{"id":54536,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-elastic-stack-analiz-security-logov-dashbordy"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"3-elastic-stack-analiz-security-logov-dashbordy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","title":{"rendered":"3. Elastic stack: anal\u00fdza bezpe\u010dnostn\u00fdch logov. Dashboardy","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"3.
\n
\nV predch\u00e1dzaj\u00facich \u010dl\u00e1nkoch sme sa trocha obozn\u00e1mili s ELK stackom a nastaven\u00edm konfigura\u010dn\u00e9ho s\u00faboru Logstash pre parsovanie logov. V tomto \u010dl\u00e1nku prejdeme k najd\u00f4le\u017eitej\u0161iemu z h\u013eadiska analytiky, k tomu, \u010do chcete vidie\u0165 od syst\u00e9mu a pre\u010do to v\u0161etko bolo vytvoren\u00e9 \u2014 k grafom a tabu\u013ek\u00e1m zl\u00fa\u010den\u00fdm v palubn\u00fdch dosk\u00e1ch<\/b>. Dnes sa podrobnej\u0161ie obozn\u00e1mime so syst\u00e9mom vizualiz\u00e1cie Kibana<\/b>, presk\u00famame, ako vytv\u00e1ra\u0165 grafy a tabu\u013eky a na z\u00e1ver postav\u00edme jednoduch\u00fa palubn\u00fa dosku na z\u00e1klade logov z firewalla Check Point.
\n<\/a><\/noindex>
\nPrv\u00fdm krokom pri pr\u00e1ci s Kibana je vytvorenie index pattern<\/b>, logicky to je z\u00e1klad\u0148a indexov zjednoten\u00fdch pod\u013ea ur\u010dit\u00e9ho princ\u00edpu. Samozrejme, toto je len nastavenie, aby Kibana pohodlnej\u0161ie h\u013eadala inform\u00e1cie vo v\u0161etk\u00fdch indexoch naraz. Definuje sa pod\u013ea zhodovania re\u0165azca, napr\u00edklad \u201echeckpoint-*\u201c a n\u00e1zvu indexu. Napr\u00edklad \u201echeckpoint-2019.12.05\u201c vyhovuje vzoru, ale jednoducho \u201echeckpoint\u201c u\u017e nie. Osobitne stoj\u00ed za zmienku, \u017ee v niektor\u00fdch vyh\u013ead\u00e1vaniach nie je mo\u017en\u00e9 h\u013eada\u0165 inform\u00e1cie pod\u013ea r\u00f4znych vzorov indexov naraz, nesk\u00f4r v nasleduj\u00facich \u010dl\u00e1nkoch uvid\u00edme, \u017ee API po\u017eiadavky sa uskuto\u010d\u0148uj\u00fa bu\u010f pod\u013ea n\u00e1zvu indexu, alebo pod\u013ea jedn\u00e9ho vzoru, obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

Potom skontrolujeme v menu Discover, \u010di s\u00fa v\u0161etky logy indexovan\u00e9 a \u010di je nastaven\u00fd spr\u00e1vny parser. Ak sa objavia ak\u00e9ko\u013evek nezrovnalosti, napr\u00edklad zmeni\u0165 typ d\u00e1t z re\u0165azca na cel\u00e9 \u010d\u00edslo, je potrebn\u00e9 upravi\u0165 konfigura\u010dn\u00fd s\u00fabor Logstash, a tak nov\u00e9 logy bud\u00fa zapisovan\u00e9 spr\u00e1vne. Pre to, aby star\u00e9 logy pred zmenou prijali potrebn\u00fd form\u00e1t, pom\u00e1ha len proces reindex\u00e1cie, v nasleduj\u00facich \u010dl\u00e1nkoch sa t\u00e1to oper\u00e1cia podrobne presk\u00fama. Uist\u00edme sa, \u017ee v\u0161etko je v poriadku, obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

