Hauv cov ntawv dhau los, peb tau txais me ntsis paub txog cov elk pawg thiab teeb tsa Logstash teeb tsa cov ntaub ntawv rau lub cav parser. Hauv kab lus no, peb yuav txav mus rau qhov tseem ceeb tshaj plaws los ntawm kev txheeb xyuas qhov pom, qhov koj xav tau. pom los ntawm lub kaw lus thiab txhua yam tau tsim rau - cov no yog cov duab kos thiab cov lus sib xyaw ua ke dashboards. Niaj hnub no peb yuav los saib ze dua ntawm qhov pom qhov system Kibana, peb yuav saib yuav ua li cas los tsim cov duab thiab cov ntxhuav, thiab yog li ntawd peb yuav tsim ib lub dashboard yooj yim raws li cov cav los ntawm Check Point firewall.
Thawj kauj ruam hauv kev ua haujlwm nrog kibana yog tsim index qauv, logically, qhov no yog lub hauv paus ntawm indexes united raws li ib tug tej yam hauv paus ntsiab lus. Tau kawg, qhov no tsuas yog qhov chaw ua kom Kibana yooj yim dua tshawb nrhiav cov ntaub ntawv hla txhua qhov ntsuas tib lub sijhawm. Nws yog teem los ntawm kev sib piv ib txoj hlua, hais tias "checkpoint-*" thiab lub npe ntawm qhov ntsuas. Piv txwv li, "checkpoint-2019.12.05" yuav haum tus qauv, tab sis tsuas yog "checkpoint" tsis muaj lawm. Nws yog ib qho tsim nyog hais cais tias hauv kev tshawb nrhiav nws tsis tuaj yeem tshawb nrhiav cov ntaub ntawv ntawm cov qauv ntsuas sib txawv tib lub sijhawm; me ntsis tom qab hauv cov ntawv txuas ntxiv peb yuav pom tias API thov raug tsim los ntawm lub npe ntawm qhov ntsuas, lossis tsuas yog los ntawm ib qho. kab ntawm tus qauv, daim duab yog clickable:
Tom qab ntawd, peb txheeb xyuas hauv Discover cov ntawv qhia zaub mov uas txhua lub cav raug txheeb xyuas thiab qhov tseeb parser raug teeb tsa. Yog tias pom muaj qhov tsis sib xws, piv txwv li, hloov cov ntaub ntawv los ntawm ib txoj hlua mus rau tus lej, koj yuav tsum hloov kho Logstash configuration file, vim li ntawd, cov cav tshiab yuav raug sau kom raug. Txhawm rau kom cov ntawv teev qub qub coj mus rau hauv daim ntawv xav tau ua ntej qhov kev hloov pauv, tsuas yog cov txheej txheem reindexing pab tau; nyob rau hauv cov ntawv txuas ntxiv no cov haujlwm no yuav tham txog ntau yam ntxiv. Cia peb nco ntsoov tias txhua yam nyob rau hauv kev txiav txim, daim duab yog clickable:
Cov cav yog nyob rau hauv qhov chaw, uas txhais tau tias peb tuaj yeem pib tsim cov dashboards. Raws li kev txheeb xyuas ntawm dashboards los ntawm cov khoom siv kev ruaj ntseg, koj tuaj yeem nkag siab txog lub xeev ntawm cov ntaub ntawv kev ruaj ntseg hauv ib lub koom haum, pom meej meej pom qhov tsis zoo ntawm txoj cai tam sim no, thiab tom qab ntawd tsim txoj hauv kev los tshem tawm lawv. Cia peb tsim ib lub dashboard me me uas siv ntau yam kev pom pom. Lub dashboard yuav muaj 5 yam:
- rooj rau xam tag nrho cov cav los ntawm cov hniav
- rooj ntawm IPS kos npe tseem ceeb
- pie chart for Threat Prevention events
- daim duab ntawm cov chaw uas nyiam tshaj plaws mus xyuas
- daim ntawv qhia txog kev siv cov ntawv thov txaus ntshai tshaj plaws
Txhawm rau tsim cov duab kos duab, koj yuav tsum mus rau cov ntawv qhia zaub mov Pom tau, thiab xaiv cov duab xav tau uas peb xav tsim! Wb mus nyob rau hauv kev txiav txim.
Table rau xam tag nrho cov cav los ntawm cov hniav
Ua li no, xaiv ib daim duab Cov Ntaub Ntawv Cov Lus, peb poob rau hauv cov khoom siv rau kev tsim cov duab, sab laug yog daim duab teeb tsa, sab xis yog li cas nws yuav saib hauv qhov chaw tam sim no. Ua ntej, kuv yuav ua kom pom tias lub rooj tiav yuav zoo li cas, tom qab ntawd peb yuav mus dhau qhov chaw, daim duab yog clickable:
Cov ncauj lus kom ntxaws ntxiv ntawm daim duab, daim duab yog clickable:
Cia peb saib cov kev teeb tsa.
