Debian12.11 : Suricata + Elastic Stack + Kibana

Prerequisite.

We will install Suricata IDS and ElasticStack anad Kibana on the following servers
・1st server Suricata IDS & Filebeat : Debian12.11 IP address (192.168.11.83)
・2nd server　ElasticStack & kibana　: Ubunru24.04 IP address(192.168.11.85)

Run as a sudo user other than root

 1st server Suricata Install

SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic. Its basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.

1.Suricata

①Install required packages

➁Suricata install

Check Version

Enable suricata.service to run on system reboot

Stop the Suricata service as it needs to be configured first.

2.Configure Suricata

①Determine interface and IP address where Suricata will inspect network packets

Edit /etc/suricata/suricata.yaml file

SURICATA supports live reloading of rules, allowing you to add, delete, or edit rules without restarting the running SURICATA process. To enable the live reload option, scroll to the bottom of the configuration file and add the following line

This setting allows the SIGUSR2 system signal to be sent to a running process, and SURICATA will reload the modified rules into memory. A command such as the following will signal the SURICATA process to reload the rule set without restarting the process:

➁Add rule set
Suricata has a tool called suricata-update that allows you to retrieve rulesets from external providers. You can download the latest rulesets for your suricata server by running

It shows that suricata-update has retrieved the free Emerging Threats ET Open Rules and saved them in Suricata's /etc/suricata/rules/suricata.rules file. It also shows the number of rules processed, in this example 60142 were added, of which 44537 were activated.

➂Adding Rule Set Providers
List Default Providers

If you include the tgreen/hunting ruleset as an example

Perform update

3.Suricata Configuration Testing

①Run Verification Tool

Suricata service restart

Check log files

4.Testing the Suricata Rule

①Test ET Open rule number 2100498 using the following command

②Check the log file using the specified rule number

 ③Check events in /var/log/suricata/eve.log

Install jq

Filter EVE Log events by searching for 2100498 signatures
Display alert objects with signature_id keys that match the values in 2100498

④Creating and Applying Custom Rules
Create the following custom signature to scan SSH traffic to non-SSH ports and include it in the file /etc/suricata/rules/local.rules (IPv4 only this time)

Editing suricata.yaml

Verify SURICATA settings

Edit the custom signature you just created and convert it to use the drop action.

⑤Reconfigure SURICATA and reboot in IPS mode

SURICATA operates in IDS mode by default and does not actively block network traffic; to switch to IPS mode, SURICATA's default settings must be changed.

Create a new systemd override file using the systemctl edit command:

Add the following section in red at the beginning

Reload systemd to detect new Suricata settings

With this change, we are ready to send traffic to Suricata through the UFW firewall.

⑥Configure UFW to send traffic to Suricata
To add the rules needed for Suricata to UFW, you must directly edit the firewall files in /etc/ufw/before.rules and /etc/ufw/before6.rules.

Similarly, change /etc/ufw/before6.rules

Restart UFW

Ensure that packets matching the aforementioned signature sid:2100498 are dropped

Reload signatures

Test this rule using curl

Checking eve.log using jq, "action" is set to "blocked

Elastic stack 9.x　Install

Install & configure Elastic Stack to visualize & search SURICATA logs
This section is basically done on a second Ubuntu24.04 server

①Install Elastic stack 9.x repository signing key

➁Install Elastic Stack 9.x repository

update

➂Installing Elasticsearch 9.x on Ubuntu 24.04

During installation, security features are enabled by default;

Certifications and authorizations are in effect.
TLS at the transport and HTTP layers is enabled and configured.
An Elastic super user account (elastic) and its password will be created.

④Configuring Elasticsearch 9.x on Ubuntu
Since this is a basic single-node cluster, we will use the default settings.

Check the Elasticsearch configuration file /etc/elasticsearch/elasticsearch.yml and you will see that the security settings are enabled

⑤Start Elasticsearch

Start Elasticsearch and allow it to run at system startup

Check Status

You can also check the status of the ES using the curl command; replace IP as appropriate

When prompted, enter the Elasticsearch password generated during the Elasticsearch installation
The output will look like this

Also, make sure that both the HTTP and transport ports are open;

⑥Reset Elasticsearch Password
The auto-generated Elastic user password is too complex, reset it using the command /usr/share/elasticsearch/bin/elasticsearch-reset-password
To reset the password, run the command

⑦Elasticsearch Logs
Elasticsearch writes logs to the /var/log/elasticsearch path; the log you need to check if there is a problem with your Elasticsearch instance is /var/log/elasticsearch/CLUSTER_NAME.log The logs you need to check if there is a problem with your Elasticsearch instance are

CLUSTER_NAME is the value of the cluster.name option in the elasticsearch.yaml file. If this value is not changed, the default is elasticsearch and the log file is /var/log/elasticsearch/elasticsearch.log.

log

Kibana 9.x Install

This section is basically done on a second Ubuntu 24.04 server

①Install

➁Configure Kibana 9
Kibana is configured by default to run on localhost:5601. To allow external access, edit the configuration file and replace the server.host value with the interface IP.

