Hello there, and welcome back.
So kicking things off,
let's quickly go over our setup here and what is expected that you have in
place at a minimum before being able to install Packetbeat.
So first we have our ELK instance,
which is set up using the Docker method of install.
Currently in our ELK Stack setup, we have Winlogbeat,
as well as Sysmon configured.
This is not required,
but can help provide some additional context in the security
use cases that we'll cover in a later demo.
I will be going over the manual method of installation,
but there's also a centralized method that can be configured within ELK itself.
All right,
so the first thing we need to do is ensure that we have Npcap or
WinPcap installed and running on our Windows host.
This allows us to grab the traffic that is spanning over its network interface,
thus giving Packetbeat something to read from.
So the first thing we're going to do here is pull up an internet browser here,
and we're going to go navigate to the Npcap website.
And you're just going to click on the Downloads tab,
which is at the top of the page, and select the latest installer.
This one is the 1.70.
It'll start the download of the EXE, and once downloaded,
go ahead and launch it.
Now I already have it installed,
but I will reinstall it so I can show you the features here.
Accept the copyright.
And this is important.
You're going to want to select these bottom two checkboxes,
which supports wireless adapters,
as well as install Npcap and WinPcap compatible mode.
This ensures that no matter your setup,
the Packetbeat and the Nmap Pcap will be able to effectively
gather the logs required and utilize them.
So then you'll go ahead and click Install.
Now this will only take a minute, and then you'll click,
I believe it's Next and Finish once completed.
Okay, now that installation is complete, we'll click Next and Finish.
Now you're all set.
Npcap is installed and running.
So next,
we will download the Packetbeat Windows ZIP file
from the Downloads page in Elastic,
and then we'll extract these contents of the ZIP file into the C
Program Files location and rename it to Packetbeat.
So just navigate on over to the Downloads page from Elastic,
you select your versioning, for this we just used the Windows ZIP,
you download it, and then once it's fully downloaded,
on the right side of my screen here you'll see you're going to
want to extract it to the Program Files location,
and then go ahead and rename it to Packetbeat with a capital P.
And as you see,
we'll click in there and we'll see all the files that we have downloaded.
Now that we have everything downloaded,
we actually need to install Packetbeat on this host.
So what you're going to want to do,
on the left side of my screen you'll see we have our our
Windows PowerShell open in administrative mode.
You do that by right‑clicking on the PowerShell icon and then select Run
as administrator and this prompt will come up here.
You're going to want to navigate to that Program Files Packetbeat folder,
and then simply you're going to run this .\install‑service‑packetbeat‑ps1.
Go ahead and click Enter, and we'll see, there we go.
Okay, so this indicates a successful installation.
As you see, the status is marked as Stopped.
That means the service is not running, but it is installed correctly.
Now if you get any red error messages here,
most likely it's probably the script execution error,
which would occur if this is the first time you've run
scripts in PowerShell on this host.
So if you do get the script execution is disabled,
you'll need to set the execution policy to allow script enablement.
So,
per the command you could add a
‑ExecutionPolicyUnrestricted and then the file name,
or if you wanted to do it globally, just run Set‑ExecutionPolicy to bypass.
That way,
moving forward any scripts that you run on this host in
administrative mode you won't be prompted for that error.
So next, we'll have to ensure our host can communicate with the ELK instance.
So what we're going to actually do is go over to the
right side of our screen here, and we're going to open the Packetbeat.
You can open it in any file solution that you would like.
I'm just going to use Notepad for simplicity's sake.
So the first thing we're actually going to do is we have to set
where the Elasticsearch installation is at and set the username
and password as well so it's authorized to set up and ingest
the Packetbeat logging.
So within the YAML file under a section called output
Elasticsearch is where we can find that.
So we're going to scroll down to the section that is labeled output for Elastic.
You see Kibana, which we'll come back to.
Elasticsearch Output.
And as you can see here, we have this hosts section,
which is set to our destination IP address,
and the port.
