{"id":54536,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/3-elastic-stack-analiz-security-logov-dashbordy"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"3-elastic-stack-analiz-security-logov-dashbordy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","title":{"rendered":"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/703e366b85e1c67018387e2f2a807f1b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0412 \u043f\u0440\u0435\u0434\u0448\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c ELK \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0430 \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u2014 \u043a \u0433\u0440\u0430\u0444\u0438\u043a\u0430\u043c \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0451\u043d\u043d\u044b\u043c \u0432 <b>\u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b<\/b>. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043f\u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 <b>Kibana<\/b>, \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b, \u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u043e\u0437\u0434\u0430\u0434\u0438\u043c \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0434\u0430\u0448\u0431\u043e\u0440\u0434 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043b\u043e\u0433\u043e\u0432 \u0441 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 Check Point.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n\u041f\u0435\u0440\u0432\u044b\u043c \u0448\u0430\u0433\u043e\u043c \u0440\u0430\u0431\u043e\u0442\u044b \u0441 Kibana \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 <b>index pattern<\/b>, \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438, \u044d\u0442\u043e \u0431\u0430\u0437\u0430 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0451\u043d\u043d\u044b\u0445 \u043f\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443. \u0415\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u044d\u0442\u043e \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430, \u0447\u0442\u043e\u0431\u044b Kibana \u043c\u043e\u0433\u043b\u0430 \u0443\u0434\u043e\u0431\u043d\u0435\u0435 \u0438\u0441\u043a\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e \u0432\u0441\u0435\u043c \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u043c \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e. \u041e\u043d\u0430 \u0437\u0430\u0434\u0430\u0451\u0442\u0441\u044f \u043f\u043e \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0441\u0442\u0440\u043e\u043a\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u201ccheckpoint-*\u201d \u0438 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0434\u0435\u043a\u0441\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u00abcheckpoint-2019.12.05\u00bb \u043f\u043e\u0434\u0445\u043e\u0434\u0438\u0442 \u043f\u043e\u0434 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0430 \u043f\u0440\u043e\u0441\u0442\u043e \u00abcheckpoint\u00bb \u0443\u0436\u0435 \u043d\u0435\u0442. \u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0438\u0441\u043a\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u043e \u0440\u0430\u0437\u043d\u044b\u043c \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u0430\u043c \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432 \u043f\u043e\u0438\u0441\u043a\u0435 \u043d\u0435\u043b\u044c\u0437\u044f. \u0427\u0443\u0442\u044c \u043f\u043e\u0437\u0436\u0435 \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u0443\u0432\u0438\u0434\u0438\u043c, \u0447\u0442\u043e API-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u043b\u0438\u0431\u043e \u043f\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044e \u0438\u043d\u0434\u0435\u043a\u0441\u0430, \u043b\u0438\u0431\u043e \u043f\u043e \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u0430, \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0430 \u043a\u043b\u0438\u043a\u0430\u0431\u0435\u043b\u044c\u043d\u0430:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/64\/nm\/tb\/64nmtbsfwl-qfysx5n6km6iwr3m.