業務用エアコン関連の技術情報、エラーコード、環境問題対策に関する別サイト「エアコンの安全な修理･適切なフロン回収」

Debian13.6 : Suricata+Elasticsearch+Kibana+Filebeat

2026.07.23

Prerequisite

We will install Suricata IDS and Elastic on the following servers
・1st server　Suricata IDS & Filebeat　: Debian13.6 IP(192.168.11.83)
・2nd server　Elasticsearch & kibana　: Debian13.5 IP(192.168.11.85)

 1st server Suricata Install

SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic. Its basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.

1.Suricata

①Install required packages

# apt -y install wget curl dirmngr apt-transport-https gnupg2 ca-certificates lsb-release debian-archive-keyring unzip

➁Suricata install

# apt update
# apt -y install suricata

Check Version

# suricata -V
This is Suricata version 7.0.10 RELEASE

Enable suricata.service to run on system reboot

# systemctl enable suricata.service
Synchronizing state of suricata.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable suricata

Stop the Suricata service as it needs to be configured first.

# systemctl stop suricata.service

2.Configure Suricata

①Determine interface and IP address where Suricata will inspect network packets

# ip --brief add
lo               UNKNOWN        127.0.0.1/8 ::1/128 
ens33            UP             192.168.11.83/24 fe80::20c:29ff:fe8b:5daa/64

Edit /etc/suricata/suricata.yaml file

# vi /etc/suricata/suricata.yaml
 
Line 18 : Change (own network)
HOME_NET: "[192.168.11.0/24]"

Per Line136 : change
community-id: false　→　community-id: true

Per Line 622 : change
af-packet:
  - interface: eth0
↓
af-packet:
  - interface: ens33 ←Change to your own interface name

➁Add rule set
Suricata has a tool called suricata-update that allows you to retrieve rulesets from external providers. You can download the latest rulesets for your suricata server by running

# suricata-update -o /var/lib/suricata/rules

-------------------------------------------------------------
23/7/2026 -- 12:11:43 - <Info> -- Ignoring file f625293e2432dbf07497d06349de6f0b/rules/emerging-deleted.rules
23/7/2026 -- 12:11:44 - <Info> -- Loaded 68012 rules.
23/7/2026 -- 12:11:44 - <Info> -- Disabled 15 rules.
23/7/2026 -- 12:11:44 - <Info> -- Enabled 0 rules.
23/7/2026 -- 12:11:44 - <Info> -- Modified 0 rules.
23/7/2026 -- 12:11:44 - <Info> -- Dropped 0 rules.
23/7/2026 -- 12:11:45 - <Info> -- Enabled 136 rules for flowbit dependencies.
23/7/2026 -- 12:11:45 - <Info> -- Backing up current rules.
23/7/2026 -- 12:11:45 - <Info> -- Writing rules to /var/lib/suricata/rules/suricata.rules: total: 68012; enabled: 52077; added: 68012; removed 0; modified: 0
23/7/2026 -- 12:11:45 - <Info> -- Writing /var/lib/suricata/rules/classification.config
23/7/2026 -- 12:11:45 - <Info> -- Testing with suricata -T.
23/7/2026 -- 12:12:14 - <Info> -- Done.

It shows that suricata-update has retrieved the free Emerging Threats ET Open Rules and saved them in Suricata's /etc/suricata/rules/suricata.rules file. It also shows the number of rules processed, in this example 68012 were added, of which 52077 were activated.