Logy sa ocitli na spr\u00e1vnom mieste, tak\u017ee m\u00f4\u017eeme za\u010da\u0165 s vytv\u00e1ran\u00edm palubn\u00fdch dosiek. Na z\u00e1klade analytiky palubn\u00fdch dosiek od produktov security je mo\u017en\u00e9 pochopi\u0165 stav IKT v organiz\u00e1cii, jasne vidie\u0165 zranite\u013en\u00e9 miesta v aktu\u00e1lnej politike a n\u00e1sledne vypracova\u0165 sp\u00f4soby ich odstr\u00e1nenia. Postav\u00edme mal\u00fa palubn\u00fa dosku pomocou nieko\u013ek\u00fdch vizualiza\u010dn\u00fdch n\u00e1strojov. Palubn\u00e1 doska bude pozost\u00e1va\u0165 z 5 komponentov: <\/p>\n

    \n
  1. tabu\u013eka pre v\u00fdpo\u010det celkov\u00e9ho po\u010dtu logov pod\u013ea b\u043b\u0435\u0439dov<\/li>\n
  2. tabu\u013eku pre kritick\u00e9 signat\u00fary IPS<\/li>\n
  3. kol\u00e1\u010dov\u00e9ho grafu pre udalosti Threat Prevention<\/li>\n
  4. diagram pod\u013ea najpopul\u00e1rnej\u0161\u00edch nav\u0161tevovan\u00fdch str\u00e1nok<\/li>\n
  5. diagram pou\u017eitia najnebezpe\u010dnej\u0161\u00edch aplik\u00e1ci\u00ed<\/li>\n<\/ol>\n

    \nNa vytvorenie figur\u00e1ci\u00ed vizualiz\u00e1cie, treba prejs\u0165 do menu Vizualizova\u0165<\/b>, a vybra\u0165 po\u017eadovan\u00fa fig\u00faru, ktor\u00fa chceme vytvori\u0165! Postupujme krok po kroku.<\/p>\n

    Tabu\u013eka na v\u00fdpo\u010det celkov\u00e9ho po\u010dtu logov pod\u013ea bleydov<\/h3>\n

    \nPre to vyberieme fig\u00faru Tabu\u013eka \u00fadajov<\/b>, ponor\u00edme sa do n\u00e1stroja na vytv\u00e1ranie grafov, v\u013eavo sa upravuj\u00fa nastavenia fig\u00fary, vpravo to, ako bude vyzera\u0165 pri aktu\u00e1lnych nastaveniach. Najprv uk\u00e1\u017eem, ako bude vyzera\u0165 hotov\u00e1 tabu\u013eka, po tom prejdeme nastaveniami, obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Podrobnej\u0161ie nastavenia fig\u00fary, obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

    \"3.<\/a><\/noindex><\/p>\n

    Rozoberieme nastavenia.<\/p>\n

    Najprv sa nastavuje metrika<\/b>, toto je hodnota, pod\u013ea ktorej sa bud\u00fa agregova\u0165 v\u0161etky polia. Met\u00f3dy sa po\u010d\u00edtaj\u00fa na z\u00e1klade hodn\u00f4t, extrahovan\u00fdch r\u00f4znymi sp\u00f4sobmi z dokumentov. Hodnoty sa zvy\u010dajne extrahuj\u00fa z pol\u00ed<\/b> dokumentu, ale m\u00f4\u017eu by\u0165 aj generovan\u00e9 pomocou skriptov. V tomto pr\u00edpade nastav\u00edme v Agreg\u00e1cia: Po\u010det<\/b> (celkov\u00fd po\u010det logov).<\/p>\n

    Potom rozdel\u00edme tabu\u013eku pod\u013ea segmentov (pol\u00ed), na z\u00e1klade ktor\u00fdch sa bude po\u010d\u00edta\u0165 metrika. T\u00fato funkciu vykon\u00e1va nastavenie Buckets, ktor\u00e9 sa skladaj\u00fa z dvoch variantov nastavenia: <\/p>\n

      \n
    1. split rows \u2014 pridanie st\u013apcov a n\u00e1sledn\u00e9 delenie tabu\u013eky na riadky<\/li>\n
    2. split table \u2014 delenie na nieko\u013eko tabuliek pod\u013ea hodn\u00f4t ur\u010dit\u00e9ho po\u013ea. <\/li>\n<\/ol>\n

