{"id":92075,"date":"2020-08-22T19:42:03","date_gmt":"2020-08-22T17:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk"},"modified":"2020-08-22T19:42:03","modified_gmt":"2020-08-22T17:42:03","slug":"elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","title":{"rendered":"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Selles postituses kirjeldatakse ELK ja SIEM infopaneelide visualiseerimise seadistamist ELK-is<br \/>\nArtikkel on jagatud j\u00e4rgmistesse jaotistesse:<\/p>\n<p><\/p>\n<p>1- ELK SIEM \u00fclevaade<br \/>\n2- Vaikimisi armatuurlaud<br \/>\n3- Teie esimeste armatuurlaudade loomine<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Kogu postituste sisukord.<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515576\/\">Sissejuhatus. SOC-as-a-Service (SOCasS) infrastruktuuri ja tehnoloogiate rakendamine<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515722\/\">ELK stack \u2014 installimine ja seadistamine<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515920\/\">Open Distro \u00fclevaade<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516050\/\">Armatuurlaudade ja ELK SIEM-i visualiseerimine<\/a><\/noindex><\/li>\n<li>Integreerimine WAZUH-iga<\/li>\n<li>H\u00e4ired (Alerting)<\/li>\n<li>Aruandlus<\/li>\n<li>Juhtumihaldus<\/li>\n<\/ul>\n<p><\/p>\n<h3 id=\"1-obzor-elk-siem\">1- ELK SIEM \u00fclevaade<\/h3>\n<p><\/p>\n<p>ELK SIEM lisati hiljuti ELK stacki versioonis 7.2, 25. juunil 2019.<\/p>\n<p><\/p>\n<p>See on SIEM lahendus, mille on loonud elastic.co, et muuta turbeanal\u00fc\u00fctiku elu palju lihtsamaks ja v\u00e4hem v\u00e4sitavaks.<\/p>\n<p><\/p>\n<p>Meie t\u00f6\u00f6versioonis otsustasime luua oma SIEM-i ja valida oma juhtpaneeli.<\/p>\n<p><\/p>\n<p>Kuid me peame oluliseks alustada ELK SIEM-i uurimist.<\/p>\n<p><\/p>\n<h4 id=\"11--razdel-host-events\">1.1- Host'i s\u00fcndmuste jaotis<\/h4>\n<p><\/p>\n<p>Esialgu vaatame l\u00e4bi hosti jaotise. Host'i jaotis v\u00f5imaldab teil n\u00e4ha s\u00fcndmusi, mis genereeritakse k\u00f5ige l\u00f5pp-punktis.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/54ebe976e6479930ca8d20cfacdc0d8d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/e0862fafaa4ad1ba34714339a33c698f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>P\u00e4rast hostide vaatamisele kl\u00f5psamist peaksite saama midagi sellist. Nagu n\u00e4ete, on sellele arvutile \u00fchendatud kolm hosti:<\/p>\n<p><\/p>\n<p>1 Windows 10.<\/p>\n<p><\/p>\n<p>2 Ubuntu 18.04 Server.<\/p>\n<p><\/p>\n<p>Meil on mitu erinevat visuaali, millest iga\u00fcks kuvab erinevaid s\u00fcndmuste t\u00fc\u00fcpe.<\/p>\n<p><\/p>\n<p>N\u00e4iteks see, mis on keskel, n\u00e4itab sisselogimise andmeid k\u00f5ikidel kolmel masinal.<\/p>\n<p><\/p>\n<p>See andmemaht, mida te siin n\u00e4ete, on kogutud viie p\u00e4eva jooksul. See selgitab suurt arvu eba\u00f5nnestunud ja edukaid sisselogimisi. Teie puhul on t\u00f5en\u00e4oliselt v\u00e4he logisid, seega \u00e4rge muretsege.<\/p>\n<p><\/p>\n<h4 id=\"12--razdel-setevyh-sobytiy\">1.2 - V\u00f5rgus\u00fcndmuste jaotis.<\/h4>\n<p><\/p>\n<p>Liikudes v\u00f5rgujaotisse, peaksite saama midagi sellist. See jaotis v\u00f5imaldab teil hoolikalt j\u00e4lgida k\u00f5ike, mis teie v\u00f5rgus toimub, alates HTTP\/TLS liiklusest kuni DNS liikluse ja v\u00e4liste s\u00fcndmuste hoiatusteni.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/3ebae3d5e85dd84556eb26901c2fd519.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/344db7fac06acabaa011657debb52993.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h3 id=\"2--dashbordy-po-umolchaniyu\">2- Vaikimisi armatuurlaud<\/h3>\n<p><\/p>\n<p>Kasutajate elu lihtsustamiseks on elastic.co arendajad loonud vaikimisi juhtpaneeli, mida toetab ametlikult ELK. Meie bitid ei olnud selle reegli erandiks. Siin kasutan n\u00e4itena vaikimisi Packetbeat juhtpaneeli.