{"id":92075,"date":"2020-08-22T19:42:03","date_gmt":"2020-08-22T17:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk"},"modified":"2020-08-22T19:42:03","modified_gmt":"2020-08-22T17:42:03","slug":"elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","title":{"rendered":"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>I det h\u00e4r inl\u00e4gget kommer vi att beskriva inst\u00e4llningen av visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK<br \/>\nArtikeln \u00e4r indelad i f\u00f6ljande avsnitt:<\/p>\n<p><\/p>\n<p>1- \u00d6versikt av ELK SIEM<br \/>\n2- Standarddashboards<br \/>\n3- Skapa dina f\u00f6rsta dashboards<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Inneh\u00e5llsf\u00f6rteckning f\u00f6r alla inl\u00e4gg.<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515576\/\">Introduktion. Utplacering av infrastruktur och teknik f\u00f6r SOC som tj\u00e4nst (SOCasS)<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515722\/\">ELK-stack \u2014 installation och konfiguration<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/515920\/\">En promenad genom open Distro<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516050\/\">Visualisering av Dashboards och ELK SIEM<\/a><\/noindex><\/li>\n<li>Integration med WAZUH<\/li>\n<li>Avisering (Alerting)<\/li>\n<li>Rapportering<\/li>\n<li>\u00c4rendehantering<\/li>\n<\/ul>\n<p><\/p>\n<h3 id=\"1-obzor-elk-siem\">1- \u00d6versikt av ELK SIEM<\/h3>\n<p><\/p>\n<p>ELK SIEM lades nyligen till i elk-stacken i version 7.2 den 25 juni 2019.<\/p>\n<p><\/p>\n<p>Detta SIEM-l\u00f6sning skapades av elastic.co f\u00f6r att g\u00f6ra livet f\u00f6r s\u00e4kerhetsanalytikern mycket enklare och mindre tr\u00f6ttsamt.<\/p>\n<p><\/p>\n<p>I v\u00e5r version av arbetet beslutade vi att skapa v\u00e5rt eget SIEM och v\u00e4lja v\u00e5r egen instrumentpanel.<\/p>\n<p><\/p>\n<p>Men vi anser att det \u00e4r viktigt att f\u00f6rst studera ELK SIEM.<\/p>\n<p><\/p>\n<h4 id=\"11--razdel-host-events\">1.1- Avsnitt f\u00f6r host-event<\/h4>\n<p><\/p>\n<p>F\u00f6rst kommer vi att titta p\u00e5 host-avsnittet. Host-avsnittet l\u00e5ter dig se h\u00e4ndelser som genereras p\u00e5 sj\u00e4lva \u00e4ndpunkten.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/54ebe976e6479930ca8d20cfacdc0d8d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/e0862fafaa4ad1ba34714339a33c698f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Efter att ha klickat p\u00e5 'Visa hosts' b\u00f6r du f\u00e5 n\u00e5got som detta. Som du kan se \u00e4r tre hosts anslutna till denna dator:<\/p>\n<p><\/p>\n<p>1 Windows 10.<\/p>\n<p><\/p>\n<p>2 Ubuntu 18.04-server.<\/p>\n<p><\/p>\n<p>Vi har flera visualiseringar som visas, var och en visar olika typer av h\u00e4ndelser.<\/p>\n<p><\/p>\n<p>Till exempel, den som \u00e4r i mitten visar inloggningsdata f\u00f6r alla tre maskiner.<\/p>\n<p><\/p>\n<p>Den m\u00e4ngd data du ser h\u00e4r har samlats in under fem dagar. Detta f\u00f6rklarar det stora antalet misslyckade och lyckade inloggningar. Du kommer f\u00f6rmodligen ha ett litet antal loggar, s\u00e5 oroa dig inte.<\/p>\n<p><\/p>\n<h4 id=\"12--razdel-setevyh-sobytiy\">1.2- Avsnitt f\u00f6r n\u00e4tverksh\u00e4ndelser<\/h4>\n<p><\/p>\n<p>N\u00e4r du g\u00e5r till n\u00e4tverksavsnittet b\u00f6r du f\u00e5 n\u00e5got som detta. Detta avsnitt l\u00e5ter dig noggrant \u00f6vervaka allt som h\u00e4nder i ditt n\u00e4tverk, fr\u00e5n HTTP \/ TLS-trafik till DNS-trafik och externa h\u00e4ndelsevarningar.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/3ebae3d5e85dd84556eb26901c2fd519.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/344db7fac06acabaa011657debb52993.