Fedora43 : Suricata + Elastic Stack + Filebeat

Prerequisites

This time, we will install Suricata IDS and ElasticStack on the following server.
・First Server　Suricata IDS & Filebeat　: Fedora43 IP address(192.168.11.83)
・Second server　ElasticStack & kibana　: Ubuntu24.04 IP address(192.168.11.85)
Run as a sudo user other than root

 Suricata

SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic.
The basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.

1.Preparation

①Activate the EPEL repository on your system

②System Update

2.Suricata Installation and Configuration

①Suricata install

②Determine interface and IP address where Suricata will inspect network packets

③Edit configuration file

④Suricata rules update

⑤Activate Suricata

⑥Confirm Suricata startup

Check Log

Check the stats.log file for statistics (updated every 8 seconds by default)

A more advanced output, EVE JSON, can be generated with the following command

3.Suricata Testing

①Run ping test with curl utility

②Check the alert log to see if it has been logged

4.Setting Suricata Rules

①Display of rule sets packaged in Suricata

②Index list of sources providing rule sets

③Enable source (if tgreen/hunting is enabled)

Perform update

Restart Suricata service

5.Creating Suricata Custom Rules

①Create files containing customer rules

②Edit configuration file (define new rule paths)

 ③Testing the configuration file

Restart Suricat service

④Testing the application of Custom Rules
Ping another device on the same local network to see if it was logged

To get logs in JSON format, install jq on your system

Execute the following command to ping another device on the same local network

6. Configuring Suricata as an IPS

Configure Suricata to start in IPS mode to drop malicious network traffic.

①Edit the SURICATA configuration file located at /etc/sysconfig/suricata

➁Restart Suricata

➂Direct incoming network traffic to Suricata's NFQUEUE
Firewalld is installed and enabled, so add the necessary rules for Suricata to Firewalld.

④Verify that SURICATA is correctly dropping traffic.
If there is a rule matching sid:2100498 in /var/lib/suricata/rules/suricata.rules, comment it out and add the rule to /var/lib/suricata/rules/local.rules.

⑤Suricata Update

⑥Test this rule using curl

"action": "blocked", is set

Elastic stack 9.x　Install

Install and configure the Elastic Stack to visualize and search SURICATA logs
This section is primarily performed on a second Ubuntu 24.04 server.

①Install the Elastic Stack 9.x repository signing key

➁Install the Elastic Stack 9.x repository

update

➂Installing Elasticsearch 9.x on Ubuntu 24.04

During installation, security features are enabled by default;

Authentication and authorization are enabled.
TLS is enabled and configured at the transport layer and HTTP layer.
An Elastic superuser account (elastic) and its password will be created.

④Configuring Elasticsearch 9.x on Ubuntu
Since this is a basic single-node cluster, we will use the default settings.

Checking the Elasticsearch configuration file /etc/elasticsearch/elasticsearch.yml reveals that security settings are enabled.

⑤Starting Elasticsearch

Start Elasticsearch and configure it to run at system startup.

Check the status

You can also use the curl command to check the status of Elasticsearch. Replace the IP address as appropriate.

When prompted, enter the Elasticsearch password generated during Elasticsearch installation.
The output will appear as follows:

Also, ensure that both the HTTP port and the transport port are open;

⑥Resetting Elasticsearch Passwords
The automatically generated Elastic user password is too complex, so reset it using the /usr/share/elasticsearch/bin/elasticsearch-reset-password command.
To reset the password, execute the command.

⑦Elasticsearch Logs
Elasticsearch writes logs to the /var/log/elasticsearch path. The log file you need to check when there is an issue with the Elasticsearch instance is /var/log/elasticsearch/CLUSTER_NAME.log.

CLUSTER_NAME is the value of the cluster.name option in the elasticsearch.yaml file. If this value is not changed, the default is elasticsearch, and the log file will be located at /var/log/elasticsearch/elasticsearch.log.

ログ

Kibana 9.x

This section is primarily performed on a second Ubuntu 24.04 server.

①Install

➁Configuring Kibana 9
Kibana is configured by default to run on localhost:5601. To allow external access, edit the configuration file and replace the value of server.host with the interface IP.