So the only thing you'll have to do in a default policy is change this IP
address to the one that is hosting your ELK instance,
and then also make sure you remove the hash there.
And then also you're going to want to come down here,
and if you're using an API key you'll unhash this value and add in your API key,
or if you just want to use username and password,
you can uncheck those and do the same thing.
Next, in order to utilize the Kibana portion of ELK,
the dashboards,
we'll want to configure the Kibana section within this
YAML file as well with the same type of information so
that it can successfully connect.
So we will scroll up to Kibana here.
Same thing, plug in the same destination IP for our ELK instance.
The port is different, and it should be the default that comes within the policy.
Make sure it's unchecked, and that is all that is needed for the Kibana setup.
Moving on. Now that we have everything connected,
we'll need to set up actual sniffing within this YAML file to allow the
network‑connected devices the ability to capture the traffic and send it
on. For Windows, this is pretty straightforward as we just have to
ensure the correct network interface is set to the
packet.interfaces.device field within the YAML.
So we'll scroll up here to that section first so that we can properly
identify where we're going to be placing that value. And you'll see
here there's a Network device section, and we will be setting that
value here. Right now it's set to 4.
So what we're going to do now in order to confirm which network interface it
is, we're going to come back on over here to our PowerShell and we're going to
simply run .\packetbeat.exe, and then devices, and this will give us a list of
all the available network interfaces that are on this machine, and then we
just choose which one that is.
So you can see there's several on here. And if we go
to the one that's currently set,
it looks like it's the loopback device, which in this instance
we actually want it to be device number 3,
which is this gigabit network connection with the associated
IP address. So we're going to come back over and simply
change this value from a 4 to a 3.
Okay.
Another thing to mention within the YAML file is these transaction
protocols. These are all the protocols that will be captured and then
sent over to ELK within the Packetbeat setup.
So, it's important that you go through these and review and
enable or disable any of them that you may need.
Okay, now that you have the YAML file completed,
it's time to run a quick test to make sure everything checks
out. To do this, you're just going to run .\packetbeat.exe,
and then test config. Click Enter.
Now if everything checks out appropriately,
you should get this response, the Config OK. This is telling you that, okay,
we run through your config, there's no additional spaces or things left out
that are necessary for Packetbeat to successfully connect.
So the next step is we'll need to set up the assets
that are included with Packetbeat.
These are used effectively to parse index and visualize the data. In order to
properly load them, we will have to run the following command.
So again, we're going to do that .\packetbeat.exe,
and we're going to go setup ‑e.
Now this essentially is, okay, now that the config is correct,
we're going to actually load the config. And then the ‑e command is kind of
like it's an option that will print out any verbose logging or error events
to the screen, so you can run without it, but if there are any issues,
we'll provide you with what you need.
Okay. So it's loading. This is just some general loading.
We see that we've got the index setup finished in the bottom lower left half of
the screen, as well as the loading dashboards from Kibana. So it's moving on to
the next step. Loaded dashboards successfully.
Okay,
so it looks like there's a lot of errors on the screen, but
remember we ran that with the verbose logging.
If I were to do that again without the e, we would get the only
necessary commands that we're looking for.
The index setup is finished loading the Kibana dashboards, and that may take
a minute, but once completed, we will get that loaded dashboard successfully
command. And then we know that we are good to go. And there it is. At this
point if you received any other errors and did not get the loaded complete
dashboards prompt at the end,
you will want to look into those individually and satisfy them.
They're pretty verbose, so you should be able to
troubleshoot those, and they're usually tied to YAML
config issues that need to be corrected.
Okay, so once completed, now we'll actually need to start Packetbeat.
So we do this by running start‑service packetbeat.
Okay, now that we've successfully set up our config,
tested it out,
installed it, implemented it, and started Packetbeat, in our next video,
we will verify that our DNS data is being successfully sent into the ELK
instance, as well as walk through some of the common real‑world networking
use cases that you can use Packetbeat data four.
I'll see you in the next demo.