{"id":54536,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-elastic-stack-analiz-security-logov-dashbordy"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"3-elastic-stack-analiz-security-logov-dashbordy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","title":{"rendered":"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/703e366b85e1c67018387e2f2a807f1b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen articolele anterioare, ne-am familiarizat pu\u021bin cu stiva ELK \u0219i cu configurarea fi\u0219ierului Logstash pentru parserul de loguri. \u00cen acest articol, vom trece la ceea ce este cel mai important din punctul de vedere al analizei, la ceea ce dori\u021bi s\u0103 vede\u021bi din sistem \u0219i pentru care a fost creat totul \u2014 graficile \u0219i tabelele unite \u00een <b>dashboards<\/b>. Ast\u0103zi ne vom familiariza mai bine cu sistemul de vizualizare <b>Kibana<\/b>, vom explora cum s\u0103 cre\u0103m grafice, tabele \u0219i, \u00een cele din urm\u0103, vom construi un dashboard simplu pe baza logurilor de la firewall-ul Check Point.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPrimul pas \u00een lucrul cu Kibana este crearea <b>index pattern<\/b>, logic, aceasta este o baz\u0103 a indicilor unificat\u0103 dup\u0103 un anumit principiu. Desigur, aceasta este exclusiv o configurare pentru ca Kibana s\u0103 caute mai convenabil informa\u021biile \u00een toate indicii simultan. Aceasta se stabile\u0219te prin coresponden\u021ba unei \u0219iruri, s\u0103 spunem \u201ccheckpoint-*\u201d \u0219i numele indexului. De exemplu, \u201echeckpoint-2019.12.05\u201d se potrive\u0219te cu modelul, dar simplu \u201echeckpoint\u201d nu se potrive\u0219te. Merit\u0103 men\u021bionat \u00een mod separat c\u0103, la c\u0103utare, nu se poate c\u0103uta informa\u021bia pe diferite modele de index simultan; un pic mai t\u00e2rziu, \u00een articolele urm\u0103toare, vom vedea c\u0103 cererile API se fac fie dup\u0103 numele indexului, fie conform unui singur model de este, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/64\/nm\/tb\/64nmtbsfwl-qfysx5n6km6iwr3m.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/d84ad30d2ee921b7f76a8224cfad5029.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Dup\u0103 aceasta, verific\u0103m \u00een meniul Discover dac\u0103 toate logurile sunt indexate \u0219i dac\u0103 parserul este corect configurat. Dac\u0103 se constat\u0103 vreo discrepan\u021b\u0103, de exemplu, schimbarea tipului de date din \u0219ir \u00een num\u0103r \u00eentreg, trebuie s\u0103 edit\u0103m fi\u0219ierul de configurare Logstash, rezult\u00e2nd c\u0103 noile loguri vor fi \u00eenregistrate corect. Pentru ca logurile vechi s\u0103 primeasc\u0103 forma dorit\u0103 \u00eenainte de modificare, ajut\u0103 doar procesul de reindexare; \u00een articolele urm\u0103toare, aceast\u0103 opera\u021biune va fi discutat\u0103 mai detaliat. S\u0103 ne asigur\u0103m c\u0103 totul este \u00een ordine, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/y1\/-h\/jk\/y1-hjkcxrtdpuufzqxqdpqhlvha.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/c704b83f68de588b612a97cb92fa0433.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Logurile s-au aflat la locul lor, a\u0219a c\u0103 putem \u00eencepe construirea dashboard-urilor. Pe baza analizei dashboard-urilor produselor de securitate, se poate \u00een\u021belege starea securit\u0103\u021bii informa\u021biei \u00een organiza\u021bie, vizualiz\u00e2nd locurile vulnerabile \u00een politica actual\u0103 \u0219i dezvolt\u00e2nd ulterior modalit\u0103\u021bi de remediere. S\u0103 construim un mic dashboard, folosind c\u00e2teva instrumente de vizualizare. Dashboard-ul va consta din 5 componente: <\/p>\n<ol>\n<li>un tabel pentru num\u0103rarea num\u0103rului total de loguri pe blade-uri<\/li>\n<li>un tabel pentru semn\u0103turile critice IPS<\/li>\n<li>diagram\u0103 circular\u0103 pentru evenimente Threat Prevention<\/li>\n<li>diagram\u0103 pentru cele mai populare site-uri vizitate<\/li>\n<li>diagram\u0103 pentru utilizarea celor mai periculoase aplica\u021bii<\/li>\n<\/ol>\n<p>\nPentru a crea figurile de vizualizare, trebuie s\u0103 accesa\u021bi meniul <b>Vizualiza\u021bi<\/b>, \u0219i s\u0103 selecta\u021bi figura dorit\u0103 pe care vrem s\u0103 o construim! S\u0103 proced\u0103m pas cu pas.