Lihloohong tse fetileng, re ile ra tloaelana hanyenyane le "elk stack" 'me ra theha faele ea tlhophiso ea Logstash bakeng sa mohlahlobi oa log. bona ho tloha tsamaisong le hore na ntho e 'ngoe le e' ngoe e etselitsoe eng - tsena ke li-graph le litafole tse kopantsoeng li-dashboard. Kajeno re tla shebisisa tsamaiso ea pono Kibana, re tla sheba mokhoa oa ho etsa li-graph le litafole, 'me ka lebaka leo re tla haha dashboard e bonolo e thehiloeng ho li-logs tse tsoang ho Check Point firewall.
Mohato oa pele oa ho sebetsa le kibana ke ho bopa mohlala oa index, ka ho utloahalang, ona ke motheo oa li-index tse kopantsoeng ho latela molao-motheo o itseng. Ehlile, ena ke tlhophiso feela ea ho etsa hore Kibana a batle tlhahisoleseling ho li-index tsohle ka nako e le 'ngoe. E behiloe ka ho bapisa khoele, e re "checkpoint-*" le lebitso la index. Mohlala, "checkpoint-2019.12.05" e ne e tla lekana mohlala, empa "checkpoint" ha e sa le teng. Ho bohlokoa ho bolela ka thoko hore ha ho batloa ha ho khonehe ho batla tlhahisoleseling mabapi le lipaterone tse fapaneng tsa index ka nako e le 'ngoe; nakoana hamorao lingoloeng tse latelang re tla bona hore likopo tsa API li etsoa ka lebitso la index, kapa ke e le 'ngoe feela. mola oa paterone, setšoantšo se ka tobeha:
Ka mor'a sena, re sheba ho menu ea Discover hore li-log tsohle li ngotsoe 'me sekhetho se nepahetseng se lokiselitsoe. Haeba ho na le ho se lumellane ho itseng ho fumanoa, ka mohlala, ho fetola mofuta oa data ho tloha khoele ho ea ho palo e feletseng, u lokela ho fetola faele ea tlhophiso ea Logstash, ka lebaka leo, li-logs tse ncha li tla ngoloa ka nepo. E le hore li-logs tsa khale li nke mokhoa o lakatsehang pele ho phetoho, ke mokhoa oa reindexing feela o thusang; lihloohong tse latelang ts'ebetso ena e tla tšohloa ka ho qaqileng haholoanyane. Ha re etse bonnete ba hore ntho e 'ngoe le e' ngoe e hlophisitsoe hantle, setšoantšo se ka tobetsa:
Li-log li teng, ho bolelang hore re ka qala ho aha li-dashboards. Ho ipapisitsoe le li-analytics tsa li-dashboard tse tsoang lihlahisoa tsa ts'ireletso, u ka utloisisa boemo ba ts'ireletso ea tlhahisoleseling mokhatlong, ho bona ka ho hlaka bofokoli leanong la hajoale, 'me ka mor'a moo u ntlafatse litsela tsa ho li felisa. Ha re aheng dashboard e nyane re sebelisa lisebelisoa tse 'maloa tsa pono. Dashboard e tla ba le likarolo tse 5:
- tafole bakeng sa ho bala palo yohle ya dikutu ka mahare
- tafole holim'a li-signature tsa bohlokoa tsa IPS
- chate ea phae bakeng sa liketsahalo tsa Thibelo ea Tšokelo
- chate ea libaka tse tsebahalang haholo tse eteloang
- chate e mabapi le tshebediso ya ditiriso tse kotsi ka ho fetisisa
Ho theha lipalo tsa pono, o hloka ho ea ho menu Sheba pono, 'me u khethe setšoantšo se lakatsehang seo re batlang ho se haha! Ha re tsamayeng ka tatellano.
Lethathamo la ho bala palo eohle ea likutu ka lehare
Ho etsa sena, khetha setšoantšo Tafole ea Boitsebiso, re oela ka har'a lisebelisoa tsa ho etsa li-graph, ka ho le letšehali ke litlhophiso tsa setšoantšo, ka ho le letona ke kamoo e tla shebahala kateng maemong a hona joale. Taba ea pele, ke tla bonts'a hore na tafole e felileng e tla shebahala joang, ka mor'a moo re tla feta litlhophisong, setšoantšo se ka tobeha:
Litlhophiso tse qaqileng haholoanyane tsa setšoantšo, setšoantšo se ka tobetsa:
Ha re shebeng litlhophiso.
