{"id":54536,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-elastic-stack-analiz-security-logov-dashbordy"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"3-elastic-stack-analiz-security-logov-dashbordy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","title":{"rendered":"3. Elastic stack: security \u017eurn\u0101lu anal\u012bze. Datu pane\u013ci","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"3.
\n
\nIepriek\u0161\u0113j\u0101s rakstos m\u0113s nedaudz iepazin\u0101mies ar ELK steku un Logstash konfigur\u0101cijas faila iestat\u012b\u0161anu \u017eurn\u0101la anal\u012bzei. \u0160aj\u0101 rakst\u0101 p\u0101riesim pie svar\u012bg\u0101k\u0101 anal\u012bzes viedok\u013ca - uz grafikiem un tabul\u0101m, kas apvienoti darbvirsm\u0101s<\/b>. \u0160odien m\u0113s tuv\u0101k iepaz\u012bsimies ar vizualiz\u0101cijas sist\u0113mu Kibana<\/b>, apskat\u012bsim, k\u0101 izveidot grafikus un tabulas, un beig\u0101s izstr\u0101d\u0101sim vienk\u0101r\u0161u darbvirsmu, pamatojoties uz Check Point ugunsm\u016bra \u017eurn\u0101liem.
\n<\/a><\/noindex>
\nPirmais solis darbam ar Kibana ir indeksa modelis<\/b>, lo\u0123iski, tas ir indeksu kopums, kas balst\u0101s uz noteiktiem principiem. Protams, tas ir nepiecie\u0161ams, lai Kibana \u0113rt\u0101k mekl\u0113tu inform\u0101ciju visos indeksos vienlaic\u012bgi. To nosaka ar virsrakstu, piem\u0113ram, \u201ccheckpoint-*\u201d un indeksa nosaukumu. Piem\u0113ram, \u00abcheckpoint-2019.12.05\u00bb atbilst modelim, bet \u201echeckpoint\u201d jau n\u0113. Atsevi\u0161\u0137i ir v\u0113rts piemin\u0113t, ka mekl\u0113\u0161an\u0101 nevar vienlaic\u012bgi mekl\u0113t inform\u0101ciju p\u0113c da\u017e\u0101diem indeksu mode\u013ciem. Nedaudz v\u0113l\u0101k sekojo\u0161ajos rakstos m\u0113s redz\u0113sim, ka API piepras\u012bjumi tiek veidoti vai nu p\u0113c indeksa nosaukuma, vai tie\u0161i p\u0113c viena mode\u013ca, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

P\u0113c tam m\u0113s p\u0101rbaud\u0101m Discover izv\u0113ln\u0113, vai visi \u017eurn\u0101li tiek indeks\u0113ti un vai ir iestat\u012bts pareizs parsers. Ja tiek konstat\u0113tas k\u0101das nepiln\u012bbas, piem\u0113ram, j\u0101maina datu tips no virknes uz veselu skaitli, ir j\u0101redi\u0123\u0113 Logstash konfigur\u0101cijas fails, un rezult\u0101t\u0101 jaunie \u017eurn\u0101li tiks re\u0123istr\u0113ti pareizi. Lai vecie \u017eurn\u0101li pirms izmai\u0146\u0101m ieg\u016btu vajadz\u012bgo form\u0101tu, noder tikai reindeks\u0101cijas process, kas tiks s\u012bk\u0101k izskat\u012bts turpm\u0101kajos rakstos. P\u0101rliecin\u0101simies, ka viss ir k\u0101rt\u012bb\u0101, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