<\/p>\n<p><\/p>\n<p>Kui olete \u00f5igesti teinud artikli teise sammu. Teie jaoks peaks olema seadistatud juhtpaneel, mis ootab teid. Alustame!<\/p>\n<p><\/p>\n<p>Vasakul Kibana vahekaart valige armatuurlaua s\u00fcmbol. See on kolmas, arvates \u00fclevalt.<\/p>\n<p><\/p>\n<p>Sisestage aktsia nimi otsingu vahekaardile.<\/p>\n<p><\/p>\n<p>Kui bitis on mitu moodulit. Iga\u00fche jaoks luuakse juhtpaneel. Kuid ainult see, kellel on moodul aktiivne, n\u00e4itab mitte-t\u00fchje andmeid.<\/p>\n<p><\/p>\n<p>Valige see, millel on teie mooduli nimi.<\/p>\n<p><\/p>\n<p>See on p\u00f5hitemplaat. <strong>PacketBeat<\/strong>.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/f895c527f746c6df4c7e4e43c4eee802.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>See on v\u00f5rguliikluse juhtpaneel. See annab meile teavet sissetulevate ja v\u00e4ljaminevate pakettide, IP-aadresside allikate ja sihtkohtade kohta ning pakub palju kasulikku teavet turvakeskuse anal\u00fc\u00fctikule.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/1d319ebf0865ea4ad18c9f1a10d6182d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/fb4f7078d667bc3c402198c2c58c293d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h3 id=\"3---sozdanie-vashih-pervyh-dashbordov\">3 \u2014 Teie esimeste armatuurlaudade loomine.<\/h3>\n<p><\/p>\n<h4 id=\"31--osnovnye-ponyatiya\">3\u20131- P\u00f5hit\u00f5ed.<\/h4>\n<p><\/p>\n<p><strong>A- Armatuurlaudade t\u00fc\u00fcbid:<\/strong><\/p>\n<p><\/p>\n<p>Need on erinevad visualiseerimise t\u00fc\u00fcbid, mida saate oma andmete visualiseerimiseks kasutada.<\/p>\n<p><\/p>\n<p>n\u00e4iteks meil on:<\/p>\n<p><\/p>\n<ul>\n<li>Histogramm<\/li>\n<li>Kaart<\/li>\n<li>Markdowni vidin<\/li>\n<li>Ringdiagramm<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/63a8cbb26fe1caa4c224fffca02a58ad.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>B- KQL (Kibana p\u00e4ringukeel):<\/strong><\/p>\n<p><\/p>\n<p>See on keele, mida kasutatakse Kibanas andmete mugavaks otsimiseks. See v\u00f5imaldab teil kontrollida, kas teatud andmed eksisteerivad, ja paljusid muid kasulikke funktsioone. Lisateabe saamiseks v\u00f5ite uurida teavet sellel lingil.<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/kuery-query.html\">https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/kuery-query.html<\/a><\/noindex><\/p>\n<p><\/p>\n<p>See on n\u00e4ide hosti otsingu p\u00e4ringust Windows 10 pro s\u00fcsteemiga.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/2785f9afe1dfe463ad6b56febcfa04b8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>C- Filtrid:<\/strong><\/p>\n<p><\/p>\n<p>See funktsioon v\u00f5imaldab teil filtreerida teatud parameetreid, n\u00e4iteks hostinime, koodi v\u00f5i s\u00fcndmuse identifikaatorit jne. Filtrid parandavad oluliselt uurimisfaasi, v\u00e4hendades ajakulutusi ja pingutusi t\u00f5endite leidmiseks.<\/p>\n<p><\/p>\n<p><strong>D- Esimene visualiseerimine:<\/strong><\/p>\n<p><\/p>\n<p>Loome visualiseerimise MITRE ATT &amp; CK jaoks.<\/p>\n<p><\/p>\n<p>Esmalt peame minema <strong>Armatuurlaud \u2192 Loo uus armatuurlaud \u2192 loo uus \u2192 Pirnikujuline armatuurlaud<\/strong><\/p>\n<p><\/p>\n<p>Seadke t\u00fc\u00fcp indeksi mustrile, seej\u00e4rel puudutage oma bit'i nime.<\/p>\n<p><\/p>\n<p>Vajutage Enter. Selleks ajaks peaksite n\u00e4gema rohelist dona.<\/p>\n<p><\/p>\n<p>Vasakul vahekaardil Buckets leiate:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/432dd674f142ee33b4e248621638b9e8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p> \u2014 Split slices jagab dona erinevateks osadeks vastavalt andmete hajutusele.<\/p>\n<p><\/p>\n<p> \u2014 Split Chart loob selle k\u00f5rval veel \u00fche dona. <\/p>\n<p><\/p>\n<p>Kasutame jagatud viilude varianti.