Welcome to the last demo of this module.
We're going to get the last task completed so we end up with
our network data in the analysis platform.
I will show you how to install the Filebeat agent on the Zeek management host.
Then we will look at and install the Filebeat Zeek plugin.
Once we have installed the plugin,
I will show you how to configure it to capture a few of the Zeek logs.
The last task will be to activate Filebeat and have it ship the
belongs to the Globomantics Elasticsearch instance.
Let's dive in.
Before we get started, we need to make sure Zeek is logging in the JSON format.
Zeek, by default, logs in a TSV, or tab‑separated values, format.
If you're using something like Security Onion,
the version of Zeek that comes installed is already modified to use JSON.
Let's look at the Zeek site local policy,
and I will show you the configuration line that needs to be present.
All you need to do is add this line if it's not present,
and use the zeekctl deploy command to publish the changes to all remote sensors.
This change is necessary because Filebeat is expecting
the Zeek logs to be in the JSON format.
Now we're ready to install the Filebeat agent.
You can download it directly from the Elastic website.
I'm using an RPM‑based Linux distribution, so I chose the RPM format.
Remember that the version you choose should match the other
products deployed from the Elastic suite.
Globomantics is using version 7.12 of the Elastic Stack,
which is why I've already downloaded that same version of Filebeat.
Installation takes only a few seconds,
and the most recent version comes with a lot of modules
that support various third‑party software.
If you look closely,
you can see that there's a Zeek module that we will need to enable
using the filebeat module enable zeek command.
Now notice how the file listing has changed to represent enabled modules.
Once enabled, there are several configuration changes that we will need to make.
By default,
Filebeat will try to monitor every supported log file that Zeek produces,
even if it does not exist.
I do not want that behavior,
so I will modify it to only a few that I want Filebeat to monitor.
Unfortunately, we still have one more thing to change,
and that is the path where the logs are located.
Filebeat will make some assumptions about where the logs are located,
and we're going to avoid that by explicitly telling Filebeat where
we have the logs using the var.paths variable.
This is going to take awhile because for each enabled
log in this configuration file, and there are a lot of them,
I will need to add the specific path to the log file.
Now there's a shortcut that involves identifying where Filebeat assumes
you have the logs for your particular operating system,
and then using symbolic links to map that implicit
location to the explicit location.
For this lesson, I'm going to define the path for the X509 logs,
and then with the magic of video, I'll come back with all the other changes.
And like magic, I've made all the changes.
Take the time to double‑check that you've enabled or disabled the logs
you need and that the correct paths are defined.
It's easy to miss one when there are so many.
Syntax highlighting helps a little bit here.
If you get errors when Filebeat starts,
this is the file that's probably a good place to visit.
So that takes care of which logs to monitor.
Now we need to tell Filebeat where it needs to send those logs.
To do that, I'll edit the filebeat.yml file.
I contacted the Globomantics network engineers,
and they gave me the IP address for the Elasticsearch server,
which is using the default port of 9200.
If your environment is using authentication,
then you'll also need to modify either the API key or
the username‑password combination.
More complex configurations will include Logstash, but
that is outside the scope of this course.
We are finally complete with all the changes we need to make in this module.
I'm going to start the Filebeat agent, and then check the
status to make sure there are no errors with the
configuration, and if there are no errors,
we are done.
Awesome, no errors.
The Globomantics security analysts have been notified that
they should be able to see Zeek network security logs from
the DMZ user and server networks.
Let's take a look ourselves and see if our hard work has been fruitful.
Wow, that looks great.
The logs from all three sensors are being shipped to the existing Elastic Stack,
and we can see the Zeek field names populated on the left.
We made it to the end.
In this module,
I showed you how to configure a Zeek cluster using a
management host and three sensors.
We looked at some of the considerations for network sensor strategy, and
I showed you how to deploy the cluster configuration.
We ended this module with the Filebeat agent that allows us to ship all the
data from the master sensor to the Globomantics Elastic Stack.
In the next module,
I will show you how we can leverage all the data we are
collecting to support continuous monitoring.