E hlophisitsoe qalong metrics, bona ke boleng boo ka bona masimo ohle a tla kopanngoa. Metrics e baloa ho ipapisitsoe le boleng bo ntšitsoeng ka tsela e 'ngoe ho tsoa litokomaneng. Litekanyetso hangata li ntšoa ho masimo tokomane, empa hape e ka hlahisoa ho sebelisoa mangolo. Tabeng ena re kenya Aggregation: Bala (kakaretso ea palo ea lifate).
Ka mor'a sena, re arola tafole ka likarolo (masimo) ao metric e tla baloa ka eona. Ts'ebetso ena e etsoa ke litlhophiso tsa Li-Buckets, tseo le tsona li nang le likhetho tse peli tsa li-setting:
- arola mela - ho eketsa litšiea ebe ka mor'a moo ho arola tafole ka mela
- tafole e arohaneng - karohano ka litafole tse 'maloa ho latela boleng ba sebaka se itseng.
В Linkho o ka eketsa likarohano tse 'maloa ho theha litšiea tse' maloa kapa litafole, lithibelo mona li na le mabaka a utloahalang. Ka ho kopanya, o ka khetha mokhoa o tla sebelisoa ho arola likarolo: ipv4 range, date range, Terms, joalo-joalo. Khetho e thahasellisang ka ho fetisisa e nepahetse Terms и Melao ea bohlokoa, karohano ka likarolo e etsoa ho ea ka boleng ba karolo e itseng ea index, phapang pakeng tsa bona e ka palo ea litekanyetso tse khutliselitsoeng, le pontšo ea bona. Kaha re batla ho arola tafole ka mabitso a li-blades, re khetha tšimo - sehlahisoa.lentsoe la sehlooho 'me u behe boholo ho litekanyetso tse khutlisitsoeng tse 25.
Sebakeng sa likhoele, elasticsearch e sebelisa mefuta e 2 ea data - mongolo и Ntlha ea bohlokoa. Haeba u batla ho etsa lipatlisiso tse feletseng, u lokela ho sebelisa mofuta oa mongolo, ntho e loketseng haholo ha u ngola tšebeletso ea hau ea ho batla, mohlala, ho batla ho boleloa ha lentsoe ka boleng bo itseng ba tšimo (mongolo). Haeba u batla feela papali e nepahetseng, u lokela ho sebelisa mofuta oa mantsoe a sehlooho. Hape, mofuta oa lintlha tsa sehlooho o lokela ho sebelisoa bakeng sa masimo a hlokang ho hlophisoa kapa ho kopanya, ke hore, molemong oa rona.
Ka lebaka leo, Elasticsearch e bala palo ea lits'oants'o ka nako e itseng, e kopantsoeng ke boleng tšimong ea sehlahisoa. Ka Custom Label, re beha lebitso la kholomo e tla bontšoa tafoleng, re behe nako eo re bokellang li-log, re qale ho fana ka eona - Kibana o romela kopo ho elasticsearch, o emetse karabo ebe o bona lintlha tse fumanoeng ka mahlo. Tafole e lokile!
Chate ea phae bakeng sa liketsahalo tsa Thibelo ea Matšokelo
Se khahlang haholo ke tlhahisoleseling mabapi le hore na ho na le maikutlo a makae e le peresente Hlokomela и Thibela ka diketsahalo tsa tshireletso ya tlhahisoleseding leanong la hajwale la tshireletso. Chate ea phae e sebetsa hantle bakeng sa boemo bona. Khetha ka ho Bona - Chati ea pie. Hape ho metric re beha aggregation ka palo ea li-log. Ka libakete re kenya Melao => ketso.