<\/p>\n<h3>Tabel pentru num\u0103rarea totalului logurilor pe blade-uri<\/h3>\n<p>\nPentru aceasta, alegem figura <b>Tabel de date<\/b>, intr\u0103m \u00een instrumentul pentru crearea grafica, set\u0103rile figurii sunt plasate \u00een st\u00e2nga, iar aspectul acesteia \u00een set\u0103rile curente este pe dreapta. Mai \u00eent\u00e2i, voi demonstra cum va ar\u0103ta tabelul final, dup\u0103 care vom trece prin set\u0103ri, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/h6\/qh\/zs\/h6qhzsfawr4qslqtdfybm3zvzsw.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/cd0d023ad12db5bbfe2dcc51823fb459.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Set\u0103ri mai detaliate pentru figur\u0103, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/pe\/2j\/d2\/pe2jd28os3xkfs70wi9jl--0kcc.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/4e3ca27ef051e2ab86d5006c83b0ad98.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>S\u0103 analiz\u0103m set\u0103rile.<\/p>\n<p>\u00cen primul r\u00e2nd, se configureaz\u0103 <b>metrica<\/b>, aceasta este valoarea pe baza c\u0103reia vor fi agregate toate c\u00e2mpurile. Metricile sunt calculate pe baza valorilor extrase prin diferite metode din documente. Valorile sunt de obicei extrase din <b>c\u00e2mpurile<\/b> documentului, dar pot fi generate \u0219i folosind scripturi. \u00cen acest caz, stabilim \u00een <b>Agregare: Num\u0103r<\/b> (num\u0103rul total de loguri).<\/p>\n<p>Dup\u0103 aceasta, \u00eemp\u0103r\u021bim tabelul \u00een segmente (c\u00e2mpuri), pe care se va calcula metrica. Aceast\u0103 func\u021bie este \u00eendeplinit\u0103 de configura\u021bia Buckets, care la r\u00e2ndul s\u0103u const\u0103 \u00een 2 op\u021biuni de configurare: <\/p>\n<ol>\n<li>split rows \u2014 ad\u0103ugarea coloanelor \u0219i ulterior \u00eemp\u0103r\u021birea tabelului \u00een r\u00e2nduri<\/li>\n<li>split table \u2014 \u00eemp\u0103r\u021birea \u00een mai multe tabele \u00een func\u021bie de valorile unui c\u00e2mp specific. <\/li>\n<\/ol>\n<p>\n\u00cen <b>buckets<\/b> putem ad\u0103uga mai multe diviziuni pentru crearea mai multor coloane sau tabele, limit\u0103rile sunt mai degrab\u0103 logice. \u00cen agregare se poate alege metoda prin care se va face divizarea \u00een segmente: ipv4 range, date range, Terms etc. Alegerile cele mai interesante sunt <b>Terms<\/b> \u0219i <b>Termeni semnificativi<\/b>, divizarea \u00een segmente se efectueaz\u0103 \u00een func\u021bie de valorile dintr-un c\u00e2mp specific al indexului, diferen\u021ba dintre ele const\u0103 \u00een num\u0103rul de valori returnate \u0219i afi\u0219area lor. Deoarece vrem s\u0103 \u00eemp\u0103r\u021bim tabelul \u00een func\u021bie de denumirea blade-urilor, alegem c\u00e2mpul \u2014 <b>product.keyword<\/b> \u0219i stabilim dimensiunea la 25 de valori returnate. <\/p>\n<p>\u00cen loc de r\u00e2nduri, \u00een elasticsearch se folosesc 2 tipuri de date \u2014 <b>text<\/b> \u0219i <b>keyword<\/b>. Dac\u0103 dori\u021bi s\u0103 efectua\u021bi o c\u0103utare full-text, trebuie s\u0103 utiliza\u021bi tipul text, ceea ce este foarte convenabil atunci c\u00e2nd scrie\u021bi propriul serviciu de c\u0103utare, de exemplu, c\u0103ut\u00e2nd men\u021bionarea unui cuv\u00e2nt \u00eentr-un anumit c\u00e2mp (text). Dac\u0103 dori\u021bi doar o potrivire exact\u0103, trebuie s\u0103 utiliza\u021bi tipul keyword. De asemenea, tipul de date keyword ar trebui folosit pentru c\u00e2mpuri care necesit\u0103 sortare sau agregare, adic\u0103, \u00een cazul nostru.<\/p>\n<p>Ca rezultat, Elasticsearch num\u0103r\u0103 logurile pentru o anumit\u0103 perioad\u0103 de timp, agreg\u00e2ndu-le dup\u0103 valoarea din c\u00e2mpul product. \u00cen Custom Label, specific\u0103m numele coloanei care va fi afi\u0219at\u0103 \u00een tabel, stabilim timpul pentru care colect\u0103m logurile, lans\u0103m generarea \u2014 Kibana trimite o cerere c\u0103tre Elasticsearch, a\u0219teapt\u0103 un r\u0103spuns \u0219i apoi vizualizeaz\u0103 datele ob\u021binute. Tabelul este gata!