<\/p>\n<p><\/p>\n<p>Visualiseerime oma andmed vastavalt meie valitud terminile. Sel juhul viitab termin MITRE ATT &amp; CK-le.<\/p>\n<p><\/p>\n<p>Winlogbeat'is on v\u00e4li, mis annab meile selle teabe, nimeks:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">winlog.event_data.RuleName<\/code><\/pre>\n<p><\/p>\n<p><strong>Seame m\u00f5\u00f5diku loendamise, et j\u00e4rjestada s\u00fcndmusi vastavalt nende esinemiste arvule.<\/strong><\/p>\n<p><\/p>\n<p>L\u00fclitage sisse funktsioon \u201eGrupiteised teised v\u00e4\u00e4rtused eraldi segmenti\u201d.<\/p>\n<p><\/p>\n<p>See on mugav, kui teie valitud terminitel on palju erinevaid t\u00e4hendusi, mis tulenevad r\u00fctmist. See aitab visualiseerida \u00fclej\u00e4\u00e4nud andmed kui tervikut. See annab teile \u00fclevaate \u00fclej\u00e4\u00e4nud s\u00fcndmuste protsendist.<\/p>\n<p><\/p>\n<p>N\u00fc\u00fcd, kui oleme andmevahekaartide seadistamise l\u00f5petanud, liigume parameetrite vahekaardile.<\/p>\n<p><\/p>\n<p>Te peate tegema j\u00e4rgmised toimingud:<\/p>\n<p><\/p>\n<p>** Eemaldage ringikujuline kuju, et visualiseerimisel ilmuks t\u00e4isring.<\/p>\n<p><\/p>\n<p>** Valige, milline legendi asukoht teile meeldib. Antud juhul kuvame need paremal.<\/p>\n<p><\/p>\n<p>** M\u00e4\u00e4rake kuvamisv\u00e4\u00e4rtused, et need kuvataks koos nende fragmentidega lugemise h\u00f5lbustamiseks, \u00fclej\u00e4\u00e4nud j\u00e4tke vaikev\u00e4\u00e4rtustele.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/9b2e230247a5277c198f196e96e5f6da.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>L\u00f5ikamine m\u00e4\u00e4rab, kui palju soovite s\u00fcndmuse nimest kuvada.<\/strong><\/p>\n<p><\/p>\n<p>M\u00e4\u00e4rake aeg, millest visualiseerimine peaks algama, ja seej\u00e4rel klikake sinisele ruudule.<\/p>\n<p><\/p>\n<p>Te peaksite saama midagi sellist:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/b89f5bf6aee38ff9019540b5f72b6c4c.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Saate oma visualiseerimisele filtreid lisada, et filtreerida v\u00e4lja kindlat hosti, mida soovite kontrollida, v\u00f5i mingeid parameetreid, mis teie eesm\u00e4rgi jaoks kasulikud on. Visualiseerimine kuvab ainult andmeid, mis vastavad filtrisse seadistatud reeglile. Sellisel juhul kuvame andmeid, mis on saadud MITER ATT &amp; CK hostilt nimega win10.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/aa6b4716d7e2cd27c9cc6b1a4acb25ae.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h4 id=\"32--sozdanie-vashey-pervoy-informacionnoy-paneli\">3\u20132- Teie esimese armatuurlaua loomine:<\/h4>\n<p><\/p>\n<p>Armatuurlaua koostisosad koosnevad paljusid visualiseerimistest. Teie armatuurlaud peab olema selge, arusaadav ning sisaldama kasulikke ja kindlaid andmeid. Siin on n\u00e4ide armatuurlautadest, mille l\u00f5ime alates nullist winlogbeat jaoks.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: ELK ja SIEM-i visualiseerimine ELK-is\" src=\"\/wp-content\/uploads\/2020\/08\/d2da07c7fce7a96fa754c709bdedb8a0.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Ait\u00e4h teie aja eest. Loodan, et see artikkel oli teile kasulik. Kui soovite teema kohta rohkem teavet, soovitame teil k\u00fclastada <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/tutorial-visualizing.html\">ametlik veebisait<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p>Elasticsearchi Telegrami vestlust: <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/elasticsearch_ru\">https:\/\/t.me\/elasticsearch_ru<\/a><\/noindex><\/p>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516050\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445 \u043f\u0435\u0440\u0432\u044b\u0445 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432 \u041e\u0433\u043b\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u0441\u0442\u043e\u0432. