Nyob zoo tav su, hauv cov ntawv dhau los peb tau paub txog kev ua haujlwm ntawm ELK Stack. Thiab tam sim no peb yuav tham txog qhov muaj peev xwm tuaj yeem ua tiav los ntawm tus kws paub txog kev ruaj ntseg ntawm kev siv cov tshuab no. Cov ntawv teev dab tsi tuaj yeem thiab yuav tsum tau ntxiv rau elasticsearch. Cia peb xav txog dab tsi txheeb cais tuaj yeem tau los ntawm kev teeb tsa dashboards thiab seb puas muaj txiaj ntsig hauv qhov no. Kuv tuaj yeem siv automation ntawm cov txheej txheem kev ruaj ntseg cov ntaub ntawv siv ELK pawg li cas. Cia peb tsim cov architecture ntawm lub system. Nyob rau hauv tas li ntawd, qhov kev siv ntawm tag nrho cov functionality yog ib tug heev loj thiab nyuaj ua hauj lwm, yog li cov tshuaj tau muab ib tug cais lub npe - TS Total Sight.
Tam sim no, cov kev daws teeb meem uas sib sau ua ke thiab txheeb xyuas cov xwm txheej kev nyab xeeb hauv ib qho chaw muaj txiaj ntsig tau txais txiaj ntsig, vim li ntawd, tus kws tshaj lij tau txais kev txheeb cais thiab ua ntej rau kev nqis tes los txhim kho lub xeev cov ntaub ntawv kev ruaj ntseg hauv ib lub koom haum. Peb tau teeb tsa peb tus kheej xws li kev ua haujlwm hauv kev siv ELK pawg, vim li ntawd, peb tau xaiv cov haujlwm tseem ceeb hauv 4 ntu:
- Kev txheeb cais thiab kev pom;
- IS qhov xwm txheej nrhiav pom;
- Kev ua ntej ntawm qhov xwm txheej;
- Automation ntawm cov txheej txheem kev ruaj ntseg cov ntaub ntawv.
Cia peb ua tib zoo saib ntawm txhua qhov kom ntxaws ntxiv.
Cov ntaub ntawv kev ruaj ntseg teeb meem nrhiav kom tau
Lub luag haujlwm tseem ceeb hauv kev siv elasticsearch hauv peb cov ntaub ntawv yog khaws cov ntaub ntawv kev nyab xeeb nkaus xwb. Koj tuaj yeem sau cov ntaub ntawv kev nyab xeeb los ntawm txhua txoj kev tiv thaiv yog tias lawv txhawb nqa tsawg kawg qee hom kev hloov tsheb, tus qauv yog syslog lossis scp txuag rau cov ntaub ntawv.
Koj tuaj yeem muab cov qauv piv txwv ntawm cov cuab yeej tiv thaiv thiab tsis tsuas yog los ntawm qhov chaw koj yuav tsum teeb tsa kev xa tawm ntawm cov cav:
- Cov nyiaj NGFW (Check Point, Fortinet);
- Txhua qhov kev ntsuas qhov tsis zoo (PT Scanner, OpenVas);
- Web Application Firewall (PTAF);
- Netflow analyzers (Flowmon, Cisco StealthWatch);
- AD server.
Thaum koj tau teeb tsa Logstash xa cov cav thiab cov ntaub ntawv teeb tsa, koj tuaj yeem sib txheeb thiab sib piv nrog cov xwm txheej los ntawm ntau yam cuab yeej kev ruaj ntseg. Ua li no, nws yog qhov yooj yim los siv cov ntsuas ntsuas, uas peb yuav khaws txhua qhov xwm txheej cuam tshuam nrog ib qho khoom siv tshwj xeeb. Hauv lwm lo lus, ib qho kev ntsuas yog txhua qhov xwm txheej rau ib lub cuab yeej. Qhov kev faib tawm no tuaj yeem siv tau ob txoj hauv kev.