➂Adding Rule Set Providers
List Default Providers

# suricata-update list-sources

Name: abuse.ch/feodotracker
  Vendor: Abuse.ch
  Summary: Abuse.ch Feodo Tracker Botnet C2 IP ruleset
  License: CC0-1.0
Name: abuse.ch/sslbl-blacklist
  Vendor: Abuse.ch
  Summary: Abuse.ch SSL Blacklist
  License: CC0-1.0
  Replaces: sslbl/ssl-fp-blacklist
Name: abuse.ch/sslbl-c2
  Vendor: Abuse.ch
  Summary: Abuse.ch Suricata Botnet C2 IP Ruleset
  License: CC0-1.0
Name: abuse.ch/sslbl-ja3
  Vendor: Abuse.ch
  Summary: Abuse.ch Suricata JA3 Fingerprint Ruleset
  License: CC0-1.0
  Replaces: sslbl/ja3-fingerprints
Name: abuse.ch/urlhaus
  Vendor: abuse.ch
  Summary: Abuse.ch URLhaus Suricata Rules
  License: CC0-1.0
Name: aleksibovellan/nmap
  Vendor: aleksibovellan
  Summary: Suricata IDS/IPS Detection Rules Against NMAP Scans
  License: MIT
Name: et/open
  Vendor: Proofpoint
  Summary: Emerging Threats Open Ruleset
  License: MIT
Name: et/pro
  Vendor: Proofpoint
  Summary: Emerging Threats Pro Ruleset
  License: Commercial
  Replaces: et/open
  Parameters: secret-code
  Subscription: https://www.proofpoint.com/us/threat-insight/et-pro-ruleset
Name: etnetera/aggressive
  Vendor: Etnetera a.s.
  Summary: Etnetera aggressive IP blacklist
  License: MIT
Name: oisf/trafficid
  Vendor: OISF
  Summary: Suricata Traffic ID ruleset
  License: MIT
Name: pawpatrules
  Vendor: pawpatrules
  Summary: PAW Patrules is a collection of rules for IDPS / NSM Suricata engine
  License: CC-BY-SA-4.0
Name: ptrules/open
  Vendor: Positive Technologies
  Summary: Positive Technologies Open Ruleset
  License: Custom
Name: scwx/enhanced
  Vendor: Secureworks
  Summary: Secureworks suricata-enhanced ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: scwx/malware
  Vendor: Secureworks
  Summary: Secureworks suricata-malware ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: scwx/security
  Vendor: Secureworks
  Summary: Secureworks suricata-security ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: stamus/lateral
  Vendor: Stamus Networks
  Summary: Lateral movement rules
  License: GPL-3.0-only
Name: stamus/nrd-14-open
  Vendor: Stamus Networks
  Summary: Newly Registered Domains Open only - 14 day list, complete
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed
Name: stamus/nrd-30-open
  Vendor: Stamus Networks
  Summary: Newly Registered Domains Open only - 30 day list, complete
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed
Name: stamus/nrd-entropy-14-open
  Vendor: Stamus Networks
  Summary: Newly Registered Domains Open only - 14 day list, high entropy
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed
Name: stamus/nrd-entropy-30-open
  Vendor: Stamus Networks
  Summary: Newly Registered Domains Open only - 30 day list, high entropy
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed
Name: stamus/nrd-phishing-14-open
  Vendor: Stamus Networks
  Summary: Newly Registered Domains Open only - 14 day list, phishing
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed
Name: stamus/nrd-phishing-30-open
  Vendor: Stamus Networks
  Summary: Newly Registered Domains Open only - 30 day list, phishing
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed
Name: tgreen/hunting
  Vendor: tgreen
  Summary: Threat hunting rules
  License: GPLv3

If you include the tgreen/hunting ruleset as an example

# suricata-update enable-source tgreen/hunting

23/7/2026 -- 12:14:46 - <Info> -- Using data-directory /var/lib/suricata.
23/7/2026 -- 12:14:46 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml
23/7/2026 -- 12:14:46 - <Info> -- Using /etc/suricata/rules for Suricata provided rules.
23/7/2026 -- 12:14:46 - <Info> -- Found Suricata version 7.0.10 at /usr/bin/suricata.
23/7/2026 -- 12:14:46 - <Warning> -- Source index does not exist, will use bundled one.
23/7/2026 -- 12:14:46 - <Warning> -- Please run suricata-update update-sources.
23/7/2026 -- 12:14:46 - <Info> -- Creating directory /var/lib/suricata/update/sources
23/7/2026 -- 12:14:46 - <Info> -- Enabling default source et/open
23/7/2026 -- 12:14:46 - <Info> -- Source tgreen/hunting enabled

Perform update

# suricata-update update-sources

3.Suricata Configuration Testing

①Testing the configuration file

# suricata -T -c /etc/suricata/suricata.yaml -v

Notice: suricata: This is Suricata version 7.0.10 RELEASE running in SYSTEM mode
Info: cpu: CPUs/cores online: 2
Info: suricata: Running suricata under test mode
Info: suricata: Setting engine mode to IDS mode by default
Info: exception-policy: master exception-policy set to: auto
Info: logopenfile: fast output device (regular) initialized: fast.log
Info: logopenfile: eve-log output device (regular) initialized: eve.json
Info: logopenfile: stats output device (regular) initialized: stats.log
Info: detect: 1 rule files processed. 52077 rules successfully loaded, 0 rules failed, 0
Info: threshold-config: Threshold config parsed: 0 rule(s) found
Info: detect: 52082 signatures processed. 1304 are IP-only rules, 4506 are inspecting packet payload, 46037 inspect application layer, 109 are decoder event only
Notice: suricata: Configuration provided was successfully loaded. Exiting.

Suricata service restart

# systemctl start suricata

Check Status

# systemctl status suricata

● suricata.service - Suricata IDS/IDP daemon
     Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-07-23 12:17:48 JST; 26s ago
 Invocation: 9c329fa108b74bd8bfce7a043a3f98f5
       Docs: man:suricata(8)
             man:suricatasc(8)
             https://suricata.io/documentation/
    Process: 16254 ExecStart=/usr/bin/suricata -D --af-packet -c /etc/suricata/suricata.yaml --pidfile /run/suricata.p>
   Main PID: 16257 (Suricata-Main)
      Tasks: 1 (limit: 4553)
     Memory: 492.6M (peak: 511.1M)
        CPU: 26.755s
     CGroup: /system.slice/suricata.service
             └─16257 /usr/bin/suricata -D --af-packet -c /etc/suricata/suricata.yaml --pidfile /run/suricata.pid       

Jul 23 12:17:48 Lepard systemd[1]: Starting suricata.service - Suricata IDS/IDP daemon...
Jul 23 12:17:48 Lepard suricata[16254]: i: suricata: This is Suricata version 7.0.10 RELEASE running in SYSTEM mode    
Jul 23 12:17:48 Lepard systemd[1]: Started suricata.service - Suricata IDS/IDP daemon.