Thaum xub thawj configured kev ntsuas, qhov no yog tus nqi uas tag nrho cov teb yuav muab sib sau ua ke. Metrics yog xam raws li cov nqi rho tawm hauv ib txoj kev lossis lwm qhov los ntawm cov ntaub ntawv. Cov txiaj ntsig feem ntau yog muab rho tawm los ntawm liaj teb cov ntaub ntawv, tab sis kuj tuaj yeem tsim siv cov ntawv sau. Hauv qhov no peb muab tso rau hauv Aggregation: suav (tag nrho cov log).
Tom qab no, peb faib lub rooj rau hauv ntu (thaj chaw) uas tus metric yuav raug xam. Qhov kev ua haujlwm no yog ua los ntawm Buckets qhov chaw, uas nyob rau hauv lem muaj 2 txoj kev xaiv:
- cais kab - ntxiv kab thiab tom qab faib lub rooj rau hauv kab
- cais lub rooj - faib ua ntau lub rooj raws li qhov tseem ceeb ntawm ib qho chaw tshwj xeeb.
Π Thoob koj tuaj yeem ntxiv ntau qhov sib faib los tsim ntau kab lossis cov rooj, cov kev txwv ntawm no yog qhov laj thawj zoo. Hauv kev sib sau, koj tuaj yeem xaiv txoj kev twg yuav siv los faib ua ntu: ipv4 ntau yam, hnub tim, Cov ntsiab lus, thiab lwm yam. Qhov kev xaiv nthuav tshaj plaws yog qhov tseeb Cov ntsiab lus uas ΠΈ Cov ntsiab lus tseem ceeb, kev faib ua ntu yog nqa tawm raws li qhov tseem ceeb ntawm ib qho kev ntsuas tshwj xeeb, qhov sib txawv ntawm lawv nyob hauv tus lej ntawm cov nqi xa rov qab, thiab lawv cov zaub. Txij li thaum peb xav faib lub rooj los ntawm lub npe ntawm cov hniav, peb xaiv lub teb - khoom.keyword thiab teeb qhov loj me rau 25 tus nqi rov qab.
Hloov cov hlua, elasticsearch siv 2 hom ntaub ntawv - ntawv nyeem ΠΈ lo lus tseem ceeb. Yog tias koj xav ua qhov kev tshawb nrhiav tag nrho, koj yuav tsum siv cov ntawv nyeem, ib qho yooj yim heev thaum sau koj cov kev pabcuam tshawb nrhiav, piv txwv li, nrhiav cov lus hais hauv ib nqe lus tshwj xeeb (ntawv nyeem). Yog tias koj tsuas xav tau qhov sib tw tiag tiag, koj yuav tsum siv hom lo lus tseem ceeb. Tsis tas li ntawd, cov ntaub ntawv lo lus tseem ceeb yuav tsum tau siv rau thaj chaw uas xav tau kev sib cais lossis kev sib sau ua ke, uas yog, hauv peb rooj plaub.
Yog li ntawd, Elasticsearch suav cov naj npawb ntawm cov cav rau ib lub sijhawm, suav nrog cov nqi hauv cov khoom lag luam. Hauv Custom Label, peb teeb tsa lub npe ntawm kem uas yuav tshwm sim hauv lub rooj, teem sijhawm rau peb sau cov cav, pib ua haujlwm - Kibana xa cov lus thov mus rau elasticsearch, tos rau cov lus teb thiab tom qab ntawd pom cov ntaub ntawv tau txais. Lub rooj npaj txhij!
Daim Ntawv Qhia Pie rau Kev Tiv Thaiv Kev Nyab Xeeb
Ntawm qhov txaus siab yog cov ntaub ntawv hais txog ntau npaum li cas cov tshuaj tiv thaiv muaj raws li feem pua ntes tau ΠΈ Tiv Thaiv ntawm cov ntaub ntawv kev ruaj ntseg xwm txheej nyob rau hauv txoj cai ruaj ntseg tam sim no. Daim ntawv qhia ncuav qab zib ua haujlwm zoo rau qhov xwm txheej no. Xaiv hauv Visualize - Daim ntawv qhia ncuav. Tsis tas li ntawd nyob rau hauv lub metric peb teem aggregation los ntawm tus naj npawb ntawm cov cav. Hauv thoob peb muab Cov Lus Qhia => ua.
