Now that we have our Zeek cluster working and collecting network data,
let us look at how Globomantics can get that data into their existing
Elastic Stack using the Filebeat agent.
All the logs from our Zeek cluster are stored on the master
sensor, which is performing the cluster management.
The first step will be to download and install the
Filebeat agent on the management host.
The ElasticSuite requires that each component be the same version.
Globomantics is using Elasticsearch version 7.12, and as a result we
will need to download and install version 7.12 of the Filebeat
agent. When the agent is installed, we can easily set up the Zeek
plugin so it is activated for use.
Then, we will need to configure the type and location of the Zeek
logs we want to send to the Elastic Stack. After configuring the
plugin, the final step is to tell the Filebeat agent where in our
environment it should send the logs.
Here is a quick look back at the Zeek cluster on the Globomantics network.
All the data is being collected at the Zeek management host.
And with the help of the Filebeat agent,
we can now ship those logs out to the existing Elastic Stack,
also known in the industry as a security information
and event management platform, or SIEM for short. In the next clip,
I will demonstrate how to finalize the Zeek cluster deployment and integration.