Check log files

# tail -f /var/log/suricata/suricata.log

[16257 - Suricata-Main] 2026-07-23 12:17:48 Info: logopenfile: fast output device (regular) initialized: fast.log
[16257 - Suricata-Main] 2026-07-23 12:17:48 Info: logopenfile: eve-log output device (regular) initialized: eve.json   
[16257 - Suricata-Main] 2026-07-23 12:17:48 Info: logopenfile: stats output device (regular) initialized: stats.log    
[16257 - Suricata-Main] 2026-07-23 12:18:05 Info: detect: 1 rule files processed. 52077 rules successfully loaded, 0 rules failed, 0
[16257 - Suricata-Main] 2026-07-23 12:18:05 Info: threshold-config: Threshold config parsed: 0 rule(s) found
[16257 - Suricata-Main] 2026-07-23 12:18:05 Info: detect: 52082 signatures processed. 1304 are IP-only rules, 4506 are inspecting packet payload, 46037 inspect application layer, 109 are decoder event only
[16257 - Suricata-Main] 2026-07-23 12:18:17 Warning: af-packet: ens33: AF_PACKET tpacket-v3 is recommended for non-inline operation
[16257 - Suricata-Main] 2026-07-23 12:18:17 Info: runmodes: ens33: creating 2 threads
[16257 - Suricata-Main] 2026-07-23 12:18:17 Info: unix-manager: unix socket '/var/run/suricata-command.socket'
[16257 - Suricata-Main] 2026-07-23 12:18:17 Notice: threads: Threads created -> W: 2 FM: 1 FR: 1   Engine started.

4.Testing the Suricata Rule

①Use the following command to test using ET Open Signature ID 2100498

# curl http://testmynids.org/uid/index.html
uid=0(root) gid=0(root) groups=0(root)

②Check the log file using the specified rule number.
Suricata comes with the following two log files enabled by default.

/var/log/suricata/fast.log
/var/log/suricata/eve.log
To check the log entries corresponding to the curl request, use the grep command to examine the /var/log/suricata/fast.log log file.
2100498 Searches for log entries using the rule identifier. (For IPv4)

# grep 2100498 /var/log/suricata/fast.log
07/23/2026-12:19:16.953615  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 13.227.50.36:80 -> 192.168.11.83:55132

 ③Check events in /var/log/suricata/eve.log

Install jq

# apt -y install jq

Filter EVE Log events by searching for 2100498 signatures
Display alert objects with signature_id keys that match the values in 2100498

# jq 'select(.alert .signature_id==2100498)' /var/log/suricata/eve.json

{
  "timestamp": "2026-07-23T12:19:16.953615+0900",
  "flow_id": 1180740665949227,
  "in_iface": "ens33",
  "event_type": "alert",
  "src_ip": "13.227.50.36",
  "src_port": 80,
  "dest_ip": "192.168.11.83",
  "dest_port": 55132,
  "proto": "TCP",
  "pkt_src": "wire/pcap",
  "community_id": "1:x46E/XOLACRMqCIuO+StFqu5Uz0=",
  "tx_id": 0,
  "tx_guessed": true,
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 2100498,
    "rev": 7,
    "signature": "GPL ATTACK_RESPONSE id check returned root",
    "category": "Potentially Bad Traffic",
    "severity": 2,
    "metadata": {
      "confidence": [
        "Medium"
      ],
      "created_at": [
        "2010_09_23"
      ],
      "signature_severity": [
        "Informational"
      ],
      "updated_at": [
        "2019_07_26"
      ]
    }
  },
  "http": {
    "hostname": "testmynids.org",
    "url": "/uid/index.html",
    "http_user_agent": "curl/8.14.1",
    "http_content_type": "text/html",
    "http_method": "GET",
    "protocol": "HTTP/1.1",
    "status": 200,
    "length": 39
  },
  "files": [
    {
      "filename": "/uid/index.html",
      "gaps": false,
      "state": "CLOSED",
      "stored": false,
      "size": 39,
      "tx_id": 0
    }
  ],
  "app_proto": "http",
  "direction": "to_client",
  "flow": {
    "pkts_toserver": 5,
    "pkts_toclient": 4,
    "bytes_toserver": 430,
    "bytes_toclient": 805,
    "start": "2026-07-23T12:19:16.274912+0900",
    "src_ip": "192.168.11.83",
    "dest_ip": "13.227.50.36",
    "src_port": 55132,
    "dest_port": 80
  }
}

5.Reset SURICATA and restart it in IPS mode.

SURICATA operates in IDS mode by default and does not actively block network traffic. To switch to IPS mode, you must modify SURICATA's default settings.