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h3 id=\"2--dashbordy-po-umolchaniyu\">2- Standarddashboards<\/h3>\n<p><\/p>\n<p>F\u00f6r att underl\u00e4tta livet f\u00f6r anv\u00e4ndarna har utvecklarna p\u00e5 elastic.co skapat en standardinstrumentpanel som officiellt st\u00f6ds av ELK. V\u00e5ra bitar var inget undantag fr\u00e5n denna regel. H\u00e4r kommer jag att ta Packetbeat-standardinstrumentpanelen som exempel.<\/p>\n<p><\/p>\n<p>Om du har genomf\u00f6rt steg tv\u00e5 i artikeln korrekt, b\u00f6r du ha en instrumentpanel som v\u00e4ntar p\u00e5 dig. L\u00e5t oss b\u00f6rja.<\/p>\n<p><\/p>\n<p>I v\u00e4nstra fliken i Kibana v\u00e4ljer du panelens symbol. Det \u00e4r den tredje nedifr\u00e5n.<\/p>\n<p><\/p>\n<p>Ange namnet p\u00e5 andelen i s\u00f6kfliken.<\/p>\n<p><\/p>\n<p>Om det finns flera moduler i biten, kommer en kontrollpanel att skapas f\u00f6r var och en av dem. Men endast den som har modulen aktiv kommer att visa n\u00e5gra data.<\/p>\n<p><\/p>\n<p>V\u00e4lj den som har namnet p\u00e5 din modul.<\/p>\n<p><\/p>\n<p>Detta \u00e4r huvudmallen. <strong>PacketBeat<\/strong>.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/f895c527f746c6df4c7e4e43c4eee802.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Detta \u00e4r kontrollpanelen f\u00f6r n\u00e4tverksfl\u00f6den. Den kommer att informera oss om inkommande och utg\u00e5ende paket, k\u00e4llor och destinationer f\u00f6r IP-adresser, samt ge mycket anv\u00e4ndbar information f\u00f6r analytikern i s\u00e4kerhetscentret.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/1d319ebf0865ea4ad18c9f1a10d6182d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/fb4f7078d667bc3c402198c2c58c293d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h3 id=\"3---sozdanie-vashih-pervyh-dashbordov\">3 \u2014 Skapa dina f\u00f6rsta instrumentpaneler.<\/h3>\n<p><\/p>\n<h4 id=\"31--osnovnye-ponyatiya\">3\u20131- Grundl\u00e4ggande begrepp<\/h4>\n<p><\/p>\n<p><strong>A- Typer av instrumentpaneler:<\/strong><\/p>\n<p><\/p>\n<p>Detta \u00e4r olika typer av visualiseringar som du kan anv\u00e4nda f\u00f6r att visa dina data.<\/p>\n<p><\/p>\n<p>Till exempel har vi:<\/p>\n<p><\/p>\n<ul>\n<li>Histogram<\/li>\n<li>Karta<\/li>\n<li>Markdown-widget<\/li>\n<li>Cirkeldiagram<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/63a8cbb26fe1caa4c224fffca02a58ad.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>B- KQL (Kibana Query Language):<\/strong><\/p>\n<p><\/p>\n<p>Detta \u00e4r spr\u00e5ket som anv\u00e4nds i Kibana f\u00f6r enkel s\u00f6kning i data. Det l\u00e5ter dig kontrollera om specifik data finns och m\u00e5nga andra anv\u00e4ndbara funktioner. F\u00f6r att l\u00e4ra dig mer kan du studera informationen via denna l\u00e4nk.<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/kuery-query.html\">https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/kuery-query.html<\/a><\/noindex><\/p>\n<p><\/p>\n<p>Detta \u00e4r ett exempel p\u00e5 en s\u00f6kfr\u00e5ga f\u00f6r en v\u00e4rd med Windows 10 Pro.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/2785f9afe1dfe463ad6b56febcfa04b8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>C- Filter:<\/strong><\/p>\n<p><\/p>\n<p>Denna funktion l\u00e5ter dig filtrera specifika parametrar, till exempel v\u00e4rdnamn, kod eller h\u00e4ndelse-ID, etc. Filter f\u00f6rb\u00e4ttrar betydligt unders\u00f6kningsfasen n\u00e4r det g\u00e4ller tid och insats som l\u00e4ggs p\u00e5 att hitta bevis.<\/p>\n<p><\/p>\n<p><strong>D- F\u00f6rsta visualiseringen:<\/strong><\/p>\n<p><\/p>\n<p>L\u00e5t oss skapa en visualisering f\u00f6r MITER ATT &amp; CK.