Hello again, and welcome back.
So as a network professional,
there may be times where you need to quickly get a sense of a specific
type of activity that could be occurring on your network.
This could be for troubleshooting network outages or simply just
trying to visualize source and destination connections.
Luckily ELK, along with Packetbeat, can help solidify those needs.
Now even though we just have Packetbeat configured on a local Windows machine,
you can actually set up Packetbeat on networking devices as a
span collector to collect DNS and flow‑related activity as it
progresses over a networking switch.
All right,
so let's dive into some quick wins that are offered
within ELK for a networking professional,
as well as we're going to quickly verify that Packetbeat is actually logging.
So the first thing we're going to do in order to verify
the raw events within the ELK solution,
we're going to navigate to the Discover section in the left drop‑down,
which is going to pull up our base event search.
We're going to ensure that we have this top index filter just set to a
wildcard so that we're seeing everything that we need to see.
You may get a couple of pop‑up alerts, but that's okay,
you can just exit out of those.
And then all I'm doing here is searching for this Packetbeat wildcard.
And once you do that,
that'll just give you a quick sense of all the total count of
Packetbeat‑related logs that you have flowing within your instance.
Okay, now that we've verified our Packetbeat logs,
let's go ahead and head on over, if you go to this left drop‑down, to the
Network section under Security. Now it's time for the fun part.
We really get to dive into some of these use cases that can be used on a
reoccurring basis for any network or security professional.
So the first thing you'll see once you load this page up is a quick
overview of your networking logs if you scroll down a little bit,
including all events like Flow Logs, DNS, TLS handshakes,
etc. I do have it filtered on that specific Windows host,
which is the Desktop 123.
So as you can see here, we can see our networking events, just overall
counts, DNS queries, any potential TLS handshakes,
unique flow IDs, and then any source and destination connections.
You'll also get an overall sense if you scroll down a little bit more
around some of the flows that are occurring within your assets. This
view provides us a more in‑depth look at the bytes in and out specific
to these hosts and domains.
So we look at these source and destinations, we can see more in depth.
Okay,
what's happening on the network between interactions between
different sources on our side in different destinations that could be
on our side or that could be external to the enterprise? There's also
other countries that we just don't have geodata currently flowing in,
but you can add in geodata as well that may help provide that
additional context.
So as a network engineer,
you may be tasked with determining latency or
connectivity issues between two hosts.
Maybe you're currently configuring a new firewall policy that
needs to ensure connection has been established.
So by using these overview charts that we just looked
at and narrowing down your sources,
you can get a quick sense of the flows that are being sent, as well as
any maybe TLS connections attempting to be established.
So another use case also would be if you're attempting to restrict network
activity by country, if you were to enable geolocation tracking, these
dashboards would also provide some quick insight into where in the world
your connections are going. If you want to get fancy with it and activate
this overall graph chart, that might be a good place to start as well.
Now if you want to dive even deeper, you see that this is just the flow data.
Let's click on into the DNS data. Click into this tab here and
scroll down a bit, and we'll see an overview right here of the top
domains visited by the selected host.
Now we have this filtered to just our workstation here, but
you can imagine how this could be expanded.
So this can be helpful in determining connectivity to specific work‑related
resources and also help identify sites that are being visited that maybe should
not be. Just a quick overview. People are visiting Amazon, DNS Google, OneNote.
Again, now I just typed these in beforehand to trigger these, but this is a
quick way to get a sense of, okay, what are the top sites being visited?
Now, if we keep scrolling down here on this DNS tab,
we will see even more of a verbose dashboard that contains DNS
records broken down into the number of times visited, as well
as that by bytes in and bytes out.
That gives you even more visibility into what your users may be
experiencing latency on. Now one use case that could be derived from
this chart also is if a network professional was attempting to upload
data to a specific domain and was having difficulty. This diagram
could help verify the network issues that may lie by looking at the
bytes in/bytes out.
This may be determined if there's an issue on the corporate
side or maybe if it's a larger issue with the internet
service provider on the hosting side.
So now that we have a good idea of kind of where to visualize and see
our networking logging from Packetbeat, in the next video we're going
to dive into the security side of the house and really pair the
Packetbeat data with the current Winlog events data and Sysmon data to
provide us an even more in‑depth look of what intrusions could be
happening on the network.
I'll see you in the next video.