OracleLinux10.1 : Suricata + Elastic Stack,Kibana,Filebeat

Prerequisites

1.Suricata
SURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic.
The basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.

2.Elastic Stack,Kibana,Filebeat
Install and configure the Elastic Stack to enable visualization and search of SURICATA logs using Kibana and Filebeat.

This time, we will install Suricata IDS and ElasticStack on the following server.
・First Server　Suricata IDS & Filebeat　: OracleLinux10.1 IP address(192.168.11.83)
・Second server　ElasticStack & kibana　: OracleLinux10.0 IP address(192.168.11.85)

First Server: Suricata Installation

1. Installing and Configuring Suricata

①Suricata Install

②Determine interface and IP address where Suricata will inspect network packets

③Edit configuration file

④Suricata rules update

⑤Activate Suricata

⑥Confirm Suricata startup

Check Log

Check the stats.log file for statistics (updated every 8 seconds by default)

A more advanced output, EVE JSON, can be generated with the following command

2. Suricata Testing

①Run ping test with curl utility

②Check the log file using the specified rule number.
Suricata comes with the following two log files enabled by default:

/var/log/suricata/fast.log
/var/log/suricata/eve.log
To check the log entries corresponding to the curl request, use the grep command to examine the /var/log/suricata/fast.log log file.
2100498 Searches for log entries using the rule identifier. (For IPv4)

 ③Checking events in /var/log/suricata/eve.log

Install jq

Search for signature 2100498 to filter EVE log events
Display the alert object with the signature_id key matching the value 2100498

3.Setting Suricata Rules

①Display of rule sets packaged in Suricata

②Index list of sources providing rule sets

③Enable source (if tgreen/hunting is enabled)

Perform update

Restart Suricata service

4. Configuring Suricata as an IPS

Configure Suricata to run in IPS mode to drop malicious network traffic.

Create the following custom signature to scan SSH traffic to non-SSH ports, and include it in the file /var/lib/suricata/rules/local.rules.
(Assuming the SSH port is 22)

Edit the /etc/suricata/suricata.yaml configuration file and include local.rules.

Verify SURICATA Configuration

Edit the SURICATA configuration file located at /etc/sysconfig/suricata

Restart Suricata

Status Check

Direct incoming network traffic to Suricata's NFQUEUE
Firewalld is installed and enabled, so add the necessary rules for Suricata to Firewalld.(Assuming the SSH port is 22)

Verify that SURICATA is correctly dropping traffic.
Switch the signature's default action from alert or log to active dropping traffic.
Open the /var/lib/suricata/rules/suricata.rules file and comment out any entries matching sid:2100498.

Create a new rule named sid:2100498 in /var/lib/suricata/rules/local.rules.

Reload signatures

Test this rule using curl

Use jq to examine the eve.log file

"action": "blocked", is set

Integration of the ELK Stack and SURICATA

Install and configure the Elastic Stack to visualize and search SURICATA logs more efficiently.
This section is primarily performed on the second OracleLinux 10.0 server.

1. Elasticsearch Install

1.1 Download and install the GPG key

1.2 Create the repository definition in the /etc/yum/yum.repos.d directory.

1.3 Elasticsearch Install

2. Elasticsearch Settings

Elasticsearch is configured by default to accept only local connections.
Additionally, tools such as Filebeat cannot send logs because authentication is not enabled.
This time, we will configure Elasticsearch's network settings and enable the xpack security module built into Elasticsearch.

2.1 Elasticsearch Network Configuration
Since the Elasticsearch and SURICATA servers are separate, Elasticsearch must be configured to listen for connections on the private network interface.

2.2 Start Elasticsearch

2.3 Create passwords for elastic and kibana_system
Be sure to copy the passwords for the elastic user and kibana_system user, as they will be needed later.
The kibana_system user is used for configuring Kibana.
The elastic user is used for configuring Filebeat and Auditbeat, and for logging into Kibana.
If you forget your password, you can use the command again to reset it.

