00e4evavahemik, Terms jne. K\u00f5ige huvitavam valik on just <b>Terminid<\/b> ja <b>Olulised terminid<\/b>, jagamine toimub teatud indeksiv\u00e4lja v\u00e4\u00e4rtuste p\u00f5hjal, nende vahel on erinevus tagastatud v\u00e4\u00e4rtuste arvus ja nende kuvamises. Kuna soovime tabelit jagada blaidide nimede j\u00e4rgi, valime v\u00e4lja \u2014 <b>product.keyword<\/b> ja m\u00e4\u00e4rame suuruse 25 tagastatud v\u00e4\u00e4rtuse arvu. <\/p>\n<p>Elasticsearchis kasutatakse ridade asemel 2 t\u00fc\u00fcpi andmeid \u2014 <b>ntext<\/b> ja <b>m\u00e4rks\u00f5na<\/b>. Kui soovite teostada t\u00e4isteksti otsingut, peate kasutama t\u00fc\u00fcpi text, mis on v\u00e4ga mugav oma otsinguteenuse kirjutamisel, n\u00e4iteks otsides mainimist s\u00f5na konkreetses v\u00e4ljande (teksti) t\u00e4henduses. Kui soovite ainult t\u00e4pset vaste, peate kasutama t\u00fc\u00fcpi keyword. Samuti tuleb andmet\u00fc\u00fcpi keyword kasutada v\u00e4ljade puhul, mis n\u00f5uavad sorteerimist v\u00f5i agregaati, see t\u00e4hendab, meie juhul.<\/p>\n<p>Tulemusena loendab Elasticsearch logide arvu teatud aja jooksul, agreggeerides v\u00e4\u00e4rtuse j\u00e4rgi v\u00e4ljandes product. Custom Label'is m\u00e4\u00e4rame veeru nime, mis kuvatakse tabelis, m\u00e4\u00e4rame aja, mille jooksul logisid kogume, k\u00e4ivitame joonistamise \u2014 Kibana saadab p\u00e4ringu elasticsearch'i, ootab vastust ja visualiseerib seej\u00e4rel saadud andmed. Tabel on valmis!<\/p>\n<h3>Ringdiagram s\u00fcndmuste Threat Prevention<\/h3>\n<p>\nTeatud huvi pakub info, kui palju on \u00fcldiselt protsentuaalses suhtes reaktsioone <b>detect<\/b> ja <b>prevent<\/b> kuulub I\u0411 tegevustele kehtivasse turvapoliitikasse. Selleks sobib ringdiagramm h\u00e4sti. Valime Visualize \u2014 <b>Pie chart<\/b>. Samuti m\u00e4\u00e4rame metoodikas logide arvu agregatsiooni. Buckets'is paneme Terms =&gt; action. <\/p>\n<p>Tundub, et k\u00f5ik on \u00f5igesti, kuid tulemuseks kuvatakse v\u00e4\u00e4rtused k\u00f5igi blade'ide kohta, tuleb filtreerida ainult nende blade'ide j\u00e4rgi, mis t\u00f6\u00f6tavad Threat Prevention raames. Seet\u00f5ttu seame kindlasti <b>filtri<\/b> et otsida teavet ainult blade'ide kohta, mis vastutavad I\u0411 juhtumite eest \u2014 product: (\"Anti-Bot\" OR \"New Anti-Virus\" OR \"DDoS Protector\" OR \"SmartDefense\" OR \"Threat Emulation\"). Pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/te\/1p\/wo\/te1pwo7es8c1nnssm5tuhtdfxog.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/8ff2a225089922d8634f5c85ee7fc5fc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Ja veel t\u00e4iendavad seadistused, pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/20\/yf\/xs\/20yfxs1tflzd3ja05bulm9s8pco.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/b747aa69a089862f91bd93c7868bacd3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Tabel IPSi s\u00fcndmuste kohta<\/h3>\n<p>\nEdasi on I\u0411 seisukohalt v\u00e4ga oluline vaatamine ja kontrollimine s\u00fcndmuste kohta blade'i <b>IPS<\/b> ja <b>Ohuhalduse simuleerimine<\/b>, mis <b>ei blokeeru<\/b> kehtiva poliitika j\u00e4rgi, et hiljem kas muuta signatuur prevent'i v\u00f5i kui liiklus on valideeritud \u2014 mitte kontrollida signatuuri. Tabeli loome samamoodi nagu esimeses n\u00e4ites, ainult erinevusega, et loome mitu veergu: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Kindlasti seadistame filtri, et otsida teavet ainult blade'ide kohta, mis vastutavad I\u0411 juhtumite eest \u2014 product: (\"SmartDefense\" OR \"Threat Emulation\"). Pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/gu\/pt\/q_\/guptq_dmmsig3ueo2xoahhgh_ts.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/7f595da7aecf502249e8a804b5768680.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Veel t\u00e4iendavad seadistused, pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/7h\/va\/ma\/7hvamanbqtsl3vvkbk_r_wgpu4e.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/ecce5e34c3deac5089e9ba1471a92411.