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435. \u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 \u0434\u043b\u044f SOC \u043a\u0430\u043a Service (SOCasS) ELK stack \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u041f\u0440\u043e\u0433\u0443\u043b\u043a\u0430 \u043f\u043e open Distro [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92076,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92075","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445 \u043f\u0435\u0440\u0432\u044b\u0445 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432 \u041e\u0433\u043b\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u0441\u0442\u043e\u0432. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435. \u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 \u0434\u043b\u044f SOC \u043a\u0430\u043a Service (SOCasS) ELK stack \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u041f\u0440\u043e\u0433\u0443\u043b\u043a\u0430 \u043f\u043e open Distro\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47ELK SIEM Open Distro: \u0412\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445 \u043f\u0435\u0440\u0432\u044b\u0445 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432 \u041e\u0433\u043b\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u0441\u0442\u043e\u0432. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435. \u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 \u0434\u043b\u044f SOC \u043a\u0430\u043a Service (SOCasS) ELK stack \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u041f\u0440\u043e\u0433\u0443\u043b\u043a\u0430 \u043f\u043e open Distro\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-22T17:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-22T17:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47ELK SIEM Open Distro: ELK ja SIEM visuaalsete armatuurlaudade seadistamine ELK | ProHoster","description":"Selles postituses k\u00e4sitletakse ELK ja SIEM visuaalsete armatuurlaudade seadistamist ELK. Artikkel on jagatud j\u00e4rgmistesse osadesse: 1- ELK SIEM \u00fclevaade 2- Vaikes\u00e4tete armatuurlaud 3- Teie esimeste armatuurlaudade loomine. K\u00f5igi postituste sisukord. Sissejuhatus. SOC kui teenuse infrastruktuuri ja tehnoloogiate juurutamine (SOCasS) ELK t\u00f6\u00f6suhte \u2013 paigaldamine ja seadistamine. Open Distro'i tutvustus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ELK SIEM Open Distro: \u0412\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK | ProHoster","og:description":"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445 \u043f\u0435\u0440\u0432\u044b\u0445 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432 \u041e\u0433\u043b\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u0441\u0442\u043e\u0432. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435. \u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 \u0434\u043b\u044f SOC \u043a\u0430\u043a Service (SOCasS) ELK stack \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u041f\u0440\u043e\u0433\u0443\u043b\u043a\u0430 \u043f\u043e open Distro","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-22T17:42:03+00:00","article:modified_time":"2020-08-22T17:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92075","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:15:36","updated":"2022-09-27 16:41:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/92075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=92075"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/92075\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/92076"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=92075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=92075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=92075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}