5.1 Enabling nfqueue mode

# vi /usr/lib/systemd/system/suricata.service

The following changes will be made
[Service]
#ExecStart=/usr/bin/suricata -D --af-packet -c /etc/suricata/suricata.yaml - -pidfile /run/suricata.pid
ExecStart=/usr/bin/suricata -D -q 0 -c /etc/suricata/suricata.yaml --pidfile /run/suricata.pid

Reload the configuration and restart Suricata.

# systemctl daemon-reload
# systemctl restart suricata.service

5.2 Configuring UFW to Send Traffic to Suricata

# vi /etc/ufw/before.rules

Add the following to line 19
# Don't delete these required lines, otherwise there will be errors
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines

## Start Suricata NFQUEUE rules
-I INPUT 1 -p tcp --dport 2244 -j NFQUEUE --queue-bypass
-I OUTPUT 1 -p tcp --sport 2244 -j NFQUEUE --queue-bypass
-I FORWARD -j NFQUEUE
-I INPUT 2 -j NFQUEUE
-I OUTPUT 2 -j NFQUEUE
## End Suricata NFQUEUE rules

For IPv6, edit the following file in the same way

# vi /etc/ufw/before6.rules

Restart the UFW service

#  systemctl restart ufw.service

5.3 Create local rules and define them in the Suricata configuration file
First, to avoid conflicts, disable packets that match the signature sid:2100498 defined in suricata.rules.
Find the line matching sid:2100498 and comment it out.

# vi /var/lib/suricata/rules/suricata.rules

#alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, confidence Medium, signature_severity Informational, updated_at 2019_07_26;)

Create a new local rule(Set the action to "drop"

# vi /var/lib/suricata/rules/local.rules
drop ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, confidence Medium, signature_severity Informational, updated_at 2019_07_26;)

Define in the Suricata configuration file

# vi /etc/suricata/suricata.yaml

dd around line 2200
rule-files:
     - suricata.rules
     - local.rules

# systemctl restart suricata

5.4 Test this rule using curl

# curl --max-time 5 http://testmynids.org/uid/index.html
curl: (28) Operation timed out after 5000 milliseconds with 0 out of 39 bytes received

Using jq to check eve.log for "action": "blocked"

# jq 'select(.alert .signature_id==2100498)' /var/log/suricata/eve.json

{
  "timestamp": "2026-07-23T13:16:14.591701+0900",
  "flow_id": 1889823126448824,
  "event_type": "alert",
  "src_ip": "13.227.50.120",
  "src_port": 80,
  "dest_ip": "192.168.11.83",
  "dest_port": 33606,
  "proto": "TCP",
  "pkt_src": "wire/pcap",
  "community_id": "1:cdGq8bYrcTXFZqFVKbHGW1NtEi4=",
  "tx_id": 0,
  "tx_guessed": true,
  "alert": {
    "action": "blocked",
    "gid": 1,
    "signature_id": 2100498,
    "rev": 7,
    "signature": "GPL ATTACK_RESPONSE id check returned root",
    "category": "Potentially Bad Traffic",
    "severity": 2,
    "metadata": {
      "confidence": [
        "Medium"
      ],
      "created_at": [
        "2010_09_23"
      ],
      "signature_severity": [
        "Informational"
      ],
      "updated_at": [
        "2019_07_26"
      ]
    }
  },
  "http": {
    "hostname": "testmynids.org",
    "url": "/uid/index.html",
    "http_user_agent": "curl/8.14.1",
    "http_content_type": "text/html",
    "http_method": "GET",
    "protocol": "HTTP/1.1",
    "status": 200,
    "length": 39
  },
  "files": [
    {
      "filename": "/uid/index.html",
      "gaps": false,
      "state": "CLOSED",
      "stored": false,
      "size": 39,
      "tx_id": 0
    }
  ],
  "app_proto": "http",
  "direction": "to_client",
  "flow": {
    "pkts_toserver": 3,
    "pkts_toclient": 4,
    "bytes_toserver": 256,
    "bytes_toclient": 753,
    "start": "2026-07-23T13:16:14.571080+0900",
    "src_ip": "192.168.11.83",
    "dest_ip": "13.227.50.120",
    "src_port": 33606,
    "dest_port": 80
  }
}

Elastic stack 9.x installation

Install & configure Elastic Stack to visualize & search SURICATA logs
This section is basically done on a second Debian13.5 server

①Install Elastic stack 9.x repository signing key

# apt update
# apt -y install gnupg2
# wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
gpg --dearmor -o /etc/apt/trusted.gpg.d/elastic.gpg

➁Install Elastic Stack 9.x repository

# echo "deb https://artifacts.elastic.co/packages/9.x/apt stable main" > /etc/apt/sources.list.d/elastic-9.x.list

update

# apt update

➂Installing Elasticsearch 9.x 

# apt install elasticsearch -y

During installation, security features are enabled by default;

--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : 2xI*8Yxqsy=RfCDWI7qK

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

-------------------------------------------------------------------------------------------------

Certifications and authorizations are in effect.
TLS at the transport and HTTP layers is enabled and configured.
An Elastic super user account (elastic) and its password will be created.

