All right,
now that we have our local Zeek configuration built from the Salt file,
we need to go through and see its operations in Kibana.
Let's hop into the lab and validate that we can see the Zeek data
and see how we can view or use it in Kibana.
Let's go check it out.
All right, here I am in my Security Onion dashboard.
And from here,
I'm able to just hop straight into Hunt or Kibana or whatever
tool that I want to use within the suite.
This is really cool because it gives us a simple dashboard to get a
lot of data and do our threat hunting to work on case management
through Hive and so on and so forth.
So I'm going to go ahead and open Kibana.
And at this point,
the configurations were already reset back to their default ones.
Those changes that we made in the previous demo were just to show
the Salt configuration changes taking effect with the local site
script and the Zeek control file.
So the Salt configuration was able to update those for
us when we restarted Security Onion.
Here in Kibana,
we have such a cool dashboard that just pops up
automatically as soon as we launch it.
It gives us an overview of a lot of the data that we
have going through our network, where that data is coming from,
what some of the log files are, and what tools we're using to get this data.
And since Zeek is the focus of this course,
as you can see, we have a lot of the connection logs and everything like that,
the SSL logs, the HTTP logs that Zeek handled and provides Security Onion.
And we can filter, we can change colors in Kibana.
So this is really cool the type of visualizations that we can create in here.
Like I was saying in the previous clips,
it's pretty much like a SIEM,
and it adds a lot of visualizations and capabilities and stuff like that.
And this defaults to the last 24 hours.
Now I'm going to go ahead and just click the connection log dataset
just to talk through what we're seeing real quick.
When we click that, the connection log is specific to Zeek.
So all of these logs are similar to the ones that we'll find in
the connection log in the Zeek nsm folder.
And it's giving us a lot of data on the IP addresses and
the ports and everything like that.
We can filter on different alerts or different files or hosts or networks.
We see the top protocols, the conversations that we see,
and then this overview of the logs right here.
And we can expand any of these to go ahead and look at more of that data.
And we can look at it in either table format or JSON format.
So Kibana gives us some pretty cool capabilities from this perspective.
And with the Security Onion implementation itself,
what's really cool about this is we can go ahead and
create cases in our case management tool,
TheHive, straight from these logs.
So I think that's a really cool capability.
I'm going to go ahead and go back to the previous tab and
just click on the Zeek module over here.
And let's see what pulls up with that dashboard.
It's a similar setup where we're seeing the top protocols,
the IP addresses, the different datasets that Zeek's providing us,
the ports and all of that information.
We can filter it further on the different log files.
We can export any of this information as well,
which can be really handy if we're needing to import these
into another tool or if we need to keep them for some
historical records and stuff like that.
And we can also click on any of these fields just like a normal SIEM,
and it'll pull up information on those indicators on those IP addresses what
kind of traffic we're seeing on them and so on and so forth,
so similar to traditional SIEM functionality.
Now,
this is why Kibana is so powerful with its visualizations and
stuff like that because it's really dynamic.
They're fairly easy to create as well,
and it provides us a lot of nice visuals to be able to have up on a
monitoring platform or come in and view and click around and come in
and work through it because we can click in the graphs and jump into
the actual data in the graphs.
Instead of it just being a visual, it's actually interactive.
All right, so let's go back to the Kibana dashboard.
And the last thing that I want to show is some of the
SIEM‑type capabilities of Kibana.
So as you'll see, I went over to the Discover tab.
And this setup might look a little bit familiar.
It's reminiscent of our traditional SIEM devices,
Splunk and QRadar and any other ones that ingest logs.
We typically have formats like this where we're just displaying the
logs with the fields and everything like that.
And what's really cool about this is similarly to those other platforms,
we can just expand it and see the actual information.
We can see every single field that is in this log
and the data that comes with it.
We can click on them too.
So if we wanted to jump into some additional OSSEC data we can do
that just by clicking on that hyperlink right there.
So this gives us a lot of capabilities to dive from the logs themselves
into additional tabs to find more data if we wanted to.
What's cool about this too is a lot of the fields are already
extracted or populated in the SIEM capabilities here.
So if we wanted to, we could filter in on specific fields or anything like that.
We can search for field names as well.
So if we were looking for a specific port,
we can go ahead and do that and see if anything comes up with those fields.
And as you can see, it refreshed the search,
cleared the current filter that we had on it,
and now we have all of the logs that are populated with that one.
So an example of doing a simple search with that is if
we wanted to just look for port 53.
It would be a similar syntax to that.
And it filters the logs for us, gives us only the relevant data.
So you can use the Kibana query language to create search
strings similarly to other SIEMs as well.
We can filter by the fields,
we can filter by logs that have certain fields like we just did,
and then we can also do those custom searches and add
filters and so on and so forth.
So the capabilities here are really cool.
And what I like about this right now in this demo is that we're
validating that we are seeing messages from Zeek.
And how do I know that?
Because we have the log file path right there,
the /nsm/zeek/logs, and then current/http,
for example, right here.