      \nV buckets<\/b> m\u00f4\u017ee sa prida\u0165 nieko\u013eko delen\u00ed na vytvorenie viacer\u00fdch st\u013apcov alebo tabuliek, obmedzenia s\u00fa sk\u00f4r logick\u00e9. V agreg\u00e1cii si m\u00f4\u017eete vybra\u0165, ak\u00fdm sp\u00f4sobom sa bude robi\u0165 delenie na segmenty: ipv4 range, date range, Terms at\u010f. Najzauj\u00edmavej\u0161ou vo\u013ebou je pr\u00e1ve Terms<\/b> a Significant Terms<\/b>, delenie na segmenty sa vykon\u00e1va pod\u013ea hodn\u00f4t ur\u010dit\u00e9ho po\u013ea indexu, rozdiel medzi nimi spo\u010d\u00edva v po\u010dte vracan\u00fdch hodn\u00f4t a ich zobrazen\u00ed. Ke\u010f\u017ee chceme rozdeli\u0165 tabu\u013eku pod\u013ea n\u00e1zvu bleydov, vyber\u00e1me pole \u2014 product.keyword<\/b> a nastav\u00edme ve\u013ekos\u0165 na 25 vracan\u00fdch hodn\u00f4t. <\/p>\n

      Namiesto riadkov v elasticsearch sa pou\u017e\u00edvaj\u00fa 2 typy \u00fadajov \u2014 text<\/b> a keyword<\/b>. Ak chcete vykona\u0165 fulltextov\u00e9 vyh\u013ead\u00e1vanie, mus\u00edte pou\u017ei\u0165 typ text, \u010do je ve\u013emi u\u017eito\u010dn\u00e9 pri p\u00edsan\u00ed v\u00e1\u0161ho vyh\u013ead\u00e1vacieho servisu, napr\u00edklad h\u013ead\u00e1te spom\u00ednanie slova v konkr\u00e9tnom v\u00fdzname po\u013ea (texte). Ak chcete iba presn\u00fa zhodu, mus\u00edte pou\u017ei\u0165 typ keyword. Tento typ d\u00e1t keyword by sa mal taktie\u017e pou\u017e\u00edva\u0165 pre polia, ktor\u00e9 vy\u017eaduj\u00fa triedenie alebo agreg\u00e1ciu, teda v na\u0161om pr\u00edpade.<\/p>\n

      V\u00fdsledkom je, \u017ee Elasticsearch po\u010d\u00edta po\u010det logov za ur\u010den\u00fd \u010das s agregovan\u00edm pod\u013ea hodnoty v poli product. V Custom Label zad\u00e1me n\u00e1zov st\u013apca, ktor\u00fd sa zobraz\u00ed v tabu\u013eke, zad\u00e1me \u010das, za ktor\u00fd zbierame logy, spust\u00edme vykres\u013eovanie \u2014 Kibana odo\u0161le po\u017eiadavku do Elasticsearch, \u010dak\u00e1 na odpove\u010f a potom vizualizuje z\u00edskan\u00e9 d\u00e1ta. Tabu\u013eka je pripraven\u00e1!<\/p>\n

      Kol\u00e1\u010dov\u00fd graf udalost\u00ed Threat Prevention<\/h3>\n

      \nUr\u010dit\u00fd z\u00e1ujem predstavuje inform\u00e1cia, ak\u00fd je vlastne percentu\u00e1lny pomer reakci\u00ed. detect<\/b> a prevent<\/b> na incidenty IB v aktu\u00e1lnej bezpe\u010dnostnej politike. Pre tak\u00fato situ\u00e1ciu je dobre zvolen\u00fd kol\u00e1\u010dov\u00fd graf. Vyber\u00e1me v Visualize \u2014 Pie chart<\/b>. Taktie\u017e v metrike nastavujeme agreg\u00e1ciu pod\u013ea po\u010dtu logov. V buckets nastavujeme Terms => action. <\/p>\n