④Configuring Elasticsearch 9.x
Since this is a basic single-node cluster, we will use the default settings.

Check the Elasticsearch configuration file /etc/elasticsearch/elasticsearch.yml and you will see that the security settings are enabled

# cat /etc/elasticsearch/elasticsearch.yml

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
#
# The following settings, TLS certificates, and keys have been automatically    
# generated to configure Elasticsearch security features on 23-07-2026 06:40:17
#
# --------------------------------------------------------------------------------

# Enable security features
xpack.security.enabled: true

xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["Lion"]

# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0

# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0

#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

⑤Start Elasticsearch

Start Elasticsearch and allow it to run at system startup

# systemctl daemon-reload
# systemctl enable --now elasticsearch
# systemctl start elasticsearch

Check Status

# systemctl status elasticsearch

● elasticsearch.service - Elasticsearch
     Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-07-23 15:43:52 JST; 17s ago
 Invocation: 9a58989a95434e8c9fd4c3b89fa1bc50
       Docs: https://www.elastic.co
   Main PID: 19293 (server-launcher)
      Tasks: 98 (limit: 4562)
     Memory: 2.4G (peak: 2.4G)
        CPU: 50.782s
     CGroup: /system.slice/elasticsearch.service
             tq19293 /usr/share/elasticsearch/lib/tools/server-launcher/server-launcher -p /var/run/elasticsearch/elasticsearch.pid --quiet
             tq19343 /usr/share/elasticsearch/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch >
             mq19365 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller

Jul 23 15:43:21 Lion systemd[1]: Starting elasticsearch.service - Elasticsearch...
Jul 23 15:43:45 Lion systemd-entrypoint[19293]: WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
Jul 23 15:43:45 Lion systemd-entrypoint[19293]: WARNING: sun.misc.Unsafe::arrayBaseOffset has been called by com.google.protobuf.UnsafeUtil$MemoryAccessor>
Jul 23 15:43:45 Lion systemd-entrypoint[19293]: WARNING: Please consider reporting this to the maintainers of class com.google.protobuf.UnsafeUtil$MemoryA>
Jul 23 15:43:45 Lion systemd-entrypoint[19293]: WARNING: sun.misc.Unsafe::arrayBaseOffset will be removed in a future release
Jul 23 15:43:52 Lion systemd[1]: Started elasticsearch.service - Elasticsearch.

You can also check the status of the ES using the curl command; replace IP as appropriate

# curl https://192.168.11.85:9200 --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic

When prompted, enter the Elasticsearch password generated during the Elasticsearch installation
The output will look like this

Enter host password for user 'elastic':  ←Password
{
  "name" : "Lion",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "GtkKCPx0SrqtG-O5U8iGKQ",
  "version" : {
    "number" : "9.4.4",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "77cd231096e56b56ac1d24445a9430a252622e6d",
    "build_date" : "2026-07-15T22:13:42.125968334Z",
    "build_snapshot" : false,
    "lucene_version" : "10.4.0",
    "minimum_wire_compatibility_version" : "8.19.0",
    "minimum_index_compatibility_version" : "8.0.0"
  },
  "tagline" : "You Know, for Search"
}

Also, make sure that both the HTTP and transport ports are open;

# ss -altnp | grep -E "9200|9300"

LISTEN 0      4096                    *:9200            *:*    users:(("java",pid=19343,fd=838))                                                           
LISTEN 0      4096   [::ffff:127.0.0.1]:9300            *:*    users:(("java",pid=19343,fd=836))                                                           
LISTEN 0      4096                [::1]:9300         [::]:*    users:(("java",pid=19343,fd=835))

⑥Reset Elasticsearch Password
The auto-generated Elastic user password is too complex, reset it using the command /usr/share/elasticsearch/bin/elasticsearch-reset-password
To reset the password, run the command

# /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -i

This tool will reset the password of the [elastic] user.
You will be prompted to enter the password.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]:
Re-enter password for [elastic]:
Password for the [elastic] user successfully reset.

⑦Elasticsearch Logs
Elasticsearch writes logs to the /var/log/elasticsearch path; the log you need to check if there is a problem with your Elasticsearch instance is /var/log/elasticsearch/CLUSTER_NAME.log The logs you need to check if there is a problem with your Elasticsearch instance are

CLUSTER_NAME is the value of the cluster.name option in the elasticsearch.yaml file. If this value is not changed, the default is elasticsearch and the log file is /var/log/elasticsearch/elasticsearch.log.