\u017durn\u0101li izr\u0101d\u012bj\u0101s sav\u0101 viet\u0101, t\u0101d\u0113\u013c varam s\u0101kt izstr\u0101d\u0101t darbvirsmas. Pamatojoties uz anal\u012bzi no dro\u0161\u012bbas produktiem, var saprast, k\u0101da ir inform\u0101cijas dro\u0161\u012bba organiz\u0101cij\u0101, vizu\u0101li redz\u0113t tr\u016bkumus eso\u0161aj\u0101 politik\u0101 un turpm\u0101k izstr\u0101d\u0101t veidus, k\u0101 tos nov\u0113rst. Izstr\u0101d\u0101sim nelielu darbvirsmu, izmantojot vair\u0101kus vizualiz\u0101cijas r\u012bkus. Darbvirsma b\u016bs sast\u0101v no 5 komponentiem: <\/p>\n

    \n
  1. tabula, lai skait\u012btu kop\u0113jo \u017eurn\u0101lu skaitu p\u0113c pl\u0101ksn\u0113m<\/li>\n
  2. tabulu ar kritiskaj\u0101m IPS parakstiem<\/li>\n
  3. ap\u013ca diagrammu par Threat Prevention notikumiem<\/li>\n
  4. diagramma par vis\u0101m popul\u0101r\u0101kaj\u0101m apmekl\u0113taj\u0101m vietn\u0113m<\/li>\n
  5. diagramma par visbie\u017e\u0101k lietotaj\u0101m b\u012bstamaj\u0101m lietotn\u0113m<\/li>\n<\/ol>\n

    \nLai izveidotu vizualiz\u0101cijas fig\u016bras, j\u0101atver izv\u0113lne Vizualiz\u0113t<\/b>, un j\u0101izv\u0113las nepiecie\u0161am\u0101 fig\u016bra, kuru v\u0113lamies izveidot! Iesim sec\u012bgi.<\/p>\n

    Tabula kop\u0113j\u0101 logu skaita apr\u0113\u0137in\u0101\u0161anai pa blade<\/h3>\n

    \n\u0160im izv\u0113l\u0113simies fig\u016bru Datu tabula<\/b>, ieejam r\u012bkos grafiku izveidei, pa kreisi ir fig\u016bras iestat\u012bjumi, pa labi - k\u0101 t\u0101 izskat\u012bsies pa\u0161reiz\u0113jos iestat\u012bjumos. Vispirms par\u0101d\u012b\u0161u, k\u0101 izskat\u012bsies gatav\u0101 tabula, p\u0113c tam p\u0101riesim pie iestat\u012bjumiem, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Det\u0101l\u0101kie fig\u016bras iestat\u012bjumi, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Apskat\u012bsim iestat\u012bjumus.<\/p>\n

    S\u0101kotn\u0113ji tiek iestat\u012bts metrika<\/b>, \u0161o v\u0113rt\u012bbu izmanto, lai agreg\u0113tu visus laukus. Metricas tiek apr\u0113\u0137in\u0101tas, pamatojoties uz v\u0113rt\u012bb\u0101m, kas ieg\u016btas \u0161\u0101d\u0101 vai cit\u0101d\u0101 veid\u0101 no dokumentiem. V\u0113rt\u012bbas parasti tiek ieg\u016btas no laukiem<\/b> dokument\u0101, bet t\u0101s var ar\u012b tikt \u0123ener\u0113tas, izmantojot skriptus. \u0160aj\u0101 gad\u012bjum\u0101 uzst\u0101dam Agreg\u0101cija: Skaits<\/b> (kop\u0113jais logu skaits).<\/p>\n

    P\u0113c tam sadal\u0101m tabulu pa segmentiem (laukiem), p\u0113c kuriem tiks apr\u0113\u0137in\u0101ta metrika. \u0160o funkciju veic iestat\u012bjums Buckets, kas savuk\u0101rt sast\u0101v no 2 iestat\u012bjumu variantiem: <\/p>\n

      \n
    1. sadal\u012bt rindas \u2014 kolonu pievieno\u0161ana un v\u0113l\u0101k tabulas sadal\u012b\u0161ana pa rind\u0101m<\/li>\n
    2. sadal\u012bt tabulu \u2014 sadal\u012b\u0161ana vair\u0101k\u0101s tabul\u0101s p\u0113c noteikt\u0101 lauka v\u0113rt\u012bb\u0101m. <\/li>\n<\/ol>\n