<\/p>\n<p><\/p>\n<p>F\u00f6rst m\u00e5ste vi g\u00e5 till <strong>Dashboard \u2192 Skapa ny instrumentpanel \u2192 skapa ny \u2192 Cirkeldiagram<\/strong><\/p>\n<p><\/p>\n<p>St\u00e4ll in typ f\u00f6r indexm\u00f6nstret och tryck sedan p\u00e5 namnet p\u00e5 din bit.<\/p>\n<p><\/p>\n<p>Tryck Enter. Vid detta skede b\u00f6r du se en gr\u00f6n donut.<\/p>\n<p><\/p>\n<p>I fliken Buckets till v\u00e4nster hittar du:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/432dd674f142ee33b4e248621638b9e8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p> \u2014 Split slices delar donutdiagrammet i olika delar baserat p\u00e5 dataskillnader.<\/p>\n<p><\/p>\n<p> \u2014 Split Chart kommer att skapa en annan donut bredvid den h\u00e4r. <\/p>\n<p><\/p>\n<p>Vi kommer att anv\u00e4nda delade skivor.<\/p>\n<p><\/p>\n<p>Vi kommer att visualisera v\u00e5ra data baserat p\u00e5 den term vi har valt. I detta fall kommer termen att h\u00e4nvisa till MITER ATT &amp; CK.<\/p>\n<p><\/p>\n<p>I Winlogbeat \u00e4r f\u00e4ltet som ger oss denna information kallat:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">winlog.event_data.RuleName<\/code><\/pre>\n<p><\/p>\n<p><strong>Vi kommer att st\u00e4lla in en r\u00e4knefunktion f\u00f6r att ordna h\u00e4ndelser beroende p\u00e5 antalet g\u00e5nger de f\u00f6rekommer.<\/strong><\/p>\n<p><\/p>\n<p>Aktivera funktionen \"Gruppera andra v\u00e4rden i ett eget segment\".<\/p>\n<p><\/p>\n<p>Detta kommer att vara anv\u00e4ndbart om termerna du valt har m\u00e5nga olika betydelser som kommer fr\u00e5n rytmen. Det hj\u00e4lper till att visualisera \u00f6vriga data som en helhet. Detta ger dig en uppfattning om procenten av \u00f6vriga h\u00e4ndelser.<\/p>\n<p><\/p>\n<p>Nu n\u00e4r vi har avslutat inst\u00e4llningarna f\u00f6r databladen, l\u00e5t oss g\u00e5 vidare till inst\u00e4llningsfliken.<\/p>\n<p><\/p>\n<p>Du m\u00e5ste g\u00f6ra f\u00f6ljande:<\/p>\n<p><\/p>\n<p>** Ta bort donut-formen s\u00e5 att den fulla cirkeln visas i visualiseringen.<\/p>\n<p><\/p>\n<p>** V\u00e4lj en position f\u00f6r legenden som du gillar. I det h\u00e4r fallet kommer vi att visa dem till h\u00f6ger.<\/p>\n<p><\/p>\n<p>** St\u00e4ll in visningsv\u00e4rden s\u00e5 att de visas bredvid sin del f\u00f6r enkel l\u00e4sning, och l\u00e5t resten vara som standard.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/9b2e230247a5277c198f196e96e5f6da.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Avtr\u00e4ngning definierar hur mycket du vill visa av h\u00e4ndelsens namn.<\/strong><\/p>\n<p><\/p>\n<p>St\u00e4ll in tiden d\u00e5 visualiseringen ska b\u00f6rja och klicka sedan p\u00e5 den bl\u00e5 fyrkanten.<\/p>\n<p><\/p>\n<p>Du b\u00f6r f\u00e5 n\u00e5got som liknar detta:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/b89f5bf6aee38ff9019540b5f72b6c4c.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Du kan ocks\u00e5 l\u00e4gga till ett filter till din visualisering f\u00f6r att filtrera en viss v\u00e4rd som du vill kontrollera, eller andra parametrar som du tror \u00e4r anv\u00e4ndbara f\u00f6r ditt syfte. Visualiseringen kommer endast att visa data som matchar regeln som placerats i filtret. I det h\u00e4r fallet kommer vi att visa data f\u00f6r MITER ATT&amp;CK som kommer endast fr\u00e5n v\u00e4rden med namnet win10.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/aa6b4716d7e2cd27c9cc6b1a4acb25ae.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h4 id=\"32--sozdanie-vashey-pervoy-informacionnoy-paneli\">3\u20132- Skapa din f\u00f6rsta instrumentpanel:<\/h4>\n<p><\/p>\n<p>En instrumentpanel \u00e4r en samling av m\u00e5nga visualiseringar. Ditt instrumentpanel b\u00f6r vara klart, begripligt och inneh\u00e5lla anv\u00e4ndbara och deterministiska data. H\u00e4r \u00e4r ett exempel p\u00e5 instrumentpaneler som vi skapade fr\u00e5n grunden f\u00f6r winlogbeat.