Ubuntu Server24.04 : Suricata + Elastic Stack

Prerequisites

This time, we will install Suricata IDS and ElasticStack on the following server.
・First Server　Suricata IDS & Filebeat　: Ubuntu Server24.04 IP(192.168.11.83)
・Second server　ElasticStack & kibana　: Debian12.x IP(192.168.11.85)

 First Server: Suricata Installation

SURICATA IDS/IPS is an open-source intrusion detection system that monitors network traffic and detects suspicious activity. Its core mechanism is signature-based, enabling it to detect predefined patterns of malicious communication. A key feature of Suricata is its ability to not only detect threats but also actively defend against them.

1.Suricata

Installing Suricata

Version Check

Enable suricata.service to run at system restart.

The Suricata service must be configured first, so stop the service.

2.Configuring Suricata

①Suricata determines the interface and IP address for inspecting network packets.

Edit the /etc/suricata/suricata.yaml file

SURICATA supports live rule reloading, allowing you to add, remove, or edit rules without restarting the running SURICATA process. To enable the live reload option, scroll to the bottom of the configuration file and add the following line:

This setting allows you to send the SIGUSR2 system signal to the running process, causing SURICATA to reload the modified rules into memory. Commands like the following notify the SURICATA process to reload the rule set without restarting the process:

➁Add Rule Set
Suricata includes a tool called suricata-update that can retrieve rule sets from external providers. Running the following command downloads the latest rule set for the SURICATA server:

suricata-update has acquired the free Emerging Threats ET Open Rules and saved them to Suricata's /etc/suricata/rules/suricata.rules file. It also indicates the number of processed rules; in this example, 64,661 were added, of which 48,809 were enabled.

➂Add Rule Set Provider
Display the default provider list

For example, when including the tgreen/hunting rule set

Perform the update

3.Testing Suricata Configuration

①Changing the Default Rule Path

➁Run the verification tool

Restart the Suricata service

Check the log file

4.Testing Suricata Rules

①Test ET Open rule number 2100498 using the following command:

②Check the log file using the specified rule number.

 ③Checking events in /var/log/suricata/eve.log

Install jq

Search for signature 2100498 and filter EVE log events
Display alert objects with a signature_id key matching the value 2100498

④Creating and Applying Custom Rules
Create the following custom signature to scan SSH traffic to non-SSH ports, and include it in the file /etc/suricata/rules/local.rules (in this case, only for IPv4 where the SSH port is 22):

Editing suricata.yaml

Verify SURICATA Configuration

Edit the custom signature from earlier and convert it to use a drop action.

⑤Reconfigure SURICATA and restart it in IPS mode.

SURICATA operates in IDS mode by default and does not actively block network traffic. To switch to IPS mode, you must modify SURICATA's default settings.

Use the systemctl edit command to create a new systemd override file.：

Add the following text in red at the beginning

Reload the configuration and restart Suricata.

With this change, you are now ready to send traffic to Suricata using the UFW firewall.

⑥Configuring UFW to send traffic to Suricata
To add the rules required for Suricata to UFW, you must directly edit the firewall files /etc/ufw/before.rules and /etc/ufw/before6.rules. (Assuming the SSH port is 22)

If using IPv6, similarly modify /etc/ufw/before6.rules.

Restart UFW

Verify that SURICATA is correctly dropping traffic.
Change the default action for signatures from alert or log to active dropping traffic.
Open the /etc/suricata/rules/suricata.rules file and comment out any entries matching sid:2100498.

Create a new entry as sid:2100498 in /etc/suricata/rules/local.rules

Suricata restart

Test this rule using curl

Using jq to check eve.log for "action": "blocked"

Elastic Stack 9.x Installation

Install and configure the Elastic Stack to visualize and search SURICATA logs
This section is primarily performed on a second Debian 12.x server.

①Install the Elastic Stack 9.x repository signing key

➁Install the Elastic Stack 9.x repository

update

➂Installing Elasticsearch 9.x on Debian 12.x

During installation, security features are enabled by default;

Authentication and authorization are enabled.
TLS is enabled and configured for the transport layer and HTTP layer.
An Elastic superuser account (elastic) and its password are created.

④Configuring Elasticsearch 9.x on Ubuntu
Since this is a basic single-node cluster, we will use the default settings.

Checking the Elasticsearch configuration file /etc/elasticsearch/elasticsearch.yml reveals that security settings are enabled.

⑤Elasticsearch startup

Start Elasticsearch and configure it to run at system startup.

Check the status

You can also use the curl command to check the status of Elasticsearch. Replace the IP address as appropriate.

When prompted, enter the elastic built-in superuser password generated during Elasticsearch installation. The output will appear as follows:

Also, ensure that both the HTTP port and the transport port are open;

⑥Resetting Elasticsearch Passwords
The automatically generated Elastic user password is too complex, so reset it using the /usr/share/elasticsearch/bin/elasticsearch-reset-password command.
To reset the password, execute the command.