      \nNo buckets<\/b> var pievienot vair\u0101kus sadal\u012bjumus, lai izveidotu vair\u0101kas kolonnas vai tabulas, ierobe\u017eojumi \u0161eit dr\u012bz\u0101k ir lo\u0123iski. Agreg\u0101cij\u0101 var izv\u0113l\u0113ties, p\u0113c k\u0101da principa notiks sadal\u012bjums pa segmentiem: ipv4 range, date range, Terms utt. Visinteresant\u0101kais izv\u0113le ir tie\u0161i Terms<\/b> un Significant Terms<\/b>, sadal\u012bjums pa segmentiem tiek veikts p\u0113c noteikt\u0101 lauka indeksa v\u0113rt\u012bb\u0101m, at\u0161\u0137ir\u012bba starp tiem ir attiec\u012bb\u0101 uz atgrieztaj\u0101m v\u0113rt\u012bb\u0101m un to att\u0113lo\u0161anu. T\u0101 k\u0101 m\u0113s v\u0113lamies sadal\u012bt tabulu p\u0113c blade nosaukuma, izv\u0113lamies lauku \u2014 product.keyword<\/b> un nor\u0101d\u0101m apjomu, cik 25 v\u0113rt\u012bbas tiks atgriezti. <\/p>\n

      Viet\u0101 rind\u0101m elasticsearch tiek izmantoti 2 datu tipi \u2014 text<\/b> un keyword<\/b>. Ja j\u016bs v\u0113laties veikt pilnteksta mekl\u0113\u0161anu, jums j\u0101dara izmantojiet datu tipu text, kas ir \u013coti \u0113rti, rakstot savu mekl\u0113\u0161anas pakalpojumu, piem\u0113ram, mekl\u0113jot piemin\u0113jumus v\u0101rdam konkr\u0113t\u0101 lauka (teksta) noz\u012bm\u0113. Ja j\u016bs v\u0113laties tikai prec\u012bzu atbilst\u012bbu, jums j\u0101dara izmantojiet datu tipu keyword. T\u0101pat datu tips keyword j\u0101izmanto laukiem, kas prasa k\u0101rto\u0161anu vai agreg\u0101ciju, t.i., m\u016bsu gad\u012bjum\u0101.<\/p>\n

      Rezult\u0101t\u0101 Elasticsearch saskaita \u017eurn\u0101lu skaitu noteikt\u0101 laik\u0101, veicot agreg\u0101ciju p\u0113c lauka product. Custom Label lauci\u0146\u0101 nosak\u0101m kolonnas nosaukumu, kas tiks att\u0113lots tabul\u0101, nosak\u0101m laiku, kur\u0101 v\u0101cam \u017eurn\u0101lus, uzs\u0101kam vizualiz\u0101ciju \u2014 Kibana s\u016bta piepras\u012bjumu elastsearch, gaida atbildi un p\u0113c tam vizualiz\u0113 ieg\u016btos datus. Tabula gatava!<\/p>\n

      Sagatavo\u0161ana p\u0113c Threat Prevention notikumiem<\/h3>\n

      \nNoteiktu interesi rada inform\u0101cija par to, cik daudz ir \u012bpa\u0161i procentu\u0101li attiec\u012bb\u0101s uz reakcij\u0101m detect<\/b> un prevent<\/b> uz incidente BI eso\u0161aj\u0101 dro\u0161\u012bbas politik\u0101. \u0160\u0101d\u0101 gad\u012bjum\u0101 labi der\u0113tu sagatavo\u0161ana. Izv\u0113lamies Visualize \u2014 Pie chart<\/b>. T\u0101pat metriku nosak\u0101m agreg\u0101cijai p\u0113c \u017eurn\u0101lu skaita. Buckets lauci\u0146\u0101 ievietojam Terms => action. <\/p>\n

