Debian13.1 : Suricata + Elastic Stack + Kibana

Prerequisite.

We will install Suricata IDS and ElasticStack on the following servers
・1st server Suricata IDS & Filebeat : Debian13.1 IP address (192.168.11.83)
・2nd server　ElasticStack & kibana　: Ubunru24.04 IP address(192.168.11.85)
Run as a sudo user other than root

 1st server Suricata Install

SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic. Its basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.

1.Suricata

①Install required packages

➁Suricata install

Check Version

Enable suricata.service to run on system reboot

Stop the Suricata service as it needs to be configured first.

2.Configure Suricata

①Determine interface and IP address where Suricata will inspect network packets

Edit /etc/suricata/suricata.yaml file

➁Add rule set
Suricata has a tool called suricata-update that allows you to retrieve rulesets from external providers. You can download the latest rulesets for your suricata server by running

It shows that suricata-update has retrieved the free Emerging Threats ET Open Rules and saved them in Suricata's /etc/suricata/rules/suricata.rules file. It also shows the number of rules processed, in this example 61848 were added, of which 46019 were activated.

➂Adding Rule Set Providers
List Default Providers

If you include the tgreen/hunting ruleset as an example

Perform update

3.Suricata Configuration Testing

①Testing the configuration file

Suricata service restart

Check log files

4.Testing the Suricata Rule

①Use the following command to test using ET Open Signature ID 2100498

②Check the log file using the specified rule number.
Suricata comes with the following two log files enabled by default.

/var/log/suricata/fast.log
/var/log/suricata/eve.log
To check the log entries corresponding to the curl request, use the grep command to examine the /var/log/suricata/fast.log log file.
2100498 Searches for log entries using the rule identifier. (For IPv4)

 ③Check events in /var/log/suricata/eve.log

Install jq

Filter EVE Log events by searching for 2100498 signatures
Display alert objects with signature_id keys that match the values in 2100498

5.Reset SURICATA and restart it in IPS mode.

SURICATA operates in IDS mode by default and does not actively block network traffic. To switch to IPS mode, you must modify SURICATA's default settings.

5.1 Enabling nfqueue mode

Reload the configuration and restart Suricata.

5.2 Configuring UFW to Send Traffic to Suricata

5.3 Create local rules and define them in the Suricata configuration file
First, disable packets matching signature sid:2100498 defined in suricata.rules to avoid conflicts.

Create a new local rule

Define in the Suricata configuration file

Reload the signature

5.4 Test this rule using curl

Using jq to check eve.log for "action": "blocked"

Elastic stack 9.x installation

Install & configure Elastic Stack to visualize & search SURICATA logs
This section is basically done on a second Ubuntu24.04 server

①Install Elastic stack 9.x repository signing key

➁Install Elastic Stack 9.x repository

update

➂Installing Elasticsearch 9.x on Ubuntu 24.04

During installation, security features are enabled by default;

Certifications and authorizations are in effect.
TLS at the transport and HTTP layers is enabled and configured.
An Elastic super user account (elastic) and its password will be created.

④Configuring Elasticsearch 9.x on Ubuntu
Since this is a basic single-node cluster, we will use the default settings.

Check the Elasticsearch configuration file /etc/elasticsearch/elasticsearch.yml and you will see that the security settings are enabled

⑤Start Elasticsearch

Start Elasticsearch and allow it to run at system startup

Check Status

You can also check the status of the ES using the curl command; replace IP as appropriate

When prompted, enter the Elasticsearch password generated during the Elasticsearch installation
The output will look like this

Also, make sure that both the HTTP and transport ports are open;

⑥Reset Elasticsearch Password
The auto-generated Elastic user password is too complex, reset it using the command /usr/share/elasticsearch/bin/elasticsearch-reset-password
To reset the password, run the command

⑦Elasticsearch Logs
Elasticsearch writes logs to the /var/log/elasticsearch path; the log you need to check if there is a problem with your Elasticsearch instance is /var/log/elasticsearch/CLUSTER_NAME.log The logs you need to check if there is a problem with your Elasticsearch instance are

CLUSTER_NAME is the value of the cluster.name option in the elasticsearch.yaml file. If this value is not changed, the default is elasticsearch and the log file is /var/log/elasticsearch/elasticsearch.log.

logs

Kibana 9.x installation

This section is basically done on a second Ubuntu 24.04 server

①Install

➁Configure Kibana 9
Kibana is configured by default to run on localhost:5601. To allow external access, edit the configuration file and replace the server.host value with the interface IP.