<\/p>\n<h3>Diagram\u0103 circular\u0103 pentru evenimentele de prevenire a amenin\u021b\u0103rilor<\/h3>\n<p>\nO informa\u021bie deosebit de interesant\u0103 este procentajul reac\u021biilor <b>detect<\/b> \u0219i <b>prevent<\/b> privind incidentele de securitate cibernetic\u0103 \u00een politica de securitate actual\u0103. Pentru un astfel de caz, diagram\u0103 circular\u0103 este potrivit\u0103. Alege\u021bi \u00een Visualize \u2014 <b>Pie chart<\/b>. De asemenea, \u00een metric\u0103 stabilim agregarea dup\u0103 num\u0103rul de loguri. \u00cen buckets punem Terms =&gt; action. <\/p>\n<p>Se pare c\u0103 totul este corect, dar valorile arat\u0103 pentru toate blade-urile, trebuie s\u0103 filtr\u0103m doar blade-urile care func\u021bioneaz\u0103 \u00een cadrul preven\u021biei amenin\u021b\u0103rilor. A\u0219adar, este esen\u021bial s\u0103 configur\u0103m <b>filtrul<\/b> pentru a c\u0103uta informa\u021bii doar pe blade-urile care r\u0103spund de incidentele de securitate cibernetic\u0103 \u2014 product: (\"Anti-Bot\" OR \"New Anti-Virus\" OR \"DDoS Protector\" OR \"SmartDefense\" OR \"Threat Emulation\"). Imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/te\/1p\/wo\/te1pwo7es8c1nnssm5tuhtdfxog.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/8ff2a225089922d8634f5c85ee7fc5fc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u0218i set\u0103rile mai detaliate, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/20\/yf\/xs\/20yfxs1tflzd3ja05bulm9s8pco.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/b747aa69a089862f91bd93c7868bacd3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Tabelul pentru evenimentele IPS<\/h3>\n<p>\nApoi, foarte important din perspectiva securit\u0103\u021bii cibernetice este vizualizarea \u0219i verificarea evenimentelor pe blade <b>IPS<\/b> \u0219i <b>Emularea Amenin\u021b\u0103rilor<\/b>, care <b>nu sunt blocate<\/b> de politica actual\u0103, pentru a putea ulterior fie s\u0103 trecem semn\u0103tura \u00een prevent, fie, dac\u0103 traficul este valid \u2014 s\u0103 nu verific\u0103m semn\u0103tura. Tabelul se creeaz\u0103 la fel ca \u00een primul exemplu, cu diferen\u021ba c\u0103 cre\u0103m mai multe coloane: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Este esen\u021bial s\u0103 configur\u0103m filtrul pentru a c\u0103uta informa\u021bii doar pe blade-urile care r\u0103spund de incidentele de securitate cibernetic\u0103 \u2014 product: (\"SmartDefense\" OR \"Threat Emulation\"). Imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/gu\/pt\/q_\/guptq_dmmsig3ueo2xoahhgh_ts.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/7f595da7aecf502249e8a804b5768680.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Set\u0103ri mai detaliate, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/7h\/va\/ma\/7hvamanbqtsl3vvkbk_r_wgpu4e.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/ecce5e34c3deac5089e9ba1471a92411.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Grafice despre cele mai populare site-uri vizitate<\/h3>\n<p>\nPentru aceasta, cre\u0103m o figur\u0103 \u2014 <b>Bar\u0103 vertical\u0103<\/b>. De asemenea, folosim metrica count (axa Y), iar pe axa X, ca valori, vom folosi denumirile site-urilor vizitate \u2014 \u201cappi_name\u201d. Aici exist\u0103 o mic\u0103 inginerie: dac\u0103 rul\u0103m set\u0103rile \u00een varianta actual\u0103, toate site-urile vor fi marcate pe grafic cu o singur\u0103 culoare. Pentru a le face colorate, folosim o setare suplimentar\u0103 \u2014 \u201csplit series\u201d, care permite \u00eemp\u0103r\u021birea coloanei deja existente \u00een mai multe valori, \u00een func\u021bie de c\u00e2mpul selectat, desigur! Aceasta \u00eemp\u0103r\u021bire poate fi utilizat\u0103 fie ca o coloan\u0103 colorat\u0103, \u00een modul stacked, fie \u00een modul normal, pentru a crea mai multe coloane pe baza unei valori de pe axa X. \u00cen acest caz, folosim aceea\u0219i valoare ca pe axa X, ceea ce permite colorarea tuturor coloanelor, iar \u00een partea dreapt\u0103 sus, acestea vor fi marcate cu culori. \u00cen filtrul stabilim \u2014 product:\u00abURL Filtering\u00bb pentru a vedea informa\u021bii doar despre site-urile vizitate, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/mm\/7z\/eu\/mm7zeuhxbi7mycsbe9iwhfvj-pi.