      Izskat\u0101s, ka viss ir pareizi, bet rezult\u0101t\u0101 tiek r\u0101d\u012btas v\u0113rt\u012bbas visiem blade, nepiecie\u0161ams filtr\u0113t tikai tos, kas darbojas Threat Prevention. T\u0101d\u0113\u013c oblig\u0101ti iestat\u0101m filtru<\/b> lai mekl\u0113tu inform\u0101ciju tikai par blade, kas atbild par BI incidentiem \u2014 product: (\u00abAnti-Bot\u00bb OR \u00abNew Anti-Virus\u00bb OR \u00abDDoS Protector\u00bb OR \u00abSmartDefense\u00bb OR \u00abThreat Emulation\u00bb). Att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Un v\u0113l detaliz\u0113t\u0101kas iestat\u012b\u0161anas, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Tabula p\u0113c IPS notikumiem<\/h3>\n

      \nT\u0101l\u0101k ir \u013coti svar\u012bgi no dro\u0161\u012bbas puses p\u0101rskat\u012bt un p\u0101rbaud\u012bt notikumus p\u0113c blade IPS<\/b> un Threat Emulation<\/b>, kas netiek blo\u0137\u0113ti<\/b> eso\u0161aj\u0101 politik\u0101, lai n\u0101kotn\u0113 vai nu p\u0101rv\u0113rstu parakstu prevent, vai, ja trafiks ir der\u012bgs, \u2014 neizmantotu parakstu. Tabulu veidojam t\u0101pat k\u0101 pirmaj\u0101 piem\u0113r\u0101, tikai ar to at\u0161\u0137ir\u012bbu, ka izveidojam vair\u0101kas kolonnas: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Oblig\u0101ti iestat\u0101m filtru, lai mekl\u0113tu inform\u0101ciju tikai par blade, kas atbild par BI incidentiem \u2014 product: ( \u00abSmartDefense\u00bb OR \u00abThreat Emulation\u00bb). Att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Detaliz\u0113t\u0101ki iestat\u012bjumi, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Diagrammas par visbie\u017e\u0101k apmekl\u0113taj\u0101m vietn\u0113m<\/h3>\n

      \nLai to izdar\u012btu, izveidojam fig\u016bru \u2014 Vertical Bar<\/b>. Metrikai izmantojam count (Y ass), bet X ass v\u0113rt\u012bb\u0101m izmantosim apmekl\u0113to viet\u0146u nosaukumus \u2014 \u201cappi_name\u201d. \u0160eit ir neliela vilt\u012bba: ja palaid\u012bsim iestat\u012bjumus pa\u0161reiz\u0113j\u0101 variant\u0101, tad visas vietnes tiks iez\u012bm\u0113tas uz grafika vien\u0101 kr\u0101s\u0101; lai t\u0101s padar\u012btu daudzkr\u0101sainas, izmantojam papildu iestat\u012bjumu \u2014 \u201csplit series\u201d, kas \u013cauj dal\u012bt jau gatavu kolonnu vair\u0101k\u0101s v\u0113rt\u012bb\u0101s atkar\u012bb\u0101 no izv\u0113l\u0113t\u0101 lauka. \u0160o dal\u012bjumu var izmantot k\u0101 vienu daudzkr\u0101sainu kolonnu v\u0113rt\u012bb\u0101m sakraut\u0101 re\u017e\u012bm\u0101, vai ar\u012b norm\u0101l\u0101 re\u017e\u012bm\u0101, lai izveidotu vair\u0101kas kolonnas p\u0113c noteiktas X ass v\u0113rt\u012bbas. \u0160aj\u0101 gad\u012bjum\u0101 m\u0113s izmantojam to pa\u0161u v\u0113rt\u012bbu, kas uz X ass, kas \u013cauj vis\u0101m kolonn\u0101m b\u016bt daudzkr\u0101sain\u0101m, un aug\u0161\u0113j\u0101 labaj\u0101 st\u016br\u012b t\u0101s tiks atz\u012bm\u0113tas ar kr\u0101s\u0101m. Filtr\u0101 iestat\u0101m \u2014 product:\u00abURL Filtering\u00bb, lai redz\u0113tu inform\u0101ciju tikai par apmekl\u0113t\u0101m vietn\u0113m, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Iestat\u012bjumi:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Diagramma par visb\u012bstam\u0101ko aplik\u0101ciju izmanto\u0161anu<\/h3>\n