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/d84ad30d2ee921b7f76a8224cfad5029.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0432 \u043c\u0435\u043d\u044e Discover, \u0447\u0442\u043e \u0432\u0441\u0435 \u043b\u043e\u0433\u0438 \u0438\u043d\u0434\u0435\u043a\u0441\u0438\u0440\u0443\u044e\u0442\u0441\u044f, \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0440\u0441\u0435\u0440. \u0415\u0441\u043b\u0438 \u0431\u0443\u0434\u0443\u0442 \u043a\u0430\u043a\u0438\u0435-\u043b\u0438\u0431\u043e \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0442\u0438\u043f \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0441\u0442\u0440\u043e\u043a\u0438 \u043d\u0430 \u0446\u0435\u043b\u043e\u0435 \u0447\u0438\u0441\u043b\u043e, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b Logstash, \u0447\u0442\u043e\u0431\u044b \u043d\u043e\u0432\u044b\u0435 \u043b\u043e\u0433\u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e. \u0414\u043b\u044f \u0442\u043e\u0433\u043e \u0447\u0442\u043e\u0431\u044b \u0441\u0442\u0430\u0440\u044b\u0435 \u043b\u043e\u0433\u0438 \u043f\u0440\u0438\u043d\u044f\u043b\u0438 \u043d\u0443\u0436\u043d\u044b\u0439 \u0432\u0438\u0434 \u043f\u043e\u0441\u043b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0435\u0438\u043d\u0434\u0435\u043a\u0441\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d \u0431\u043e\u043b\u0435\u0435 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u043e \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445. \u0423\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0438\u043c\u0441\u044f, \u0447\u0442\u043e \u0432\u0441\u0435 \u0432 \u043f\u043e\u0440\u044f\u0434\u043a\u0435, \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0430 \u043a\u043b\u0438\u043a\u0430\u0431\u0435\u043b\u044c\u043d\u0430:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/y1\/-h\/jk\/y1-hjkcxrtdpuufzqxqdpqhlvha.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/c704b83f68de588b612a97cb92fa0433.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u041b\u043e\u0433\u0438 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u043c\u0435\u0441\u0442\u0435, \u0437\u043d\u0430\u0447\u0438\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u0442\u044c \u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044e \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432. \u041d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432 \u043e\u0442 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043d\u044f\u0442\u044c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0418\u0411 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043c\u0435\u0441\u0442\u0430 \u0432 \u0442\u0435\u043a\u0443\u0449\u0435\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u0438 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \u0421\u043e\u0437\u0434\u0430\u0434\u0438\u043c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0434\u0430\u0448\u0431\u043e\u0440\u0434, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u0414\u0430\u0448\u0431\u043e\u0440\u0434 \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0441\u0442\u043e\u044f\u0442\u044c \u0438\u0437 5 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432: <\/p>\n<ol>\n<li>\u0442\u0430\u0431\u043b\u0438\u0446\u0430 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0447\u0435\u0442\u0430 \u043e\u0431\u0449\u0435\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043b\u043e\u0433\u043e\u0432 \u043f\u043e \u0431\u043b\u0435\u0439\u0434\u0430\u043c<\/li>\n<li>\u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u043f\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u0430\u043c IPS<\/li>\n<li>\u043a\u0440\u0443\u0433\u043e\u0432\u0443\u044e \u0434\u0438\u0430\u0433\u0440\u0430\u043c\u043c\u0443 \u043f\u043e \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c Threat Prevention<\/li>\n<li>diagram o najbolj priljubljenih spletnih mestih<\/li>\n<li>diagram o uporabi najbolj nevarnih aplikacij<\/li>\n<\/ol>\n<p>\nZa ustvarjanje figur vizualizacije, pojdite v meni <b>Vizualiziraj<\/b>, in izberite \u017eeleno figuro, ki jo \u017eelite zgraditi! Pojdimo po vrsti.