Rewrite as follows

➂Generate Kibana-Elasticsearch Enrollment Token
To configure your Kibana instance to communicate with an existing Elasticsearch cluster with security features enabled, you need an Enrollment Token.

④Generate Kibana encryption keys
Kibana uses encryption keys in several areas, from encrypting data for Kibana-related indexes to storing session information. The required keys are as follows

• xpack.encryptedSavedObjects.encryptionKey:Used to encrypt stored objects such as dashboards and visualizations
• xpack.reporting.encryptionKey: Used to encrypt saved reports
• xpack.security.encryptionKey: Used to encrypt session information

These can be generated using the command below

The command will give such an output

Insert these lines into Kibana config file, kibana.yml

⑤Running Kibana
Start Kibana 9 and allow it to run at system startup.

status

The following appears at the end of the output

Copy the provided Kibana URL (including code) and use it in your browser to access Kibana and complete the setup.

Similarly, Kibana logs are available in /var/log/kibana/kibana.log and /var/log/syslog.

⑥Accessing the Kibana9 Dashboard

You can now access http://192.168.11.85:5601/?code=561945
(copy the appropriate address for each person)

If UFW is running, open Kibana port

When you access Kibana 9, the welcome page asks you to configure Elastic.
First, enter the generated registration token.
Copy the Kibana token generated using the command /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana, and paste it into the box

You can now access http://192.168.11.85:5601/?code=561945

Paste the token and Kibana will automatically connect to Elasticsearch.
Click Configure Elastic. Your settings will be saved and Elasticsearch will be configured and restarted.

Go to the login page. Log in using the generated Elastic user credentials.

On the welcome page, click "Explore on my own" to proceed to the Kibana 9.x dashboard.

Installing Filebeat 9

To collect and monitor logs from Debian12.11 using the ELK stack, Filebeat must be installed.
This work will be done on the 1st server Debian12.11 IP address (192.168.11.83).

①Install Elastic Repos
To install Filebeat 9, you must install the Elastic 9.x repository.

update

Install Filebeat 9

➁Configuring Filebeat Logging

The default filebeat configuration file is /etc/filebeat/filebeat.yml
To make Filebeat write logs to its own log file, enter the following settings in the configuration file

➂Connecting Filebeat to the data processing system
Configure Filebeat to connect to a data processing system. In this case, it is Elasticsearch.
To send logs directly to Elasticsearch, edit the Filebeat configuration file and update the Output Settings section.

Connecting to Elasticsearch 9 requires SSL and authentication.
Make sure you can connect to Elasticsearch port 9200/tcp

④Elasticsearch CA certificate creation
Download the Elasticsearch CA certificate and save it in a directory of your choice (this time as /etc/filebeat/elastic-ca.crt)

Get the credentials that Filebeat uses to authenticate to Elasticsearch. In this case, we will use the default superadmin and Elastic user credentials.

⑤Configuration File Test

⑥Test Filebeat output connections

⑦Enable Filebeat's Suricata module
Change modules.d/suricata.yml as follows

Enable Filebeat's Suricata module

⑧Set up initial environment
Load the SIEM dashboard and pipeline into Elasticsearch
filebeat setup command

⑨Filebeat service launched

⑩Check with Kibana

Log back into Kibana at accsess http://192.168.11.85:5601

Type "Suricata Events Overview" in the top search field and click [Filebeat Suricata]Events Overview

All Suricata events in the last 15 minutes are displayed

Click on the Alerts text next to the Suricata logo for malicious traffic alerts

Create a new user account so that you do not have to use the elastic superuser account.
Click on the three-line mark in the upper left corner and select "Stack Management" under "Management"

Select "security" and "Users"

Click on the "Create user" button in the upper right corner

Enter new user information, assign the roles kibana_admin, kibana_system, monitoring_user, and editor in Privileges, and finally click Create user

Log out of the current profile and confirm that you can log in with the newly created user account.