      \nLai to izdar\u012btu, izveidojam fig\u016bru \u2014 Vertical Bar. Metrikai izmantojam count (Y ass), bet X ass v\u0113rt\u012bb\u0101m izmantosim izmantoto aplik\u0101ciju nosaukumus - \u201cappi_name\u201d. Visb\u016btisk\u0101kais ir uzst\u0101d\u012bt filtru \u2014 product: \u00abApplication Control\u00bb AND app_risk: (4 OR 5 OR 3 ) AND action:\u00abaccept\u00bb. Filtr\u0113jam \u017eurn\u0101lus pa Application Control, \u0146emam tikai t\u0101s vietnes, kas ir kategoriz\u0113tas k\u0101 vietnes ar kritisku, augstu un vid\u0113ju risku, un tikai tad, ja piek\u013cuve \u0161\u012bm vietn\u0113m ir at\u013cauta. Att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Iestat\u012bjumi, klik\u0161\u0137in\u0101mi:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Domenas panelis<\/h3>\n

      \nDomenas pane\u013ca apskate un izveide notiek atsevi\u0161\u0137\u0101 izv\u0113lnes punkt\u0101 \u2014 Vad\u012bbas panelis<\/b>. \u0160eit viss ir vienk\u0101r\u0161i: tiek izveidots jauns pane\u013ca, taj\u0101 pievienota vizualiz\u0101cija, novietota pa viet\u0101m un viss!<\/p>\n

      Izveidojam paneli, ar kuru var\u0113sim saprast pamatst\u0101vokli organiz\u0101cijas dro\u0161\u012bb\u0101, protams, tikai Check Point l\u012bmen\u012b, att\u0113ls ir klik\u0161\u0137in\u0101ms:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Balstoties uz \u0161iem grafikiem, m\u0113s varam saprast, kuras kritisk\u0101s signature netiek blo\u0137\u0113tas uz ugunsm\u016bra, kur iet lietot\u0101ji, k\u0101das visb\u012bstam\u0101k\u0101s aplik\u0101cijas vi\u0146i izmanto.<\/p>\n

      Secin\u0101jums<\/h3>\n

      \nM\u0113s apskat\u012bj\u0101m pamata vizualiz\u0101cijas iesp\u0113jas Kibana un izveidoj\u0101m inform\u0101cijas paneli, ta\u010du tas ir tikai neliela da\u013ca. Turpin\u0101jum\u0101 kurs\u0101 \u012bpa\u0161i apl\u016bkosim kartes iestat\u012b\u0161anu, darbu ar Elasticsearch sist\u0113mu, iepaz\u012bsimies ar API piepras\u012bjumiem, automatiz\u0101ciju un v\u0113l daudz ko citu!<\/p>\n

      T\u0101tad sekojiet l\u012bdzi jaunumiem (Telegram<\/a><\/noindex>, Facebook<\/a><\/noindex>, VK<\/a><\/noindex>, TS Solution Blog<\/a><\/noindex>), Yandex.Dzen<\/a><\/noindex>.
      \n
      Avots:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54536","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Elastic stack: dro\u0161\u012bbas \u017eurn\u0101lu anal\u012bze. Inform\u0101cijas pane\u013ci | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54536","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/54536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=54536"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/54536\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=54536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=54536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=54536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}