      Vyzer\u00e1 to v\u0161etko spr\u00e1vne, ale v\u00fdsledkom s\u00fa hodnoty zo v\u0161etk\u00fdch bleydov, je potrebn\u00e9 filtrova\u0165 iba tie bleydy, ktor\u00e9 funguj\u00fa v r\u00e1mci Threat Prevention. Preto nutne nastav\u00edme filter<\/b> na to, aby sme vyh\u013ead\u00e1vali inform\u00e1cie iba pod\u013ea bleydov zodpovedaj\u00facich za incidenty IB \u2014 product: (\"Anti-Bot\" OR \"New Anti-Virus\" OR \"DDoS Protector\" OR \"SmartDefense\" OR \"Threat Emulation\"). Obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      A viac podrobn\u00fdch nastaven\u00ed, obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Tabu\u013eka pod\u013ea udalost\u00ed IPS<\/h3>\n

      \n\u010ealej je ve\u013emi d\u00f4le\u017eit\u00e9 z poh\u013eadu IB preh\u013ead\u00e1va\u0165 a kontrolova\u0165 udalosti pod\u013ea bleydov IPS<\/b> a Emul\u00e1cia hrozieb<\/b>, ktor\u00e9 nie s\u00fa blokovan\u00e9<\/b> aktu\u00e1lnou politikou, aby sme n\u00e1sledne bu\u010f previedli signat\u00faru do prevent alebo ak je traffic validn\u00fd \u2014 nekontrolova\u0165 signat\u00faru. Tabu\u013eku vytv\u00e1rame rovnako ako pri prvom pr\u00edklade, len s t\u00fdm rozdielom, \u017ee vytv\u00e1rame nieko\u013eko st\u013apcov: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Nezabudnite nastavi\u0165 filter, aby sme inteligentne vyh\u013ead\u00e1vali inform\u00e1cie iba pod\u013ea bleydov zodpovedaj\u00facich za incidenty IB \u2014 product: (\"SmartDefense\" OR \"Threat Emulation\"). Obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Viac podrobn\u00fdch nastaven\u00ed, obr\u00e1zok je klikate\u013en\u00fd:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Grafy najpopul\u00e1rnej\u0161\u00edch nav\u0161tevovan\u00fdch str\u00e1nok<\/h3>\n

      \nNa to vytvor\u00edme tvar \u2014 Vertik\u00e1lny st\u013apec<\/b>. Metiku tie\u017e pou\u017eijeme count (osa Y), a na osi X ako hodnoty pou\u017eijeme n\u00e1zov nav\u0161t\u00edven\u00fdch str\u00e1nok \u2014 \u201cappi_name\u201d. Je tu mal\u00fd trik, ak spust\u00edme nastavenia v aktu\u00e1lnej forme, v\u0161etky str\u00e1nky bud\u00fa na grafe ozna\u010den\u00e9 jednou farbou, preto aby sme ich spravili viacfarebn\u00fdmi, pou\u017eijeme dodato\u010dn\u00e9 nastavenie \u2014 \u201csplit series\u201d, ktor\u00e9 umo\u017e\u0148uje rozdeli\u0165 u\u017e pripraven\u00fd st\u013apec na nieko\u013eko \u010fal\u0161\u00edch hodn\u00f4t, v z\u00e1vislosti od vybran\u00e9ho po\u013ea samozrejme! Toto delenie m\u00f4\u017eeme bu\u010f pou\u017ei\u0165 ako jeden viacfarebn\u00fd st\u013apec pod\u013ea hodn\u00f4t v re\u017eime stacked, alebo v norm\u00e1lnom re\u017eime na vytvorenie nieko\u013ek\u00fdch st\u013apcov pod\u013ea ur\u010denej hodnoty na osi X. V tomto pr\u00edpade tu pou\u017e\u00edvame to ist\u00e9 hodnotenie, \u010do aj na osi X, to umo\u017e\u0148uje urobi\u0165 v\u0161etky st\u013apce viacfarebn\u00fdmi, vpravo hore bud\u00fa ozna\u010den\u00e9 farbami. Vo filtre nastavujeme \u2014 product:\u00abURL Filtering\u00bb, aby sme videli inform\u00e1cie iba o nav\u0161t\u00edven\u00fdch str\u00e1nkach, obr\u00e1zok je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Nastavenia:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Graf o vyu\u017e\u00edvan\u00ed najnebezpe\u010dnej\u0161\u00edch aplik\u00e1ci\u00ed<\/h3>\n