<\/p>\n<h3>Tabela za \u0161tetje skupnega \u0161tevila logov po blazbah<\/h3>\n<p>\nZa to izberite figuro <b>Podatkovna tabela<\/b>, pridite v orodje za ustvarjanje grafikonov, na levi se nastavi oblika, desno je, kako bo videti v trenutnih nastavitvah. Najprej bom pokazal, kako bo izgledala kon\u010dna tabela, potem pa bomo pre\u0161li na nastavitve, slika je klikljiva:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/h6\/qh\/zs\/h6qhzsfawr4qslqtdfybm3zvzsw.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/cd0d023ad12db5bbfe2dcc51823fb459.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Bolj podrobne nastavitve figure, slika je klikljiva:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/pe\/2j\/d2\/pe2jd28os3xkfs70wi9jl--0kcc.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/4e3ca27ef051e2ab86d5006c83b0ad98.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Preu\u010dimo nastavitve.<\/p>\n<p>Sprva se nastavi <b>\u043c\u0435\u0442\u0440\u0438\u043a\u0430<\/b>, to je vrednost, po kateri bodo agregirana vsa polja. Metri\u010dne vrednosti se izra\u010dunavajo na podlagi vrednosti, pridobljenih na razli\u010dne na\u010dine iz dokumentov. Vrednosti se obi\u010dajno pridobivajo iz <b>polj<\/b> dokumenta, lahko pa so tudi ustvarjene z uporabo skriptov. V tem primeru postavimo v <b>Agregacija: \u0160tevilo<\/b> (skupno \u0161tevilo logov).<\/p>\n<p>Potem delimo tabelo po segmentih (poljih), po katerih bo \u0161tela metriko. To funkcijo izvaja nastavitev Buckets, ki sama po sebi vsebuje 2 razli\u010dici nastavitev: <\/p>\n<ol>\n<li>split rows \u2014 dodajanje stolpcev in kasneje delitev tabele na vrstice<\/li>\n<li>split table \u2014 delitev na ve\u010d tabel po vrednostih dolo\u010denega polja. <\/li>\n<\/ol>\n<p>\nV <b>buckets<\/b> lahko dodate ve\u010d delitev za ustvarjanje ve\u010d stolpcev ali tabel, omejitve so tukaj bolj logi\u010dne. V agregaciji lahko izberete, kako bo potekalo deljenje na segmente: ipv4 range, date range, Terms itd. Najbolj zanimiva izbira je prav <b>Terms<\/b> in <b>Significant Terms<\/b>, delitev na segmente se izvede po vrednostih dolo\u010denega polja indeksa, razlika med njimi pa je v \u0161tevilu vrnjenih vrednosti in njihovi predstavitvi. Ker \u017eelimo deliti tabelo po imenu blazb, izbiramo polje \u2014 <b>product.keyword<\/b> in nastavimo velikost na 25 vrnjenih vrednosti. <\/p>\n<p>Namesto vrstic v elasticsearch so uporabljeni 2 tipi podatkov \u2014 <b>text<\/b> in <b>keyword<\/b>. \u010ce \u017eelite izvesti polno besedilno iskanje, morate uporabiti tip text, kar je zelo priro\u010dno pri pisanju va\u0161e iskalne storitve, na primer, ko i\u0161\u010dete omembo besede v specifi\u010dnem pomenu polja (besedilu). \u010ce \u017eelite le natan\u010dno ujemanje, morate uporabiti tip keyword. Tudi tip podatkov keyword je treba uporabiti za polja, ki zahtevajo razvr\u0161\u010danje ali agregacijo, torej v na\u0161em primeru.<\/p>\n<p>Zaradi tega Elasticsearch \u0161teje \u0161tevilo dnevnikov v dolo\u010denem \u010dasu z agregacijo po vrednosti v polju product. V Custom Label dolo\u010dimo ime stolpca, ki se bo prikazoval v tabeli, dolo\u010dimo \u010das, za katerega zbiramo dnevnike, za\u017eenemo vizualizacijo \u2014 Kibana po\u0161lje poizvedbo v Elasticsearch, \u010daka na odgovor in nato vizualizira pridobljene podatke. Tabela je pripravljena!<\/p>\n<h3>Kro\u017ena diagram o dogodkih Threat Prevention<\/h3>\n<p>\nZanimiva je informacija, koliko odstotek vsega je reakcij <b>detect<\/b> in <b>prevent<\/b> na incidente IB v trenutni varnostni politiki. Za tak primer je kro\u017ena diagram zelo primeren. Izberemo v Visualize \u2014 <b>Pie chart<\/b>. V metrikah dolo\u010dimo agregacijo po \u0161tevilu dnevnikov. V buckets postavimo Terms =&gt; action. <\/p>\n<p>Zdi se, da je vse prav, vendar se prika\u017eejo vrednosti za vse blade, zato je treba filtrirati samo tiste blade, ki delujejo v okviru Threat Prevention. Zato nujno nastavimo <b>filtr<\/b> da bi iskali informacije samo po bladeh, ki odgovarjajo za incidente IB \u2014 product: (\"Anti-Bot\" OR \"New Anti-Virus\" OR \"DDoS Protector\" OR \"SmartDefense\" OR \"Threat Emulation\"). Slika je klikabilna:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/te\/1p\/wo\/te1pwo7es8c1nnssm5tuhtdfxog.