Qhov kev xaiv thawj yog los configure Logstash config. Ua li no, koj yuav tsum tau duplicate lub cav rau qee qhov chaw rau hauv ib chav tsev cais nrog lwm hom. Thiab tom qab ntawd siv hom no. Cov piv txwv clones log los ntawm IPS hniav ntawm Check Point firewall.
filter {
if [product] == "SmartDefense" {
clone {
clones => ["CloneSmartDefense"]
add_field => {"system" => "checkpoint"}
}
}
}
Txhawm rau khaws cov xwm txheej zoo li no hauv ib qho kev ntsuas cais nyob ntawm thaj chaw ntawm cov cav, piv txwv li, xws li Destination IP ntawm qhov kos npe tawm tsam. Koj tuaj yeem siv qhov kev tsim kho zoo sib xws:
output {
if [type] == "CloneSmartDefense"{
{
elasticsearch {
hosts => [",<IP_address_elasticsearch>:9200"]
index => "smartdefense-%{dst}"
user => "admin"
password => "password"
}
}
}
Thiab nyob rau hauv txoj kev no, koj tuaj yeem txuag txhua qhov xwm txheej rau qhov ntsuas, piv txwv li, los ntawm IP chaw nyob, lossis los ntawm lub npe ntawm lub tshuab. Hauv qhov no, peb khaws cia hauv qhov ntsuas "smartdefense-%{dst}", los ntawm IP chaw nyob ntawm qhov chaw kos npe.
Txawm li cas los xij, cov khoom sib txawv yuav muaj cov log sib txawv, ua rau muaj kev ntxhov siab thiab nco nco. Thiab ntawm no nws yuav tsim nyog los ua tib zoo hloov cov teb hauv Logstash config teeb tsa nrog cov tsim ua ntej, uas yuav zoo ib yam rau txhua yam xwm txheej, uas kuj yog ib txoj haujlwm nyuaj.
Qhov kev xaiv thib ob - qhov no yog sau ib tsab ntawv lossis cov txheej txheem uas yuav nkag mus rau hauv lub hauv paus elastic hauv lub sijhawm tiag tiag, rub tawm cov xwm txheej tsim nyog, thiab txuag lawv mus rau qhov ntsuas tshiab, qhov no yog txoj haujlwm nyuaj, tab sis nws tso cai rau koj ua haujlwm nrog cov ntawv teev lus raws li koj thov. , thiab cuam tshuam ncaj qha nrog cov xwm txheej los ntawm lwm cov cuab yeej kev ruaj ntseg. Qhov kev xaiv no tso cai rau koj los kho cov kev ua haujlwm nrog cov ntawv teev lus kom muaj txiaj ntsig zoo rau koj cov ntaub ntawv nrog kev hloov pauv siab tshaj plaws, tab sis ntawm no muaj teeb meem hauv kev nrhiav tus kws tshaj lij uas tuaj yeem siv qhov no.
Thiab, ntawm chav kawm, cov lus nug tseem ceeb tshaj plaws dab tsi tuaj yeem cuam tshuam thiab kuaj tau?
Tej zaum yuav muaj ntau txoj kev xaiv ntawm no, thiab nyob ntawm seb cov cuab yeej kev nyab xeeb siv hauv koj li kev tsim kho, ob peb yam piv txwv:
- Qhov pom tseeb tshaj plaws thiab los ntawm kuv qhov kev pom yog qhov kev xaiv nthuav tshaj plaws rau cov neeg uas muaj NGFW kev daws teeb meem thiab lub tshuab ntsuas qhov tsis zoo. Qhov no yog kev sib piv ntawm IPS cov cav thiab cov txiaj ntsig ntawm qhov tsis zoo. Yog tias qhov kev tawm tsam raug kuaj pom (tsis thaiv) los ntawm IPS system, thiab qhov tsis zoo no tsis raug kaw ntawm lub tshuab kawg raws li cov txiaj ntsig ntawm kev tshuaj ntsuam, nws yuav tsum tau tshuab tag nrho cov kav dej, vim tias muaj qhov tshwm sim siab tias qhov muaj qhov tsis zoo. siv.