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"ELK SIEM Open Distro: Visualisering av informationspaneler f\u00f6r ELK och SIEM i ELK\" src=\"\/wp-content\/uploads\/2020\/08\/d2da07c7fce7a96fa754c709bdedb8a0.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Tack f\u00f6r din tid. Jag hoppas att denna artikel har varit till hj\u00e4lp f\u00f6r dig. Om du vill ha mer information i \u00e4mnet rekommenderar vi att du bes\u00f6ker <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/tutorial-visualizing.html\">den officiella webbplatsen<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p>Telegramchatten om Elasticsearch: <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/elasticsearch_ru\">https:\/\/t.me\/elasticsearch_ru<\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516050\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445 \u043f\u0435\u0440\u0432\u044b\u0445 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u043e\u0432 \u041e\u0433\u043b\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u0441\u0442\u043e\u0432. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435. \u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 \u0434\u043b\u044f SOC \u043a\u0430\u043a Service (SOCasS) ELK stack \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u041f\u0440\u043e\u0433\u0443\u043b\u043a\u0430 \u043f\u043e open Distro [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92076,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92075","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47ELK SIEM Open Distro: \u0412\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-22T17:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-22T17:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47ELK SIEM Open Distro: Visualisering av ELK och SIEM-instrumentpaneler i ELK | ProHoster","description":"I det h\u00e4r inl\u00e4gget kommer vi att beskriva konfigurationen av visualisering av ELK och SIEM-instrumentpaneler i ELK. Artikeln \u00e4r uppdelad i f\u00f6ljande avsnitt: 1- \u00d6versikt av ELK SIEM 2- Standardinstrumentpaneler 3- Skapa dina.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ELK SIEM Open Distro: \u0412\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK | ProHoster","og:description":"\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043f\u0430\u043d\u0435\u043b\u0435\u0439 ELK \u0438 SIEM \u0432 ELK \u0421\u0442\u0430\u0442\u044c\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u0434\u0435\u043b\u044b: 1- \u041e\u0431\u0437\u043e\u0440 ELK SIEM 2- \u0414\u0430\u0448\u0431\u043e\u0440\u0434\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 3- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432\u0430\u0448\u0438\u0445.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/elk-siem-open-distro-vizualizacziya-informaczionnyh-panelej-elk-i-siem-v-elk","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-22T17:42:03+00:00","article:modified_time":"2020-08-22T17:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92075","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:15:36","updated":"2022-09-27 16:41:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/92075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=92075"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/92075\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/92076"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=92075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=92075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=92075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}