Hello there, and welcome.
I'm your instructor today, Owen Dubiel,
and we'll be covering everything you need to know around detecting
anomalies and events with Packetbeat and a live environment.
Let's dig right in.
Okay,
so what you can expect to learn in this course is all the
components needed to properly set up, configure,
and implement Packetbeat within an ELK SIEM environment.
Also,
we will cover at a high level how Packetbeat can be tied
to the NIST Cybersecurity Framework.
Lastly,
we'll identify some networking and security practical use cases and demonstrate
how to set up and enable custom alerts within the solution.
All right, so what is it anyway?
Packetbeat is a real‑time network packet analyzer that is commonly used
within the Elasticsearch platform or the ELK Stack to gather metrics
around application performance and analytics.
Packetbeat is part of the overall Beats offering,
which is an open source method to ship data to Elastic.
Other examples you may be familiar with within the
Beats platform include Auditbeat, Filebeat,
Metricbeat, and Winlogbeat.
Packetbeat focuses on network protocols like HTTP and MySQL to
give you an insight into how your application, hosts or even your
overall network may be performing.
Packetbeat captures metrics like latency,
error, response times,
SLA performance, as well as user access patterns and trends.
Packetbeat allows users to pick from a handful of prebuilt protocols like
HTTP, DNS or even Flow Logs, or if needed, you could even create your own.
With Packetbeat, you don't have to worry about doing too much manual work
to configure your network logs as Packetbeat does it all for you. That's
what makes it special.
The overall flow is as follows. Packetbeat captures
the network traffic on a given host, decodes the specified network protocols,
correlation is completed between requests and responses,
extracts the fields required, and then bundles everything into a JSON file to
send to Elastic. Once shipped to Elastic or Logstash, you can then begin
working on creating visualizations of your data within Kibana by utilizing the
full ELK Stack, as you will see in our demo. Packetbeat can also be paired
with other Beats like Metricbeat or Winlogbeat to help enrich and improve
visibility and datasets. The best part about Packetbeat is that if there's
ever a system outage or a network issue that prevents the Beats from sending
to your SIEM,
you can temporarily write the logs to disk so that they will
repopulate once the network is back online again.
Now let's go ahead and dive into some of the NIST classifications and how
Packetbeat can help check some of those compliance boxes.
All right, so taking a quick look at the compliance security side of the house,
NIST provides guidelines to help companies better align their
efforts and resources to achieve a greater sense of security
posture. Today, we'll be focusing solely on the detect realm
within the NIST Cybersecurity Framework.
So looking at Packetbeat,
we can easily determine that by successfully implementing
Packetbeat within your SIEM solution, you're able to check the box for DE.AE‑3,
which is event data are collected and correlated
from multiple sources and sensors.
As we learned in the previous slides,
Packetbeat's main function is to capture network traffic logs
from multiple sources, and then within the SIEM environment when
we create our alerts and dashboards,
we are correlating these events further to paint a better picture
of possible intrusions that could be occurring.
Another NIST box that can be checked within this implementation of
Packetbeat is DE.AE‑1, a baseline of network operations and expected
dataflows for users and systems is established and managed.
So over time as you collect and create alert rules for your network logs,
you'll be able to better identify dataflow trends and activity
spikes that are considered either normal or abnormal.
For example,
you may notice authentication type activity occurs mostly in the mornings,
let's say around 9am, and slowly downturns throughout the day with
little activity that occurs over the nighttime hours.
The same thing applies with internet usage. You may notice a spike
in outbound internet usage activity around lunchtime as employees
surf the internet while on lunch break, which that may be considered normal,
but if the same spike was to occur at 3am, it may warrant further
investigation as this would be considered abnormal behavior.
Okay,
so now we have a solid understanding of what Packetbeat is and how it
is best utilized, let's go ahead and dive into our implementation of
Packetbeat in a live ELK environment.
I'll see you in the next video.