⑦Elasticsearch logs
Elasticsearch writes logs to the /var/log/elasticsearch path. The log file you need to check when there is an issue with the Elasticsearch instance is /var/log/elasticsearch/CLUSTER_NAME.log.

CLUSTER_NAME is the value of the cluster.name option in the elasticsearch.yaml file. If this value is not changed, the default is elasticsearch, and the log file will be located at /var/log/elasticsearch/elasticsearch.log.

Log

Kibana 9.x Installation

This section is primarily performed on a second Debian 12.x server.

①Install

➁Configuring Kibana 9
Kibana is configured by default to run on localhost:5601. To allow external access, edit the configuration file and replace the value of server.host with the interface IP.

Rewrite as follows:

➂Generating a Kibana-Elasticsearch Enrollment Token
To configure a Kibana instance to communicate with an existing Elasticsearch cluster with security enabled, an enrollment token is required. An enrollment token for Kibana can be generated using the following command:

④Generating Kibana Encryption Keys
Kibana uses encryption keys in several areas, from encrypting data in Kibana-related indices to storing session information. The required keys are as follows:

• xpack.encryptedSavedObjects.encryptionKey:Used to encrypt saved objects such as dashboards and visualizations.
• xpack.reporting.encryptionKey: Used for encrypting saved reports
• xpack.security.encryptionKey: Used for encrypting session information

These are generated using the following command:

The output will be as follows:

Insert the above into Kibana's configuration file kibana.yml.

⑤Running Kibana
Start Kibana and configure it to run at system startup.

status

The following appears toward the end of the output:

Copy the provided Kibana URL (including the code) and use it in your browser to access Kibana and complete the setup.

Similarly, Kibana logs are available in /var/log/kibana/kibana.log and /var/log/syslog.

⑥Accessing the Kibana 9 Dashboard

Access http://192.168.11.85:5601/?code=657887 (copy the appropriate address for each user)

If UFW is running, open the Kibana port.

When you access Kibana 9, the welcome page prompts you to configure Elastic.
First, enter the generated enrollment token.
Copy the Kibana token generated using the command /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana and paste it into the box.When you access Kibana 9, the welcome page prompts you to configure Elastic.
First, enter the generated enrollment token.
Copy the Kibana token generated using the command `/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana` and paste it into the box.

Accessing http://192.168.11.85:5601/?code=657887

Paste the token, and Kibana will automatically connect to Elasticsearch.
Click Configure Elastic. The settings will be saved, and Elasticsearch will be configured and restarted.

Proceed to the login page. Log in using the generated Elastic user credentials.

On the welcome page, click "Explore on my own" to proceed to the Kibana 9.x dashboard.

Installing Filebeat 9

To collect and monitor logs from Ubuntu 24.04 using the ELK Stack, you must install Filebeat.
This task will be performed on the first server: Ubuntu 24.04 with IP address (192.168.11.83).

①Install the Elastic Stack 9.x repository signing key

➁Install the Elastic Stack 9.x repository

update

➂Installing filebeat 9.x on Ubuntu 24.04

④Filebeat Logging Configuration

The default Filebeat configuration file is /etc/filebeat/filebeat.yml
To have Filebeat write logs to its own log file, enter the following configuration in the configuration file:

⑤Connect Filebeat to the data processing system
Configure Filebeat to connect to the data processing system. In this case, it is Elasticsearch.
To send logs directly to Elasticsearch, edit the Filebeat configuration file and update the output configuration section.

Connecting to Elasticsearch 9 requires SSL and authentication.
Verify that you can connect to Elasticsearch port 9200/tcp (Port 9200 is open on the second server, Debian 12.x).

⑥Creating the Elasticsearch CA Certificate
Download the Elasticsearch CA certificate and save it to any directory (in this case, save it as /etc/filebeat/elastic-ca.crt).

Retrieve the credentials Filebeat uses for Elasticsearch authentication. In this case, use the credentials for the default superuser, the Elastic user.

⑤Configuration File Test

⑦Enable the built-in Suricata module in Filebeats

The above command will change /etc/filebeat/modules.d/suricata.yml.disabled to /etc/filebeat/modules.d/suricata.yml, but the contents remain unchanged. Therefore, edit it as follows:
Modify modules.d/suricata.yml as follows:

⑧Set up the initial environment
Load SIEM dashboards and pipelines into Elasticsearch
Execute the filebeat setup command

⑨Start the Filebeat service

⑩Verify in Kibana

Log back into Kibana. http://192.168.11.85:5601

Enter "Suricata Events Overview" in the top search field, then click [Filebeat Suricata]Events Overview.

All Suricata events from the past 15 minutes are displayed.

To display alerts for malicious traffic, click the "Alerts" text next to the Suricata logo.

Create a new user account so that you do not need to use the elastic superuser account.
Click the three horizontal lines icon in the upper left corner, then select [Stack Management] under [Management].

「security」「Users」Selection

Click the "Create user" button in the upper right corner.

Enter the new user information, assign the kibana_admin, kibana_system, monitoring_user, editor roles under Privileges, and finally click [Create user].

Log out of the current profile and verify that you can log in with the newly created user account.