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/07bb9944b86da2c3522a09d07f23fecd.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Set\u0103ri:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ab\/fq\/s8\/abfqs80dexym6ks4kt_ktyzzzzk.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/02acd7c1d18a1cdea25d5f4ec597001e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Grafic despre utilizarea celor mai periculoase aplica\u021bii<\/h3>\n<p>\nPentru aceasta, cre\u0103m o figur\u0103 \u2014 Bar\u0103 vertical\u0103. De asemenea, folosim metrica count (axa Y), iar pe axa X, ca valori, vom folosi denumirile aplica\u021biilor utilizate \u2014 \u201cappi_name\u201d. Cel mai important este s\u0103 stabilim filtrul \u2014 product: \u00abApplication Control\u00bb AND app_risk: (4 OR 5 OR 3) AND action:\u00abaccept\u00bb. Filtr\u0103m jurnalele pe blade-ul Application control, lu\u00e2nd doar acele site-uri care sunt catalogate ca av\u00e2nd risc Critic, Ridicat, Mediu, \u0219i doar \u00een cazul \u00een care accesul la aceste site-uri este permis. Imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/2q\/nz\/82\/2qnz82z39bhtf-eohfvqcfqae-0.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/623b5bf3188c2a0b09f89728fad59920.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Set\u0103ri, clicabil:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/pb\/aj\/6s\/pbaj6sk3l1qbc8cgluy4yiaj1qy.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/63239427de04abde90d28318cab11f3c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Tabloul de bord<\/h3>\n<p>\nVizualizarea \u0219i crearea tablourilor de bord se afl\u0103 \u00eentr-un punct de meniu separat \u2014 <b>Tabloul de bord<\/b>. Aici totul este simplu, se creeaz\u0103 un nou tablou de bord, \u00een care se adaug\u0103 vizualiz\u0103ri, se aranjeaz\u0103 \u0219i totul!<\/p>\n<p>Cre\u0103m un tablou de bord care va oferi o \u00een\u021belegere a st\u0103rii de baz\u0103 a securit\u0103\u021bii informa\u021biilor \u00een organiza\u021bie, bine\u00een\u021beles, doar la nivelul Check Point, imaginea este clicabil\u0103:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ct\/9p\/lv\/ct9plv4cwbpt6ammjhqmn6x76fe.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza jurnalelor de securitate. Dashboard-uri.\" src=\"\/wp-content\/uploads\/2019\/12\/8d70a875d9a718279189a2839c9182df.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Pe baza acestor grafice, putem \u00een\u021belege ce semn\u0103turi critice nu sunt blocate de firewall, unde navigheaz\u0103 utilizatorii, care sunt cele mai periculoase aplica\u021bii pe care le utilizeaz\u0103.<\/p>\n<h3>Concluzie<\/h3>\n<p>\nAm analizat posibilit\u0103\u021bile de vizualizare de baz\u0103 \u00een Kibana \u0219i am construit un tablou de bord, dar aceasta este doar o mic\u0103 parte. \u00cen continuare, \u00een curs, vom explora set\u0103rile hartelor, lucrul cu sistemul Elasticsearch, ne vom familiariza cu cererile API, automatizarea \u0219i multe altele!<\/p>\n<p>A\u0219adar, urm\u0103ri\u021bi actualiz\u0103rile (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blogul TS Solution<\/a><\/noindex>), <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/482054\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54536","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-27T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:02:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Elastic stack: analiza logurilor de securitate. Tablouri de bord | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54536","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/54536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=54536"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/54536\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=54536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=54536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=54536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}