- Ntau qhov kev sim nkag los ntawm ib lub tshuab mus rau qhov chaw sib txawv tuaj yeem ua lub cim tsis zoo.
- Kev rub tawm cov ntaub ntawv kab mob los ntawm tus neeg siv vim yog mus xyuas ntau qhov chaw uas muaj peev xwm txaus ntshai.
Statistics thiab visualization
Qhov pom tseeb tshaj plaws thiab nkag siab lub hom phiaj ntawm ELK Stack yog qhov khaws cia thiab pom cov cav, Nws tau pom tias koj tuaj yeem tau txais cov cav los ntawm ntau yam khoom siv siv Logstash. Tom qab lub cav mus rau Elasticsearch, koj tuaj yeem teeb tsa dashboards, uas tau hais los kuj tau , nrog cov ntaub ntawv thiab txheeb cais koj xav tau los ntawm kev pom.
piv txwv:
- Dashboard ntawm Kev Tiv Thaiv Kev Nyab Xeeb nrog cov xwm txheej tseem ceeb tshaj plaws. Ntawm no koj tuaj yeem xav txog qhov twg IPS kos npe tau kuaj pom, qhov twg lawv tuaj ntawm thaj chaw.
- Dashboard ntawm kev siv cov ntawv thov tseem ceeb tshaj plaws uas cov ntaub ntawv tuaj yeem xau.
- Luam theej duab tau los ntawm ib qho kev ruaj ntseg scanner.
- Cov ntaub ntawv los ntawm Active Directory los ntawm cov neeg siv.
- VPN txuas dashboard.
Hauv qhov no, yog tias koj teeb tsa dashboards los hloov kho txhua ob peb lub vib nas this, koj tuaj yeem tau txais cov txheej txheem yooj yim rau kev saib xyuas cov xwm txheej hauv lub sijhawm tiag tiag, uas tuaj yeem siv los teb cov ntaub ntawv kev nyab xeeb kom sai li sai tau yog tias koj muab cov dashboards rau hauv cais npo.
Qhov xwm txheej tseem ceeb
Nyob rau hauv tej yam kev mob ntawm ib tug loj infrastructure, tus naj npawb ntawm cov xwm txheej tuaj yeem tawm mus, thiab cov kws tshaj lij yuav tsis muaj sijhawm los tshuaj xyuas txhua qhov xwm txheej hauv lub sijhawm. Nyob rau hauv rooj plaub no, nws yog ib qho tsim nyog ua ntej ntawm tag nrho cov kev tawm tsuas yog cov xwm txheej uas muaj kev hem thawj loj. Yog li ntawd, lub kaw lus yuav tsum ua qhov tseem ceeb rau qhov xwm txheej raws li lawv qhov hnyav ntawm kev cuam tshuam rau koj qhov kev tsim kho vaj tse. Nws raug nquahu kom teeb tsa kev ceeb toom hauv kev xa ntawv lossis xov tooj ntawm cov xwm txheej no. Kev ua ntej tuaj yeem siv tau siv cov cuab yeej Kibana li niaj zaus, los ntawm kev teeb tsa kev pom. Tab sis nrog kev ceeb toom nws nyuaj dua, los ntawm lub neej ntawd qhov kev ua haujlwm no tsis suav nrog hauv cov qauv yooj yim ntawm Elasticsearch, tsuas yog hauv qhov them nyiaj xwb. Yog li ntawd, txawm yuav ib tug them version, los yog, dua, sau ib tug txheej txheem koj tus kheej uas yuav ceeb toom rau cov kws tshwj xeeb nyob rau hauv lub sij hawm ntawm xa ntawv los yog telegram.