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Diagrammid k\u00f5ige populaarsemate k\u00fclastatavate veebisaitide kohta<\/h3>\n<p>\nSelleks loome kujundi \u2014 <b>Vertikaalne diagramm<\/b>. Samuti kasutame m\u00f5\u00f5tmena count (Y-telg), ja X-teljel kasutame k\u00fclastatud veebisaitide nimesid \u2014 \u201cappi_name\u201d. Siin on v\u00e4ike nipp, kui seadistustele k\u00e4ivitada praegusel kujul, siis k\u00f5ik veebisaidid kuvatakse diagrammil sama v\u00e4rviga, et need mitmev\u00e4rviliseks muuta, kasutame lisaseadet \u2014 \u201csplit series\u201d, mis v\u00f5imaldab juba valmis kolonni jagada mitmeks v\u00e4\u00e4rtuseks, s\u00f5ltuvalt valitud valdkonnast! Seda jagamist saab kasutada kas \u00fche mitmev\u00e4rvilise kolonnina v\u00e4\u00e4rtuste korral virnastatud re\u017eiimis v\u00f5i tavalises re\u017eiimis, et luua mitu kolonni teatud v\u00e4\u00e4rtuse p\u00f5hjal X-teljel. Antud juhul kasutame sama v\u00e4\u00e4rtust, mis X-teljelt, mis v\u00f5imaldab k\u00f5iki kolonne mitmev\u00e4rviliseks muuta, \u00fcleval paremal need t\u00e4histatakse v\u00e4rvidega. Filtris m\u00e4\u00e4rame \u2014 product:\u00abURL Filtering\u00bb, et n\u00e4ha teavet ainult k\u00fclastatud veebisaitide kohta, pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/mm\/7z\/eu\/mm7zeuhxbi7mycsbe9iwhfvj-pi.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/07bb9944b86da2c3522a09d07f23fecd.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Seaded:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ab\/fq\/s8\/abfqs80dexym6ks4kt_ktyzzzzk.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/02acd7c1d18a1cdea25d5f4ec597001e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Diagramm k\u00f5ige ohtlikumate rakenduste kasutamisest<\/h3>\n<p>\nSelleks loome kujundi \u2014 Vertikaalne tulp. Samuti kasutame m\u00f5\u00f5tmena count (Y-telg), ja X-teljel kasutame kasutatavate rakenduste nimesid \u2014 \u201cappi_name\u201d. K\u00f5ige olulisem on m\u00e4\u00e4rata filter \u2014 product: \u00abApplication Control\u00bb AND app_risk: (4 OR 5 OR 3 ) AND action:\u00abaccept\u00bb. Filtreerime logisid rakenduskontrolli blade'i j\u00e4rgi, v\u00f5tame arvesse ainult neid veebisaite, mis on kategoriseeritud kui kriitilise, k\u00f5rge, keskmise riskiga ja ainult juhul, kui nendele veebisaitidele on juurdep\u00e4\u00e4s lubatud. Pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/2q\/nz\/82\/2qnz82z39bhtf-eohfvqcfqae-0.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/623b5bf3188c2a0b09f89728fad59920.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Seaded, klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/pb\/aj\/6s\/pbaj6sk3l1qbc8cgluy4yiaj1qy.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/63239427de04abde90d28318cab11f3c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Armatuurlaud<\/h3>\n<p>\nArmatuurlaudade vaatamine ja loomine toimub eraldi men\u00fc\u00fcpunktis \u2014 <b>Armatuurlaud<\/b>. Siin on k\u00f5ik lihtne, luuakse uus armatuurlaud, lisatakse visualiseerimine, paigutatakse kohale ja k\u00f5ik!<\/p>\n<p>Loome armatuurlauda, mille abil saab aru saada organisatsiooni k\u00fcberturbe p\u00f5hiseisundist, muidugi ainult Check Pointi tasandil, pilt on klikatav:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ct\/9p\/lv\/ct9plv4cwbpt6ammjhqmn6x76fe.png\"><img decoding=\"async\" alt=\"3. Elastic stack: turvalisuse logide anal\u00fc\u00fcs. Juhtpaneelid\" src=\"\/wp-content\/uploads\/2019\/12\/8d70a875d9a718279189a2839c9182df.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Nende diagrammide p\u00f5hjal saame aru, millised kriitilised allkirjad ei blokeerita tulem\u00fc\u00fcris, kuhu kasutajad liikuvad ja milliseid k\u00f5ige ohtlikumaid rakendusi nad kasutavad.<\/p>\n<h3>Kokkuv\u00f5te<\/h3>\n<p>\nMe oleme tutvunud Kibana p\u00f5hivisualiseerimise v\u00f5imalustega ja loonud armatuurlaua, kuid see on vaid v\u00e4ike osa. Edasi kursusel k\u00e4sitleme kaarti s\u00e4tete seadistamist, t\u00f6\u00f6tamist elasticsearch s\u00fcsteemiga, tutvume API p\u00e4ringutega, automatiseerimisega ja veel paljuga!<\/p>\n<p>Seega j\u00e4lgige uuendusi (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>), <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/482054\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54536","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-27T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:02:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Elastic stack: security logide anal\u00fc\u00fcs. Armatuurlauad | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54536","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=54536"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54536\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=54536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=54536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=54536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}