Txhua yam zoo li muaj tseeb, tab sis qhov tshwm sim qhia tau hais tias muaj txiaj ntsig rau tag nrho cov hniav; koj yuav tsum tau lim tsuas yog los ntawm cov hniav uas ua haujlwm nyob rau hauv lub moj khaum ntawm Kev Tiv Thaiv Kev Nyab Xeeb. Yog li ntawd, peb twv yuav raug hu nws lub lim txhawm rau tshawb nrhiav cov ntaub ntawv tsuas yog ntawm cov hniav ua lub luag haujlwm rau cov ntaub ntawv kev nyab xeeb - cov khoom lag luam: ("Anti-Bot" LOSSIS "Tshiab Anti-Virus" OR "DDoS Protector" OR "SmartDefense" OR "Tshiab Emulation"). Daim duab yog clickable:
Thiab cov ncauj lus kom ntxaws ntxiv, daim duab yog clickable:
IPS Event Table
Tom ntej no, qhov tseem ceeb heev los ntawm cov ntaub ntawv kev ruaj ntseg ntawm qhov pom yog saib thiab xyuas cov xwm txheej ntawm cov hniav. IPS ΠΈ Kev Nyuaj Siab Emulation, kev sib tw tsis thaiv txoj cai tam sim no, txhawm rau hloov pauv qhov kos npe los tiv thaiv, lossis yog tias kev khiav tsheb siv tau, tsis txhob kos npe kos npe. Peb tsim lub rooj zoo ib yam li thawj qhov piv txwv, nrog rau qhov sib txawv tsuas yog peb tsim ob peb kab: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Nco ntsoov teeb tsa lub lim txhawm rau txhawm rau tshawb nrhiav cov ntaub ntawv tsuas yog ntawm cov hniav lub luag haujlwm rau cov ntaub ntawv kev nyab xeeb - khoom: ("SmartDefense" OR "Thiab Emulation"). Daim duab yog clickable:
Xav paub ntau ntxiv, daim duab yog clickable:
Cov kab kos rau qhov chaw nyiam tshaj plaws uas tau mus xyuas
Txhawm rau ua qhov no, tsim ib daim duab - ntsug bar. Peb kuj siv suav (Y axis) ua tus ntsuas, thiab ntawm X axis peb yuav siv lub npe ntawm cov chaw mus xyuas raws li qhov tseem ceeb - "appi_name". Muaj qhov ua kom yuam kev me me ntawm no: yog tias koj khiav qhov chaw nyob rau tam sim no, ces txhua qhov chaw yuav raug cim rau ntawm daim ntawv nrog tib xim, txhawm rau ua kom lawv muaj ntau xim peb siv qhov chaw ntxiv - "split series", uas tso cai rau koj faib ib kem npaj rau hauv ob peb yam tseem ceeb, nyob ntawm seb qhov chaw xaiv tau kawg! Qhov kev faib tawm no tuaj yeem siv los ua ib kab ntau xim raws li qhov tseem ceeb hauv hom stacked, lossis hauv ib txwm hom txhawm rau tsim ntau kab raws li tus nqi ntawm X axis.Qhov no, ntawm no peb siv cov tib tus nqi ib yam li ntawm X axis, qhov no ua rau nws tuaj yeem ua rau txhua kab ntau xim; lawv yuav raug qhia los ntawm cov xim ntawm sab xis. Hauv cov lim uas peb tau teeb tsa - cov khoom lag luam: "URL Filtering" txhawm rau pom cov ntaub ntawv tsuas yog ntawm cov chaw mus xyuas, daim duab yog clickable:
Chaw:
Daim duab qhia txog kev siv cov ntawv thov txaus ntshai tshaj plaws
Ua li no, tsim ib daim duab - Vertical Bar. Peb kuj siv suav (Y axis) ua tus ntsuas, thiab ntawm X axis peb yuav siv lub npe ntawm cov ntawv thov siv - "appi_name" raws li qhov tseem ceeb. Qhov tseem ceeb tshaj plaws yog qhov kev teeb tsa lim - khoom: "Application Control" THIAB app_risk: (4 OR 5 OR 3 ) THIAB ua: "tau txais". Peb lim cov cav los ntawm Daim Ntawv Thov Kev Tswj Hniav, tsuas yog siv cov chaw uas tau categorized li Critical, High, Medium risk sites thiab tsuas yog nkag mus rau cov chaw no tau tso cai. Daim duab yog clickable:
Chaw, clickable:
Dashboard
Saib thiab tsim dashboards yog nyob rau hauv ib qho khoom noj khoom haus cais - dashboard. Txhua yam yog qhov yooj yim ntawm no, lub dashboard tshiab tau tsim, kev pom tau ntxiv rau nws, muab tso rau hauv nws qhov chaw thiab qhov ntawd yog nws!
Peb tab tom tsim lub dashboard uas koj tuaj yeem nkag siab txog qhov xwm txheej tseem ceeb ntawm lub xeev cov ntaub ntawv kev ruaj ntseg hauv ib lub koom haum, tau kawg, tsuas yog nyob rau theem Check Point, daim duab yog clickable:
Raws li cov duab kos, peb tuaj yeem nkag siab tias cov kos npe tseem ceeb twg tsis raug thaiv ntawm firewall, qhov twg cov neeg siv mus, thiab cov ntawv thov txaus ntshai tshaj plaws uas lawv siv.
xaus
Peb tau saib lub peev xwm ntawm kev pom kev yooj yim hauv Kibana thiab tsim lub dashboard, tab sis qhov no tsuas yog ib feem me me xwb. Ntxiv rau hauv chav kawm peb yuav sib cais los ntawm kev teeb tsa cov duab qhia chaw, ua haujlwm nrog lub elasticsearch system, paub txog API thov, automation thiab ntau ntxiv!
Yog li nyob twj ywm, , , ), .
Tau qhov twg los: www.hab.com