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/8ff2a225089922d8634f5c85ee7fc5fc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>In bolj podrobne nastavitve, slika je klikabilna:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/20\/yf\/xs\/20yfxs1tflzd3ja05bulm9s8pco.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/b747aa69a089862f91bd93c7868bacd3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Tabela o dogodkih IPS<\/h3>\n<p>\nNaslednji zelo pomemben vidik z vidika IB je pregled in preverjanje dogodkov po bladeh <b>IPS<\/b> in <b>Emulacija gro\u017eenj<\/b>, ki <b>ne blokirajo<\/b> trenutne politike, da bi v nadaljevanju bodisi prenesli podpis v prevent bodisi, \u010de je promet veljaven \u2014 ne preverjati podpisa. Tabelo ustvarimo prav tako, kot v prvem primeru, le z razliko, da ustvarimo ve\u010d stolpcev: protections.keyword, severity.keyword, product.keyword, originsicname.keyword. Obvezno nastavimo filtr, da i\u0161\u010demo informacije samo po bladeh, ki odgovarjajo za incidente IB \u2014 product: (\"SmartDefense\" OR \"Threat Emulation\"). Slika je klikabilna:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/gu\/pt\/q_\/guptq_dmmsig3ueo2xoahhgh_ts.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/7f595da7aecf502249e8a804b5768680.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Bolj podrobne nastavitve, slika je klikabilna:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/7h\/va\/ma\/7hvamanbqtsl3vvkbk_r_wgpu4e.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/ecce5e34c3deac5089e9ba1471a92411.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Diagrams po najbolj priljubljenih obiskanih spletnih straneh<\/h3>\n<p>\nZa to ustvarimo obliko \u2014 <b>Vertical Bar<\/b>. Metrijo prav tako uporabljamo count (os Y), na osi X pa kot vrednosti uporabljamo imena obiskanih spletnih strani \u2014 \u201cappi_name\u201d. Tu je majhna prevara; \u010de poskusimo nastaviti s trenutnim sistemom, bodo vse spletne strani ozna\u010dene z eno barvo na grafu, da jih naredimo razli\u010dne barvne, uporabimo dodatno nastavitev \u2014 \u201csplit series\u201d, ki omogo\u010da razdelitev \u017ee pripravljenega stolpca na ve\u010d vrednosti, seveda odvisno od izbranega polja! To razdelitev lahko uporabimo bodisi kot en barvni stolpec v na\u010dinu stacked, bodisi v normalnem na\u010dinu za ustvarjanje ve\u010d stolpcev po dolo\u010deni vrednosti na osi X. V tem primeru tukaj uporabljamo isto vrednost kot na osi X, kar omogo\u010da, da so vsi stolpci razli\u010dni barvni, desno zgoraj bodo ozna\u010deni z barvami. V filtru nastavimo \u2014 product:\u00abURL Filtering\u00bb za prikaz informacij samo o obiskanih spletnih straneh, slika je klikabilna:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/mm\/7z\/eu\/mm7zeuhxbi7mycsbe9iwhfvj-pi.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/07bb9944b86da2c3522a09d07f23fecd.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Nastavitve:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ab\/fq\/s8\/abfqs80dexym6ks4kt_ktyzzzzk.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/02acd7c1d18a1cdea25d5f4ec597001e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Diagram o uporabi najbolj nevarnih aplikacij<\/h3>\n<p>\nZa to ustvarimo obliko \u2014 Vertical Bar. Metrijo prav tako uporabljamo count (os Y), na osi X pa kot vrednosti uporabljamo imena uporabljenih aplikacij \u2014 \u201cappi_name\u201d. Najpomembnej\u0161e je dolo\u010ditev filtra \u2014 product: \u00abApplication Control\u00bb AND app_risk: (4 OR 5 OR 3) AND action:\u00abaccept\u00bb. Filtriramo dnevnike po bladu Application control, vzamemo samo tista spletna mesta, ki so kategorizirana kot spletne strani z rizikom Critical, High, Medium in le v primeru, \u010de je dostop do teh spletnih strani dovoljen. Slika je klikabilna:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/2q\/nz\/82\/2qnz82z39bhtf-eohfvqcfqae-0.