Rewrite as follows:

➂Generating a Kibana-Elasticsearch Enrollment Token
To configure a Kibana instance to communicate with an existing Elasticsearch cluster with security enabled, an enrollment token is required. An enrollment token for Kibana can be generated using the following command:

④Generating Kibana Encryption Keys
Kibana uses encryption keys in several areas, from encrypting data in Kibana-related indices to storing session information. The required keys are as follows:

• xpack.encryptedSavedObjects.encryptionKey:Used to encrypt saved objects such as dashboards and visualizations.
• xpack.reporting.encryptionKey: Used for encrypting saved reports
• xpack.security.encryptionKey: Used for encrypting session information

These are generated using the following command:

The output will be as follows:

Insert the above into Kibana's configuration file kibana.yml.

⑤Running Kibana
Launch Kibana 9 and configure it to run at system startup.

status

The following appears toward the end of the output:

Copy the provided Kibana URL (including the code) and use it in your browser to access Kibana and complete the setup.

Similarly, Kibana logs are available in /var/log/kibana/kibana.log and /var/log/syslog.

⑥Accessing the Kibana 9 Dashboard

accsess to http://192.168.11.85:5601/?code=446458
(Copy each person's appropriate address)

If UFW is running, open the Kibana port.

When you access Kibana 9, the welcome page prompts you to configure Elastic.
First, enter the generated registration token.
Copy the generated Kibana token and paste it into the box.

accsess to http://192.168.11.85:5601/?code=446458

Paste the token, and Kibana will automatically connect to Elasticsearch.
Click Configure Elastic. The settings will be saved, and Elasticsearch will be configured and restarted.

Proceed to the login page. Log in using the generated Elastic user credentials.
Username : elastic
Password : Password regenerated for clarity

On the welcome page, click "Explore on my own" to proceed to the Kibana 9.x dashboard.

Installing Filebeat 9

To collect and monitor logs from Fedora 43 using the ELK Stack, you need to install Filebeat.
This task will be performed on the first server, Fedora 43, with the IP address 192.168.11.83.

①Install Elastic Repos

On Red Hat-based distributions, create a file named elasticsearch.repo in the /etc/yum.repos.d/ directory and include the following configuration:

Install

➁Filebeat Logging Configuration

The default Filebeat configuration file is located at /etc/filebeat/filebeat.yml.
To configure Filebeat to write logs to its own log file, enter the following setting in the configuration file:

➂Connect Filebeat to the data processing system
Configure Filebeat to connect to the data processing system. In this case, it is Elasticsearch.
To send logs directly to Elasticsearch, edit the Filebeat configuration file and update the output configuration section.

Connecting to Elasticsearch 9 requires SSL and authentication.
Verify that you can connect to Elasticsearch's port 9200/tcp (ensure port 9200 is open on the second server beforehand).

④Creating an Elasticsearch CA Certificate
Download the Elasticsearch CA certificate and save it to any directory (in this case, save it as /etc/filebeat/elastic-ca.crt).

Retrieve the credentials Filebeat uses for Elasticsearch authentication. In this case, use the credentials for the default superuser, the Elastic user.

⑤Configuration File Test

⑥Testing Filebeat's output connection

⑦Enable the Suricata module for Filebeat
Modify modules.d/suricata.yml as follows:

Enable the Suricata module for Filebeat

⑧Set up the initial environment
Load SIEM dashboards and pipelines into Elasticsearch
Execute the filebeat setup command

⑨Start the Filebeat service

⑩Check in Kibana

Log back into Kibana. http://192.168.11.85:5601

Enter "Suricata Events Overview" in the top search field, then click [Filebeat Suricata]Events Overview.

All Suricata events from the past 15 minutes are displayed.

To display alerts for malicious traffic, click the "Alerts" text next to the Suricata logo.

Create a new user account so you don't need to use the elastic superuser account.
Click the three-line icon in the upper left corner and select [Stack Management] under [Management].

Select "Security" and "Users"

Click the "Create user" button in the upper right corner.

Enter the new user information, assign the kibana_admin, kibana_system, monitoring_user, and editor roles under Privileges, and finally click [Create user].

Log out of the current profile and verify that you can log in with the newly created user account.