Rewrite as follows

➂Generate Kibana-Elasticsearch Enrollment Token
To configure your Kibana instance to communicate with an existing Elasticsearch cluster with security features enabled, you need an Enrollment Token.

④Generate Kibana encryption keys
Kibana uses encryption keys in several areas, from encrypting data for Kibana-related indexes to storing session information. The required keys are as follows

• xpack.encryptedSavedObjects.encryptionKey:Used to encrypt stored objects such as dashboards and visualizations
• xpack.reporting.encryptionKey: Used to encrypt saved reports
• xpack.security.encryptionKey: Used to encrypt session information

These can be generated using the command below

The command will give such an output

Insert these lines into Kibana config file, kibana.yml

⑤Running Kibana
Start Kibana 9 and allow it to run at system startup.

status

The following appears at the end of the output

Copy the provided Kibana URL (including code) and use it in your browser to access Kibana and complete the setup.

Similarly, Kibana logs are available in /var/log/kibana/kibana.log and /var/log/syslog.

⑥Accessing the Kibana9 Dashboard

You can now access http://192.168.11.85:5601/?code=446458
(copy the appropriate address for each person)

If UFW is running, open Kibana port

When you access Kibana 9, the welcome page asks you to configure Elastic.
First, enter the generated registration token.
Copy the Kibana token generated using the command /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana, and paste it into the box

You can now access http://192.168.11.85:5601/?code=446458

Paste the token and Kibana will automatically connect to Elasticsearch.
Click Configure Elastic. Your settings will be saved and Elasticsearch will be configured and restarted.

Go to the login page. Log in using the generated Elastic user credentials.
Username : elastic
Password : Easy-to-understand regenerated passwords

On the welcome page, click "Explore on my own" to proceed to the Kibana 9.x dashboard.

Installing Filebeat 9

To collect and monitor logs from Debian 13.1 using the ELK stack, Filebeat must be installed.
This work will be performed on the first server Debian13.1 IP address (192.168.11.83).

①Install Elastic Repos
To install Filebeat 9, you must install the Elastic 9.x repository.
Be sure to install the latest version of Filebeat. Installing an older version may cause a bug where nothing appears in Kibana events.

update

Install Filebeat 9

➁Configuring Filebeat Logging

The default filebeat configuration file is /etc/filebeat/filebeat.yml
To make Filebeat write logs to its own log file, enter the following settings in the configuration file

➂Connecting Filebeat to the data processing system
Configure Filebeat to connect to a data processing system. In this case, it is Elasticsearch.
To send logs directly to Elasticsearch, edit the Filebeat configuration file and update the Output Settings section.

Connecting to Elasticsearch 9 requires SSL and authentication.
Make sure you can connect to Elasticsearch port 9200/tcp

④Elasticsearch CA certificate creation
Download the Elasticsearch CA certificate and save it in a directory of your choice (this time as /etc/filebeat/elastic-ca.crt)

Get the credentials that Filebeat uses to authenticate to Elasticsearch. In this case, we will use the default superadmin and Elastic user credentials.

⑤Configuration File Test

⑥Test Filebeat output connections

⑦Set up initial environment
Load the SIEM dashboard and pipeline into Elasticsearch
filebeat setup command

⑧Filebeat service launched

⑩Check with Kibana

Log back into Kibana at accsess http://192.168.11.85:5601

Type "Suricata Events Overview" in the top search field and click [Filebeat Suricata]Events Overview

All Suricata events in the last 15 minutes are displayed

Click on the Alerts text next to the Suricata logo for malicious traffic alerts

Create a new user account so that you do not have to use the elastic superuser account.
Click on the three-line mark in the upper left corner and select "Stack Management" under "Management"

Select "security" and "Users"

Click on the "Create user" button in the upper right corner

Enter new user information, assign the roles kibana_admin, kibana_system, monitoring_user, and editor in Privileges, and finally click Create user

Log out of the current profile and confirm that you can log in with the newly created user account.