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/623b5bf3188c2a0b09f89728fad59920.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Nastavitve, klikabilno:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/pb\/aj\/6s\/pbaj6sk3l1qbc8cgluy4yiaj1qy.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/63239427de04abde90d28318cab11f3c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Nadzorna plo\u0161\u010da<\/h3>\n<p>\nOgled in ustvarjanje nadzornih plo\u0161\u010d je v lo\u010denem meniju \u2014 <b>Nadzorna plo\u0161\u010da<\/b>. Tukaj je vse preprosto, ustvarimo novo nadzorno plo\u0161\u010do, dodamo vizualizacijo, postavimo jo na mesta in vse!<\/p>\n<p>Ustvarimo nadzorno plo\u0161\u010do, s katero bomo lahko razumeli osnovno stanje informacijske varnosti v organizaciji, jasno, samo na ravni Check Point, slika je klikabilna:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ct\/9p\/lv\/ct9plv4cwbpt6ammjhqmn6x76fe.png\"><img decoding=\"async\" alt=\"3. Elastic stack: analiza varnostnih logov. Plo\u0161\u010de\" src=\"\/wp-content\/uploads\/2019\/12\/8d70a875d9a718279189a2839c9182df.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Na podlagi teh grafikonov lahko razumemo, katere kriti\u010dne signature niso blokirane na po\u017earnem zidu, kam gredo uporabniki in katere najbolj nevarne aplikacije uporabljajo.<\/p>\n<h3>Zaklju\u010dek<\/h3>\n<p>\nProu\u010dili smo osnovne mogu\u0107nosti vizualizacije u Kibani i izradili nadzornu plo\u010du, no to je tek mali deo. U nastavku kursa fokusira\u0107emo se na pode\u0161avanje mapa, rad sa Elasticsearch sistemom, upozna\u0107emo se sa API upitima, automatizacijom i jo\u0161 mnogo toga!<\/p>\n<p>Zato spremljajte novosti (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>), <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>.<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/482054\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0441\u0442\u0430\u0442\u044c\u044f\u0445 \u043c\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c elk \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Logstash \u0434\u043b\u044f \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043b\u043e\u0433\u043e\u0432, \u0432 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0441\u0430\u043c\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u043e\u043c\u0443 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438, \u0442\u043e \u0447\u0442\u043e \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0440\u0430\u0434\u0438 \u0447\u0435\u0433\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u043e\u0441\u044c \u2014 \u044d\u0442\u043e \u0433\u0440\u0430\u0444\u0438\u043a\u0438 \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u044b\u0435 \u0432 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0431\u043b\u0438\u0436\u0435 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043c\u0441\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54536","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-27T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:02:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Elastic stack: analiza sigurnosnih logova. Nadzorne plo\u010de | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Elastic stack: \u0430\u043d\u0430\u043b\u0438\u0437 security \u043b\u043e\u0433\u043e\u0432. \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/3-elastic-stack-analiz-security-logov-dashbordy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54536","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/54536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=54536"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/54536\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=54536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=54536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=54536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}