Automation ntawm cov txheej txheem kev ruaj ntseg cov ntaub ntawv
Thiab ib qho ntawm qhov nthuav tshaj plaws yog kev ua haujlwm ntawm kev ua haujlwm rau cov ntaub ntawv kev ruaj ntseg xwm txheej. Yav dhau los, peb tau siv qhov kev ua haujlwm no rau Splunk, koj tuaj yeem nyeem me ntsis ntxiv hauv qhov no . Lub tswv yim tseem ceeb yog tias IPS txoj cai yeej tsis tau sim lossis ua kom zoo, txawm hais tias qee zaum nws yog ib qho tseem ceeb ntawm cov txheej txheem kev ruaj ntseg ntawm cov ntaub ntawv. Piv txwv li, ib xyoos tom qab kev siv NGFW thiab qhov tsis muaj kev nqis tes ua los txhim kho IPS, koj yuav sau ntau cov npe kos npe nrog Kev Tshawb Nrhiav Kev Ua Haujlwm uas yuav tsis raug thaiv, uas ua rau txo qis hauv xeev cov ntaub ntawv kev ruaj ntseg hauv lub koom haum. Nov yog qee qhov piv txwv ntawm dab tsi tuaj yeem ua tau automated:
- Hloov IPS kos npe los ntawm Kev Tshawb Fawb los Tiv Thaiv. Yog tias Tiv Thaiv tsis ua haujlwm ntawm kev kos npe tseem ceeb, qhov no yog qhov tsis zoo, thiab ua txhaum loj hauv kev tiv thaiv. Peb hloov qhov kev nqis tes ua hauv txoj cai rau kev kos npe zoo li no. Qhov kev ua haujlwm no tuaj yeem siv tau yog tias NGFW ntaus ntawv muaj REST API ua haujlwm. Qhov no tsuas yog ua tau yog tias koj muaj kev txawj programming, koj yuav tsum rub tawm cov ntaub ntawv tsim nyog los ntawm Elastcisearch thiab ua tiav API thov rau NGFW tswj server.
- Yog tias ntau qhov kos npe raug kuaj pom lossis raug thaiv hauv kev sib txuas hauv network los ntawm ib qho chaw nyob IP, nws ua rau kev txiav txim siab los thaiv qhov chaw nyob IP no rau qee lub sijhawm hauv Firewall txoj cai. Kev siv kuj suav nrog kev siv REST API.
- Tua tawm lub tswv yim scan nrog lub qhov tsis zoo scanner yog tias tus tswv tsev no muaj ntau tus kos npe rau IPS lossis lwm yam cuab yeej kev ruaj ntseg, yog tias nws yog OpenVas, ces koj tuaj yeem sau ib tsab ntawv uas yuav txuas ntawm ssh mus rau kev ruaj ntseg scanner thiab khiav lub scan.
TS Total Sight
Nyob rau hauv tas li ntawd, kev siv ntawm tag nrho cov functionality yog ib tug heev loj thiab nyuaj ua hauj lwm. Yog tsis muaj kev txawj programming, koj tuaj yeem teeb tsa qhov ua haujlwm yam tsawg kawg nkaus, uas tej zaum yuav txaus rau kev siv hauv kev tsim khoom. Tab sis yog tias koj txaus siab rau tag nrho cov functionality, koj tuaj yeem them sai sai rau TS Total Sight. Koj tuaj yeem pom cov ntsiab lus ntxiv ntawm peb . Yog li ntawd, tag nrho cov tswv yim ntawm kev ua hauj lwm thiab architecture yuav zoo li no:
xaus
Peb saib dab tsi tuaj yeem siv tau los ntawm ELK Stack. Hauv cov ntawv tom ntej, peb yuav sib cais los txiav txim siab ntxiv txog kev ua haujlwm ntawm TS Total Sight!
Yog li nyob twj ywm, , , ), .
Tau qhov twg los: www.hab.com