I-ProHoster > Π‘Π»ΠΎΠ³ > Ukuphatha > I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

Lokhu okuthunyelwe kuzochaza ukusetha ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK
I-athikili ihlukaniswe yaba yizigaba ezilandelayo:

1- Ukubuyekezwa kwe-ELK SIEM
2- Amadeshibhodi azenzakalelayo
3- Ukudala amadeshibhodi akho okuqala

Ithebula lokuqukethwe kwakho konke okuthunyelwe.

1-ELK SIEM Ukubuyekezwa

I-ELK SIEM isanda kwengezwa kusitaki se-elk enguqulweni engu-7.2 ngoJuni 25, 2019.

Lesi yisixazululo se-SIEM esidalwe i-elastic.co ukwenza impilo yomhlaziyi wezokuphepha ibe lula kakhulu futhi ingabi nesicefe.

Enguqulweni yethu yomsebenzi, sinqume ukudala eyethu i-SIEM futhi sikhethe iphaneli yethu yokulawula.

Kodwa sicabanga ukuthi kubalulekile ukuhlola i-ELK SIEM kuqala.

1.1- Isigaba sokusingatha imicimbi

Sizobheka isigaba sokusingatha kuqala. Isigaba sokusingatha sizokuvumela ukuthi ubone izehlakalo ezikhiqizwa endaweni yokugcina uqobo.

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

Ngemuva kokuchofoza ukubuka abasingathi kufanele uthole okuthile okufana nalokhu. Njengoba ubona, kukhona ababungazi abathathu abaxhumeke kule khompyutha:

1 IWindows 10.

2 Ubuntu Server 18.04.

Sinezithombe ezimbalwa ezibonisiwe, ngayinye imele izinhlobo ezahlukene zemicimbi.

Isibonelo, lena emaphakathi ibonisa idatha yokungena kuyo yomithathu imishini.

Leli nani ledatha olibona lapha liqoqwe ezinsukwini ezinhlanu. Lokhu kuchaza inombolo enkulu yokungena okuhlulekile nokuphumelelayo. Cishe uzoba nenani elincane lezingodo, ngakho ungakhathazeki

1.2- Isigaba semicimbi yenethiwekhi

Ukuqhubekela esigabeni senethiwekhi, kufanele uthole okuthile okufana nalokhu. Lesi sigaba sizokuvumela ukuthi ubhekisise yonke into eyenzekayo kunethiwekhi yakho, kusukela kuthrafikhi ye-HTTP/TLS kuya kuthrafikhi ye-DNS kanye nezixwayiso zomcimbi wangaphandle.

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

2- Amadeshibhodi azenzakalelayo

Ukwenza ukuphila kube lula kubasebenzisi, onjiniyela be-elastic.co benze ibha yamathuluzi ezenzakalelayo esekelwa ngokusemthethweni i-ELK. Amabhithi ethu nawo ahlukile kulo mthetho. Lapha ngizosebenzisa amadeshibhodi azenzakalelayo e-Packetbeat njengesibonelo.

Uma ulandele isinyathelo sesibili se-athikili ngendlela efanele. Kufanele ube nebha yamathuluzi emisiwe ekulindile. Ngakho ake siqale.

Kuthebhu engakwesokunxele ye-Kibana, khetha uphawu lwedeshibhodi. Lena eyesithathu, uma ubala kusukela phezulu.

Faka igama lokwabelana kuthebhu yosesho

Uma kukhona amamojula ambalwa ku-bit. Iphaneli yokulawula izodalelwa ngayinye yazo. Kodwa yileyo kuphela enemojuli esebenzayo ezobonisa idatha engenalutho.

Khetha enegama lemojuli yakho.

Lesi yisifanekiso esikhulu I-PacketBeat.

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

Leli iphaneli yokulawula ukugeleza kwenethiwekhi. Izositshela mayelana nephakethe elingenayo neliphumayo, imithombo nezindawo zamakheli e-IP, futhi ihlinzeka ngolwazi oluningi oluwusizo lomhlaziyi wesikhungo sezokuphepha.

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

3 - Ukudala amadeshibhodi akho okuqala

3–1- Imiqondo Eyisisekelo

A- Izinhlobo zamadeshibhodi:

Lezi izinhlobo ezahlukene zokubuka ongazisebenzisa ukuze ubone idatha yakho.

isibonelo sina:

  • Igrafu yebha
  • imephu
  • Iwijethi ye-Markdown
  • Ishadi likaphayi

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

I-B- KQL (Ulimi Lombuzo waseKibana):

Lolu ulimi olusetshenziswa e-Kibana ukuze kuseshwe kalula idatha. Ikuvumela ukuthi uhlole ukuthi idatha ethile ikhona yini nezinye izici eziningi eziwusizo. Ukuze uthole okwengeziwe, ungahlola ulwazi kulesi sixhumanisi

https://www.elastic.co/guide/en/kibana/current/kuery-query.html

Lona umbuzo oyisibonelo sokuthola umsingathi osebenzayo Windows 10 pro.