[elastic] User password creation

※Resetting Elasticsearch Passwords
The automatically generated Elastic user password is too complex, so you can reset it using the /usr/share/elasticsearch/bin/elasticsearch-reset-password command.
To reset your password, execute the command.

[kibana_system] User Password Creation

3. Installing and Configuring Kibana

This section is primarily performed on the second OracleLinux 10.0 server.

3.1 Kibana Installation

3.2 xpack Security Module Configuration

Enable Kibana's xpack security features to generate several encryption keys that Kibana uses to store data in Elasticsearch.
Encryption keys are created using the kibana-encryption-keys utility located in the /usr/share/kibana/bin directory.
Store the three keys you created in a secure location.

Add these keys to Kibana's /etc/kibana/kibana.yml configuration file.

3.2 Kibana Network Configuration

3.3 Generating a Kibana-Elasticsearch Enrollment Token
To configure a Kibana instance to communicate with an existing Elasticsearch cluster with security enabled, an enrollment token is required. An enrollment token for Kibana can be generated using the following command:

3.4 Starting Kibana
Launch Kibana 9 and configure it to run at system startup.

Status Check

The following appears toward the end of the output:

Copy the provided Kibana URL (including the code) and use it in your browser to access Kibana and complete the setup.

4. Accessing the Kibana 9 Dashboard

Accsess http://192.168.11.85:5601/?code=786573
(Copy each person's appropriate address)

If the firewall is running, open the Kibana port.

When you access Kibana 9, the welcome page prompts you to configure Elastic.
First, enter the generated registration token.
Copy the Kibana token generated using the command /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana and paste it into the box.Copy the Kibana token generated using the command `/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana` and paste it into the box.

Accsess http://192.168.11.85:5601/?code=786573

The following screen will appear. Enter the code generated by the next command.

Kibana will automatically connect to Elasticsearch.

Proceed to the login page. Log in using the generated Elastic user credentials.
Username : elastic
Password : Password regenerated for clarity

On the welcome page, click "Explore on my own" to proceed to the Kibana 9.x dashboard.

Create a new user account so that you do not need to use the elastic superuser account.
Open the main menu, then navigate to Management > Stack Management > Security > Users

Click the "Create user" button in the upper right corner.

Enter new user information and assign the kibana_admin, kibana_system, monitoring_user, and editor roles under Privileges.
Finally, click [Create user].

Log out of the current profile and verify that you can log in with the newly created user account.
Currently, there is no data available to display in Kibana because Filebeat and Auditbeat are not configured on the SURICATA host.

Install Filebeat on the SURICATA server

This task will be performed on the first OracleLinux 10.1 server where Suricata has been installed.

1. Filebeat Install

1.1 Download Elastic GPG Key

1.2 Create an elasticsearch.repo file in the /etc/yum/yum.repos.d directory with the following content:

1.3 Install Filebeat

1.4 Creating an Elasticsearch CA Certificate
Download the Elasticsearch CA certificate and save it to any directory (in this case, save it as /etc/filebeat/elastic-ca.crt).
※Keep port 9200 open on the second server (the server running OracleLinux 10.0 with Elasticsearch installed).

1.4 Configure Filebeat to connect to Elasticsearch and Kibana

1.5 Configuration File Test

1.6 Enable the built-in Suricata module in Filebeats

The above command will change /etc/filebeat/modules.d/suricata.yml.disabled to /etc/filebeat/modules.d/suricata.yml, but the contents remain unchanged. Therefore, edit it as follows:

1.7 Set up the initial environment
Load the pipeline into the Suricata service
Load the SIEM dashboard into Elasticsearch

1.6 Start the Filebeat service

2. Check in Kibana

Log back into Kibana using the user you created. Accsses http://192.168.11.85:5601

Enter "Suricata Events Overview" in the top search field, then click [Filebeat Suricata]Events Overview.

All Suricata events from the past 15 minutes are displayed.

To display alerts for malicious traffic, click the "Alerts" text next to the Suricata logo.

Kibana offers a variety of features and tools for visualizing logs, so feel free to experiment with them.