Kibana is something relatively familiar to most security analysts.
At one point or another, whether using Security Onion or something else,
you've already ran into this.
So starting there, you can see, well,
you can't see much because you don't have any data.
Quick note,
I'm accessing this through a browser from a device that
is not the one that's operating HELK.
It is exposing this on the external IP. If that's not working
for you, just like this, remember to change your firewall
rules to allow for external access.
And that's probably what I would consider best practice in this
scenario, not to put any more load on the CPU or RAM.
But, how do you know this is the even HELK?
Well,
go take a look at your dashboards. If you know me, you know that MITRE
ATT&CK is probably going to activate my super nerd, so I'm going to go
ahead and click on that one first. For this specific index, MITRE
ATT&CK was entered at a certain point with time data into the indices
inside Elasticsearch.
So if I change the date,
it's going to give me all of the MITRE ATT&CK information that I expect,
mainly here to use as cross reference with the additional indicators
that we get for other types of data input,
like the Winlogbeats and Sysmon. For everything else, HELK wants
data its way. If you noticed, there are Sysmon dashboards available
as well, but there's no point in getting to the rest of the features
that make HELK such a lovable beast until I import data with juicy,
huntable content.
Just as in the network diagram,
I'm going to install Sysmon and, subsequently, Winlogbeats on each
endpoint that I want to monitor. For Sysmon in this instance,
and in most instances, I'm going to go ahead and use
@SwiftOnSecurity's basic config that's pretty much the de facto
Sysmon config in the industry. Of course,
adjust it for your needs according to the notes inside the config file.
Next,
you need to ship those events and a few more from
each device to the HELK server.
Grab Winlogbeats from Elastic and replace the winlogbeat.yml config
with the winlogbeat.yml from the config directory located in the
HELK GitHub repo that you cloned. Not done yet! Open up the YAML
file with your favorite editor.
I used PowerShell ISE here because it's already included, and it doesn't
break the YAML formatting like some other text editors.
Yes, I had to learn that through hard experience. In this line here,
edit the HELK IP for Kafka with the HELK server IP that you installed,
and then remove the second IP and port.
Now you may ask, how do I know that?
Well, if you check the Docker containers running on the HELK system,
you can see that the ports that each are mapped to, in
this case the helk‑kafka‑broker, mapped to 9092 with no
additional helk‑kafka‑brokers.
I always run this from the command line with std::out using the e flag first.
This is to make sure that I have published events.
Then I checked Kibana.
Yes, I do now have logs. Check around a bit more.
Yes,
I even have Sysmon logs, and I'm good to go. So I can shut that down and
then install it as a service with the PowerShell script.
And now rinse and repeat that for each device that you want to monitor.