      \nNa to vytvor\u00edme tvar \u2014 Vertik\u00e1lny st\u013apec. Metiku tie\u017e pou\u017eijeme count (osa Y), a na osi X ako hodnoty pou\u017eijeme n\u00e1zov pou\u017e\u00edvan\u00fdch aplik\u00e1ci\u00ed - \u201cappi_name\u201d. Najd\u00f4le\u017eitej\u0161\u00edm je nastavenie filtra \u2014 product: \u00abApplication Control\u00bb AND app_risk: (4 OR 5 OR 3) AND action:\u00abaccept\u00bb. Filtrova\u0165 logy pod\u013ea bl\u00e1du Application control, berieme iba tie str\u00e1nky, ktor\u00e9 s\u00fa kategorizovan\u00e9 ako str\u00e1nky s rizikom Kritick\u00e9, Vysok\u00e9, Stredn\u00e9 a iba v tom pr\u00edpade, ak je na tieto str\u00e1nky povolen\u00fd pr\u00edstup. Obr\u00e1zok je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Nastavenia, klikate\u013en\u00e9:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Dashboard<\/h3>\n

      \nPreh\u013ead a vytv\u00e1ranie dashboardov sa nach\u00e1dza v samostatnej \u010dasti menu \u2014 Dashboard<\/b>. Tu je v\u0161etko jednoduch\u00e9, vytvor\u00ed sa nov\u00fd dashboard, prid\u00e1 sa vizualiz\u00e1cia, rozmiestni sa a hotovo!<\/p>\n

      Vytv\u00e1rame dashboard, pod\u013ea ktor\u00e9ho budeme schopn\u00ed pochopi\u0165 z\u00e1kladn\u00fa situ\u00e1ciu stavu IB v organiz\u00e1cii, jasne, iba na \u00farovni Check Point, obr\u00e1zok je klikac\u00ed:<\/p>\n

      \"3.<\/a><\/noindex><\/p>\n

      Na z\u00e1klade t\u00fdchto grafov m\u00f4\u017eeme pochopi\u0165, ktor\u00e9 kritick\u00e9 signat\u00fary nie s\u00fa blokovan\u00e9 na firewalle, kam chodia pou\u017e\u00edvatelia a ktor\u00e9 najnebezpe\u010dnej\u0161ie aplik\u00e1cie pou\u017e\u00edvaj\u00fa.<\/p>\n

      Z\u00e1ver<\/h3>\n

      \nPresk\u00famali sme mo\u017enosti z\u00e1kladnej vizualiz\u00e1cie v Kibana a vytvorili sme dashboard, no to je len mal\u00e1 \u010das\u0165. \u010ealej v kurze sa osobitne zameriame na nastavenie m\u00e1p, pr\u00e1cu so syst\u00e9mom Elasticsearch, obozn\u00e1mime sa s API po\u017eiadavkami, automatiz\u00e1ciou a mnoh\u00fdmi \u010fal\u0161\u00edmi vecami!<\/p>\n

      Tak sa dr\u017ete aktualiz\u00e1ci\u00ed (Telegram<\/a><\/noindex>, Facebook<\/a><\/noindex>, VK<\/a><\/noindex>, Blog TS Solution<\/a><\/noindex>), Yandex.Zen<\/a><\/noindex>.
      \n
      Zdroj:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54536","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Elastic stack: anal\u00fdza bezpe\u010dnostn\u00fdch logov. Dashboardy | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54536","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/54536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=54536"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/54536\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=54536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=54536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=54536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}