$ wget -qO - <https://artifacts.elastic.co/GPG-KEY-elasticsearch> | sudo apt-key add -
$ sudo apt-get install apt-transport-https
$ echo "deb <https://artifacts.elastic.co/packages/7.x/apt> stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
$ sudo apt-get install apm-server elasticsearch logstash kibana metricbeat filebeat packetbeat
# ELASTICSEARCH
$ sudo gedit /etc/elasticsearch/elasticsearch.yml
network.host: 192.168.1.64 # VM IP
discovery.seed_hosts: ["192.168.1.64"]
$ sudo systemctl start elasticsearch.service
$ curl 192.168.1.64:9200 # test on Linux
> curl 192.168.1.65:9200 # test on Windows
# KIBANA
$ sudo gedit /etc/kibana/kibana.yml
elasticsearch.hosts: ["<http://192.168.1.64:9200>"]
server.host: "192.168.1.64"
$ sudo systemctl start kibana.service
$ sudo systemctl stop elasticsearch.service && sudo systemctl stop kibana.service && sudo systemctl stop auditbeat && sudo systemctl stop metricbeat && sudo systemctl stop filebeat && sudo systemctl start elasticsearch.service && sudo systemctl start kibana.service && sudo systemctl start auditbeat && sudo systemctl start metricbeat && sudo systemctl start filebeat && curl 192.168.1.64:9200
192.168.1.64:5601
$ sudo gedit /etc/filebeat/filebeat.yml
setup.kibana:
host: "192.168.1.64:5601"
output.elasticsearch:
hosts: ["192.168.1.64:9200"]
$ sudo filebeat modules list
$ sudo filebeat modules enable system [...microsoft...]
$ sudo filebeat-e setup
# INSTALL
Move unzipped to C:\\Program Files\\Winlogbeat\\
PS> .\\install-service-winlogbeat.ps1
# CONFIG
C:\\Program Files\\Winlogbeat\\winlogbeat.yml
setup.kibana:
host: "192.168.1.64:5601"
output.elasticsearch:
hosts: ["192.168.1.64:9200"]
PS> .\\winlogbeat.exe test config -c .\\winlogbeat.yml -e
# SETUP
PS> .\\winlogbeat.exe setup -e
# START
PS> Start-Service winlogbeat
$ sudo gedit /etc/auditbeat/auditbeat.yml
setup.kibana:
host: "192.168.1.64:5601"
output.elasticsearch:
hosts: ["192.168.1.64:9200"]
$ sudo metricbeat modules list
$ sudo metricbeat modules enable system [...windows linux elasticsearch kibana logstash http...]
$ sudo metricbeat -e setup
$ sudo gedit /etc/auditbeat/auditbeat.yml
output.elasticsearch:
hosts: ["192.168.1.64:9200"]
$ sudo auditbeat -e setup
$ sudo systemctl start auditbeat
$ sudo gedit /etc/packetbeat/packetbeat.yml
setup.kibana:
host: "192.168.1.64:5601"
output.elasticsearch:
hosts: ["192.168.1.64:9200"]
$ sudo packetbeat -e setup