# tail -f /var/log/elasticsearch/elasticsearch.log

[2026-07-23T15:43:57,998][INFO ][o.e.x.i.IndexLifecycleTransition] [Lion] moving index [.ds-.logs-elasticsearch.deprecation-default-2026.07.23-000001] from [{"phase":"hot","action":"unfollow","name":"branch-check-unfollow-prerequisites"}] to [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}] in policy [.deprecation-indexing-ilm-policy]
[2026-07-23T15:43:58,037][INFO ][o.e.c.m.MetadataMappingService] [Lion] [.ds-.logs-elasticsearch.deprecation-default-2026.07.23-000001/dn4Q10wOTyOEdFFCl3WKNQ] update_mapping [_doc]
[2026-07-23T15:44:02,948][INFO ][o.e.c.m.MetadataCreateIndexService] [Lion] creating index [.ds-ilm-history-7-2026.07.23-000001] in project [default], cause [initialize_data_stream], templates [provided in request], shards [1]/[1]
[2026-07-23T15:44:02,952][INFO ][o.e.c.m.MetadataCreateDataStreamService] [Lion] adding data stream [ilm-history-7] with write index [.ds-ilm-history-7-2026.07.23-000001], backing indices [], and aliases []
[2026-07-23T15:44:02,952][INFO ][o.e.c.r.a.AllocationService] [Lion] in project [default] updating number_of_replicas to [0] for indices [.ds-ilm-history-7-2026.07.23-000001]
[2026-07-23T15:44:03,045][INFO ][o.e.c.r.a.AllocationService] [Lion] current.health="GREEN" message="Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.ds-ilm-history-7-2026.07.23-000001][0]]])." previous.health="YELLOW" reason="shards started [[.ds-ilm-history-7-2026.07.23-000001][0]]"
[2026-07-23T15:47:24,848][INFO ][o.e.x.s.a.f.FileUserPasswdStore] [Lion] users file [/etc/elasticsearch/users] changed. updating users...
[2026-07-23T15:47:24,854][INFO ][o.e.x.s.a.f.FileUserRolesStore] [Lion] users roles file [/etc/elasticsearch/users_roles] changed. updating users roles...
[2026-07-23T15:47:44,868][INFO ][o.e.x.s.a.f.FileUserPasswdStore] [Lion] users file [/etc/elasticsearch/users] changed. updating users...
[2026-07-23T15:47:44,873][INFO ][o.e.x.s.a.f.FileUserRolesStore] [Lion] users roles file [/etc/elasticsearch/users_roles] changed. updating users roles...

Kibana 9.x installation

We will also perform this section on the second Debian 13.5 server.

①Install

# apt -y install kibana

Installing:
  kibana

Summary:
  Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 0
  Download size: 454 MB
  Space needed: 1,426 MB / 24.1 GB available

Get:1 https://artifacts.elastic.co/packages/9.x/apt stable/main amd64 kibana amd64 9.4.4 [454 MB]
Fetched 454 MB in 13s (36.1 MB/s)
Selecting previously unselected package kibana.
(Reading database ... 42589 files and directories currently installed.)
Preparing to unpack .../kibana_9.4.4_amd64.deb ...
Unpacking kibana (9.4.4) ...
Setting up kibana (9.4.4) ...
Creating kibana group... OK
Creating kibana user... OK
Created Kibana keystore in /etc/kibana/kibana.keystore

➁Configure Kibana 9
Kibana is configured by default to run on localhost:5601. To allow external access, edit the configuration file and replace the server.host value with the interface IP.

# vi /etc/kibana/kibana.yml

Line 6: Uncomment
server.port: 5601
Add around line 12
# To allow connections from remote users, set this parameter to a non-loopback address.
#server.host: "localhost"
server.host: "192.168.11.85"

➂Generate Kibana-Elasticsearch Enrollment Token
To configure your Kibana instance to communicate with an existing Elasticsearch cluster with security features enabled, you need an Enrollment Token.

# /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

eyJ2ZXIiOiI4LjE0LjAiLCJhZHIiOlsiMTkyLjE2OC4xMS44NTo5MjAwIl0sImZnciI6IjMwZTYxNzczNDNlYTJlZGIwZjE0N2Q0ZTliYWRmZjA5ZTM5MDc0NTg3ZTUzMjM4YjJlMGVlNDZiMmY5ZDA2YzEiLCJrZXkiOiJSTS0talo4QnZTTjg2UG5GdlVfOTpnLXAxc2lFMl82dU03VVRxdGFXUWZBIn0=

④Generate Kibana encryption keys
Kibana uses encryption keys in several areas, from encrypting data for Kibana-related indexes to storing session information. The required keys are as follows

  • xpack.encryptedSavedObjects.encryptionKey:Used to encrypt stored objects such as dashboards and visualizations
  • xpack.reporting.encryptionKey: Used to encrypt saved reports
  • xpack.security.encryptionKey: Used to encrypt session information

These can be generated using the command below

# /usr/share/kibana/bin/kibana-encryption-keys generate

Settings:
xpack.encryptedSavedObjects.encryptionKey: 0762c451945648ebcba9a2d22148f4acc4f2e3165672ae3a4adda417f2e4f983
xpack.reporting.encryptionKey: fedd9c63eed9aeed64a08c64f7ce7efea407dc50610b62b2c54685bfed054f76
xpack.security.encryptionKey: d7a9d29b94a7bbf878aacd6698d999672302282951870a4084cb3f6f72a1041c

Insert these lines into Kibana config file, kibana.yml

# echo -e "xpack.encryptedSavedObjects.encryptionKey: 0762c451945648ebcba9a2d22148f4acc4f2e3165672ae3a4adda417f2e4f983
xpack.reporting.encryptionKey: fedd9c63eed9aeed64a08c64f7ce7efea407dc50610b62b2c54685bfed054f76
xpack.security.encryptionKey: d7a9d29b94a7bbf878aacd6698d999672302282951870a4084cb3f6f72a1041c" >> /etc/kibana/kibana.yml

⑤Running Kibana
Start Kibana 9 and allow it to run at system startup.