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

C- Izihlungi:

Lesi sici sizokuvumela ukuthi uhlunge amapharamitha athile njengegama lomethuleli, ikhodi yomcimbi noma i-ID, njll. Izihlungi zizothuthukisa kakhulu isigaba sophenyo ngokuya kwesikhathi nomzamo ochithwe kusesha ubufakazi.

D- Ukubuka kuqala:

Masidale ukubuka ngeso kwe-MITER ATT & CK.

Okokuqala sidinga ukuya Ideshibhodi → Dala ideshibhodi entsha→dala entsha →Ideshibhodi yophayi

Setha uhlobo lwephethini yenkomba, bese uthepha igama lesigqi sakho.

Cindezela u-Enter. Manje kufanele ubone idonathi eliluhlaza.

Kuthebhu ethi Amabhakede kwesokunxele uzothola:

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

β€” Izingcezu zokuhlukanisa zizohlukanisa idonadi zibe izingxenye ezihlukene kuye ngokusabalala kwedatha.

- Ishadi Lokuhlukanisa lizodala elinye idonadi eduze kwaleli.

Sizosebenzisa izingcezu ezihlukanisiwe.

Sizobona idatha yethu ngokuya ngetemu esilikhethayo. Kulokhu igama lizobhekisela ku-MITER ATT & CK.

Ku-Winlogbeat, inkambu ezosinikeza lolu lwazi ibizwa ngokuthi:

winlog.event_data.RuleName

Sizosetha i-metric yokubala ukuze si-ode imicimbi ngokususelwe kunombolo yezikhathi ezenzeka ngayo.

Nika amandla isici esithi "Qoqa amanye amanani esigabeni esihlukile".

Lokhu kuzoba usizo uma amagama owakhethayo enezincazelo eziningi ezahlukene ezisuselwe kusigqi. Lokhu kusiza ukubona ngeso lengqondo yonke idatha iyonke. Lokhu kuzokunikeza umbono wamaphesenti emicimbi esele.

Manje njengoba sesiqedile ukusetha ithebhu yedatha, ake sidlulele kuthebhu yezinketho

Kufanele wenze lokhu okulandelayo:

**Susa umumo wedonathi ukuze ukuhumusha kubonise umbuthano ogcwele.

**Khetha indawo yenganekwane oyithandayo. Kulokhu, sizozibonisa ngakwesokudla.

**Setha amanani okubonisa ukuze abonise eduze kwamazwibela awo ukuze afundeke kalula futhi ushiye amanye njengokuzenzakalelayo

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

Ukunqanyulwa kunquma ukuthi kungakanani ofuna ukukubonisa kusuka egameni lomcimbi.

Setha isikhathi ofuna ukuhumusha kuqale ngaso, bese uchofoza isikwele esiluhlaza okwesibhakabhaka.

Kufanele ugcine ngokufana nalokhu:

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

Ungakwazi futhi ukwengeza isihlungi ekubukeni kwakho ukuze uhlunge umsingathi othize ofuna ukumhlola noma imaphi amapharamitha ocabanga ukuthi awusizo enjongweni yakho. Ukubuka kuzobonisa kuphela idatha efana nomthetho obekwe kusihlungi. Kulokhu, sizobonisa kuphela idatha ye-MITER ATT&CK evela kumsingathi ogama lakhe lingu-win10.

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

3-2- Ukudala ideshibhodi yakho yokuqala:

Ideshibhodi iqoqo lokubonwayo okuningi. Amadeshibhodi akho kufanele acace, aqondakale, futhi aqukathe idatha ewusizo, enqumayo. Nasi isibonelo samadeshibhodi esiwadale kusukela ekuqaleni we-winlogbeat.

I-ELK SIEM Open Distro: Ukubonakala kwedeshibhodi ye-ELK ne-SIEM ku-ELK

Siyabonga ngesikhathi sakho. Ngithemba ukuthi uthole lesi sihloko siwusizo. Uma ungathanda ulwazi olwengeziwe ngesihloko, sincoma ukuthi usivakashele iwebhusayithi esemthethweni.

Ingxoxo yocingo ku-Elasticsearch: https://t.me/elasticsearch_ru

Source: www.habr.com

Engeza amazwana