Ntho e ngoe le e ngoe e bonahala e nepahetse, empa sephetho se bonts'a boleng ba li-blade tsohle; o hloka ho sefa feela ka li-blade tse sebetsang ka har'a moralo oa Thibelo ea Tšokelo. Ka hona, ka sebele re e thehile sethopo molemong oa ho batla tlhahisoleseling feela ka li-blades tse ikarabellang bakeng sa liketsahalo tsa ts'ireletso ea tlhahisoleseling - sehlahisoa: ("Anti-Bot" KAPA "New Anti-Virus" KAPA "DDoS Protector" KAPA "SmartDefense" KAPA "Threat Emulation"). Setšoantšo se ka tobeha:
Le litlhophiso tse qaqileng haholoanyane, setšoantšo se ka penya:
Lethathamo la Ketsahalo ea IPS
Ka mor'a moo, ntho ea bohlokoa haholo ho tloha sebakeng sa ts'ireletso ea tlhahisoleseding ke ho shebella le ho hlahloba liketsahalo lehare. IPS и Emulation ea Kotsie leng ha lia thijoa pholisi ea hona joale, e le hore ka mor'a moo e ka ba ho fetola tshaeno ho thibela, kapa haeba sephethephethe se sebetsa, u se ke ua hlahloba tekeno. Re theha tafole ka tsela e ts'oanang le mohlala oa pele, ka phapang e le 'ngoe feela eo re e etsang litšiea tse' maloa: tšireletso.keyword, severity.keyword, product.keyword, originsicname.keyword. Etsa bonnete ba hore u theha sefe e le ho batla tlhahisoleseling feela ka li-blades tse ikarabellang bakeng sa liketsahalo tsa ts'ireletso ea tlhahisoleseling - sehlahisoa: ("SmartDefense" KAPA "Threat Emulation"). Setšoantšo se ka tobeha:
Litlhophiso tse qaqileng haholoanyane, setšoantšo se ka tobeha:
Lits'oants'o tsa libaka tse eteloang tse tsebahalang haholo
Ho etsa sena, etsa setšoantšo - Thepa e otlolohileng. Re boetse re sebelisa count (Y axis) joalo ka metric, 'me ho X axis re tla sebelisa mabitso a libaka tse etetsoeng joalo ka boleng - "appi_name". Ho na le leqheka le lenyane mona: haeba u tsamaisa litlhophiso ka har'a mofuta oa hajoale, libaka tsohle li tla tšoauoa chate ka 'mala o ts'oanang, e le ho li etsa mebala e mengata, re sebelisa litlhophiso tse ling - "lihlopha tse arohaneng", e leng se u lumellang hore u arole kholomo e lokiselitsoeng ho ea ka litekanyetso tse ling tse 'maloa, ho itšetlehile ka tšimo e khethiloeng e le hantle! Karohano ena e ka sebelisoa e le kholomo e le 'ngoe ea mebala e mengata ho latela boleng ka mokhoa o behiloeng, kapa ka mokhoa o tloaelehileng ho theha likholomo tse' maloa ho latela boleng bo itseng ho axis ea X. Tabeng ena, mona re sebelisa boleng bo lekanang le ba axis ea X, sena se etsa hore ho khonehe ho etsa hore litšiea tsohle li be le mebala e mengata; li tla bontšoa ka mebala ka holimo ka ho le letona. Sefateng seo re se behileng - sehlahisoa: "URL Filtering" molemong oa ho bona tlhahisoleseling feela libakeng tse etetsoeng, setšoantšo se ka tobeha:
Litlhophiso:
Setšoantšo sa tšebeliso ea lisebelisoa tse kotsi ka ho fetisisa
Ho etsa sena, theha setšoantšo - Vertical Bar. Re boetse re sebelisa count (Y axis) joalo ka metric, 'me ho X axis re tla sebelisa lebitso la lisebelisoa tse sebelisitsoeng - "appi_name" joalo ka boleng. Ntho ea bohlokoa ka ho fetisisa ke tlhophiso ea sefe - sehlahisoa: "Taolo ea Kopo" LE app_risk: (4 OR 5 OR 3 ) LE ketso: "amohela". Re sefa lits'oants'o ka lehare la taolo ea Ts'ebeliso, re nka feela libaka tse arotsoeng e le libaka tse kotsi, tse Phahameng, tse Bohareng mme ha feela phihlello ea libaka tsena e lumelletsoe. Setšoantšo se ka tobeha:
Litlhophiso, li ka penya:
Dashboard
Ho shebella le ho theha li-dashboard ho ntho e ka thoko ea menu - Dashboard. Ntho e 'ngoe le e' ngoe e bonolo mona, dashboard e ncha e thehiloe, pono e eketsoa ho eona, e behiloe sebakeng sa eona 'me ke eona!
Re theha dashboard eo ka eona u ka utloisisang boemo ba mantlha ba boemo ba ts'ireletso ea tlhahisoleseling mokhatlong, ha e le hantle, feela boemong ba Check Point, setšoantšo se ka penya:
Ho latela li-graph tsena, re ka utloisisa hore na ke li-signature life tse bohlokoa tse sa thijoang ho firewall, moo basebelisi ba eang teng, le hore na ba sebelisa lits'ebetso life tse kotsi haholo.
fihlela qeto e
Re shebile bokhoni ba pono ea mantlha ho Kibana mme ra haha dashboard, empa ena ke karolo e nyane feela. Ho feta moo thutong re tla sheba ka thoko ho theha limmapa, ho sebetsa le sistimi ea elasticsearch, ho tloaelana le likopo tsa API, automation le tse ling tse ngata!
Kahoo lula u mametse (, , , ), .
Source: www.habr.com