# systemctl enable --now kibana
# systemctl start kibana

Check Status

# systemctl status kibana

● kibana.service - Kibana
     Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-07-23 15:55:11 JST; 35s ago
 Invocation: 4df7b662cf534cff9b5a55c6736a7e4b
       Docs: https://www.elastic.co
   Main PID: 19660 (MainThread)
      Tasks: 11 (limit: 4562)
     Memory: 787.6M (peak: 788.1M)
        CPU: 14.764s
     CGroup: /system.slice/kibana.service
             mq19660 /usr/share/kibana/bin/../node/default/bin/node /usr/share/kibana/bin/../src/cli/kibana/dist

Jul 23 15:55:13 Lion kibana[19660]: Native global console methods have been overridden in production environment.
Jul 23 15:55:15 Lion kibana[19660]: [2026-07-23T15:55:15.702+09:00][INFO ][root] Kibana is starting
Jul 23 15:55:15 Lion kibana[19660]: [2026-07-23T15:55:15.768+09:00][INFO ][node] Kibana process configured with roles: [background_tasks, ui]
Jul 23 15:55:26 Lion kibana[19660]: [2026-07-23T15:55:26.525+09:00][INFO ][plugins-service] The following plugins are disabled: "alertingVTwo,cloudChat,cl>
Jul 23 15:55:26 Lion kibana[19660]: [2026-07-23T15:55:26.610+09:00][INFO ][http.server.Preboot] http server running at http://192.168.11.85:5601
Jul 23 15:55:26 Lion kibana[19660]: [2026-07-23T15:55:26.711+09:00][INFO ][plugins-system.preboot] Setting up [1] plugins: [interactiveSetup]
Jul 23 15:55:26 Lion kibana[19660]: [2026-07-23T15:55:26.730+09:00][INFO ][preboot] "interactiveSetup" plugin is holding setup: Validating Elasticsearch c>
Jul 23 15:55:26 Lion kibana[19660]: [2026-07-23T15:55:26.765+09:00][INFO ][root] Holding setup until preboot stage is completed.
Jul 23 15:55:34 Lion kibana[19660]: i Kibana has not been configured.
Jul 23 15:55:34 Lion kibana[19660]: Go to http://192.168.11.85:5601/?code=026151 to get started.

The following appears at the end of the output

Go to http://192.168.11.85:5601/?code=026151 to get started.

Copy the provided Kibana URL (including code) and use it in your browser to access Kibana and complete the setup.

Similarly, Kibana logs are available in /var/log/kibana/kibana.log and /var/log/syslog.

⑥Accessing the Kibana9 Dashboard

If UFW is running, open Kibana port

# ufw allow 5601/tcp
Rule added
# ufw reload
Firewall reloaded

When you go to http://192.168.11.85:5601/?code=026151, the welcome page will prompt you to configure Elastic.
First, enter the generated registration token.
Copy the Kibana token generated using the command /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana, and paste it into the box

Paste the token and Kibana will automatically connect to Elasticsearch.
Click Configure Elastic. Your settings will be saved and Elasticsearch will be configured and restarted.

Go to the login page. Log in using the generated Elastic user credentials.
Username : elastic
Password : Easy-to-understand regenerated passwords

On the welcome page, click "Explore on my own" to proceed to the Kibana 9.x dashboard.。

Installing Filebeat 9

To collect logs and monitor the first-generation server running Debian 13.6, you need to install Filebeat.
This procedure will be performed on the first server, running Debian 13.6 with the IP address 192.168.11.83.

①Install Elastic Repos
To install Filebeat 9, install the Elastic 9.x repository

# wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
gpg --dearmor > /etc/apt/trusted.gpg.d/elk.gpg

# echo "deb https://artifacts.elastic.co/packages/9.x/apt stable main" \
> /etc/apt/sources.list.d/elastic-9.list

update

# apt update

Install Filebeat 9

# apt -y install filebeat

➁Configuring Filebeat Logging

The default filebeat configuration file is /etc/filebeat/filebeat.yml
To make Filebeat write logs to its own log file, enter the following settings in the configuration file

# cat >> /etc/filebeat/filebeat.yml << 'EOL'
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0640
EOL


➂Connecting Filebeat to the data processing system
Configure Filebeat to connect to a data processing system. In this case, it is Elasticsearch.
To send logs directly to Elasticsearch, edit the Filebeat configuration file and update the Output Settings section.

Connecting to Elasticsearch 9 requires SSL and authentication.
Verify that you can connect to Elasticsearch on port 9200/tcp (make sure to open port 9200 on the second server beforehand)

# telnet 192.168.11.85 9200

Trying 192.168.11.85...
Connected to 192.168.11.85.
Escape character is '^]'.

④Elasticsearch CA certificate creation
Download the Elasticsearch CA certificate and save it in a directory of your choice (this time as /etc/filebeat/elastic-ca.crt)

# openssl s_client -connect 192.168.11.85:9200 \
-showcerts </dev/null 2>/dev/null | \
openssl x509 -outform PEM > /etc/filebeat/elastic-ca.crt

Get the credentials that Filebeat uses to authenticate to Elasticsearch. In this case, we will use the default superadmin and Elastic user credentials.

# vi /etc/filebeat/filebeat.yml

Around line 138, modify the Kibana section as follows:
#host: "localhost:5601"
host: "192.168.11.85:5601"

Change the Elasticsearch Output section around line 164 as follows:
output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]
  hosts: ["192.168.11.85:9200"]

Uncomment around line 171 and specify the location of the Elasticsearch CA certificate
  # Protocol - either `http` (default) or `https`.
  protocol: "https"
  ssl.certificate_authorities: ["/etc/filebeat/elastic-ca.crt"]

Uncomment the lines around lines 175 and 176 and enter the password
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "Password"   ←The Elastic password created on the second server

⑤Configuration File Test

# filebeat test config
Config OK

⑥Test Filebeat output connections

# filebeat test output

elasticsearch: https://192.168.11.85:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.11.85
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 9.4.4

⑦Enable the Suricata module for Filebeat

When you enable the Suricata module, /etc/filebeat/modules.d/suricata.yml.disabled becomes /etc/filebeat/modules.d/suricata.yml, but the contents remain unchanged, so modify it as follows:

# filebeat modules enable suricata

# vi /etc/filebeat/modules.d/suricata.yml
Change lines 7–8 as follows
- module: suricata
  # All logs
  eve:
    enabled: true
    var.paths: ["/var/log/suricata/eve.json"]

⑧Set up the initial environment
Load the SIEM dashboard and pipeline into Elasticsearch
filebeat setup command

# filebeat setup -e

{"log.level":"info","@timestamp":"2026-07-23T16:14:03.989+0900","log.logger":"modules","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/fileset.LoadPipeline","file.name":"fileset/pipelines.go","file.line":134},"message":"Elasticsearch pipeline loaded.","service.name":"filebeat","pipeline":"filebeat-9.4.4-suricata-eve-pipeline","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2026-07-23T16:14:04.049+0900","log.logger":"modules","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/fileset.LoadPipeline","file.name":"fileset/pipelines.go","file.line":134},"message":"Elasticsearch pipeline loaded.","service.name":"filebeat","pipeline":"filebeat-9.4.4-suricata-eve-dns","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2026-07-23T16:14:04.112+0900","log.logger":"modules","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/fileset.LoadPipeline","file.name":"fileset/pipelines.go","file.line":134},"message":"Elasticsearch pipeline loaded.","service.name":"filebeat","pipeline":"filebeat-9.4.4-suricata-eve-dns-answer-v1","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2026-07-23T16:14:04.167+0900","log.logger":"modules","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/fileset.LoadPipeline","file.name":"fileset/pipelines.go","file.line":134},"message":"Elasticsearch pipeline loaded.","service.name":"filebeat","pipeline":"filebeat-9.4.4-suricata-eve-dns-answer-v2","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2026-07-23T16:14:04.229+0900","log.logger":"modules","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/fileset.LoadPipeline","file.name":"fileset/pipelines.go","file.line":134},"message":"Elasticsearch pipeline loaded.","service.name":"filebeat","pipeline":"filebeat-9.4.4-suricata-eve-tls","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2026-07-23T16:14:04.286+0900","log.logger":"modules","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/fileset.LoadPipeline","file.name":"fileset/pipelines.go","file.line":134},"message":"Elasticsearch pipeline loaded.","service.name":"filebeat","pipeline":"filebeat-9.4.4-suricata-eve-http","ecs.version":"1.6.0"}

⑨Filebeat service launched

# systemctl start filebeat.service
# systemctl enable filebeat.service

⑩Check with Kibana

Log back into Kibana at accsess http://192.168.11.85:5601

Type "Suricata Events Overview" in the top search field and click [Filebeat Suricata]Events Overview

All Suricata events in the last 15 minutes are displayed

Click on the Alerts text next to the Suricata logo for malicious traffic alerts

Create a new user account so that you do not have to use the elastic superuser account.
Click on the three-line mark in the upper left corner and select "Stack Management" under "Management"

Select "security" and "Users"

Click on the "Create user" button in the upper right corner

Enter new user information, assign the roles kibana_admin, kibana_system, monitoring_user, and editor in Privileges, and finally click Create user

Log out of the current profile and confirm that you can log in with the newly created user account.

Go to top