Rocky Linux 9에서 Elastic Stack과 함께 Suricata IDS 설치 및 구성하는 방법

$ sudo dnf install 'dnf-command(copr)'
$ sudo dnf copr enable @oisf/suricata-7.0

$ sudo dnf install -y epel-release dnf-plugins-core

$ sudo dnf install -y suricata

$ sudo systemctl enable suricata

$ sudo nano /etc/suricata/suricata.yaml

. . .
      # Community Flow ID
      # Adds a 'community_id' field to EVE records. These are meant to give
      # records a predictable flow ID that can be used to match records to
      # output of other tools such as Zeek (Bro).
      #
      # Takes a 'seed' that needs to be same across sensors and tools
      # to make the id less predictable.

      # enable/disable the community id feature.
      community-id: true
. . .

$ ip -p -j route show default

[ {
        "dst": "default",
        "gateway": "172.31.1.1",
        "dev": "eth0",
        "protocol": "dhcp",
        "prefsrc": "65.108.61.177",
        "metric": 100,
        "flags": [ ]
    } ]

$ sudo nano /etc/suricata/suricata.yaml

# Linux high speed capture support
af-packet:
  - interface: eth0
    # Number of receive threads. "auto" uses the number of cores
    #threads: auto
    # Default clusterid. AF_PACKET will load balance packets based on flow.
    cluster-id: 99
. . .

    #  For eBPF and XDP setup including bypass, filter and load balancing, please
    #  see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.

  - interface: enp0s1
    cluster-id: 98
...
  - interface: default
    #threads: auto
    #use-mmap: no
    #tpacket-v3: yes

# Cross platform libpcap capture support
pcap:
  - interface: eth0
    # On Linux, pcap will try to use mmap'ed capture and will use "buffer-size"
    # as total memory used by the ring. So set this to something bigger
    # than 1% of your bandwidth.

- interface: enp0s1
# Put default values here
  - interface: default
    #checksum-checks: auto

$ sudo kill -usr2 $(pidof suricata)

$ sudo chgrp -R suricata /etc/suricata
$ sudo chgrp -R suricata /var/lib/suricata
$ sudo chgrp -R suricata /var/log/suricata 

$ sudo chmod -R g+r /etc/suricata/
$ sudo chmod -R g+rw /var/lib/suricata
$ sudo chmod -R g+rw /var/log/suricata

$ sudo usermod -a -G suricata $USER

$ su - ${USER}

$ id -nG
username wheel suricata

$ suricata-update
14/4/2024 -- 01:32:58 -  -- Using data-directory /var/lib/suricata.
14/4/2024 -- 01:32:58 -  -- Using Suricata configuration /etc/suricata/suricata.yaml
14/4/2024 -- 01:32:58 -  -- Using /usr/share/suricata/rules for Suricata provided rules.
14/4/2024 -- 01:32:58 -  -- Found Suricata version 7.0.4 at /usr/sbin/suricata.
.....
14/4/2024 -- 01:32:58 -  -- No sources configured, will use Emerging Threats Open
14/4/2024 -- 01:32:58 -  -- Fetching https://rules.emergingthreats.net/open/suricata-7.0.4/emerging.rules.tar.gz.
 100% - 4243799/4243799               
14/4/2024 -- 01:33:00 -  -- Done.
14/4/2024 -- 01:33:00 -  -- Loading distribution rule file /usr/share/suricata/rules/app-layer-events.rules
.....
14/4/2024 -- 01:33:04 -  -- Writing rules to /var/lib/suricata/rules/suricata.rules: total: 48646; enabled: 37144; added: 48646; removed 0; modified: 0
14/4/2024 -- 01:33:04 -  -- Writing /var/lib/suricata/rules/classification.config
14/4/2024 -- 01:33:04 -  -- Testing with suricata -T.
14/4/2024 -- 01:33:41 -  -- Done.

$ suricata-update list-sources

$ suricata-update enable-source tgreen/hunting
14/4/2024 -- 01:37:07 -  -- Using data-directory /var/lib/suricata.
14/4/2024 -- 01:37:07 -  -- Using Suricata configuration /etc/suricata/suricata.yaml
14/4/2024 -- 01:37:07 -  -- Using /usr/share/suricata/rules for Suricata provided rules.
14/4/2024 -- 01:37:07 -  -- Found Suricata version 7.0.4 at /usr/sbin/suricata.
14/4/2024 -- 01:37:07 -  -- Source index does not exist, will use bundled one.
14/4/2024 -- 01:37:07 -  -- Please run suricata-update update-sources.
14/4/2024 -- 01:37:07 -  -- Creating directory /var/lib/suricata/update/sources
14/4/2024 -- 01:37:07 -  -- Enabling default source et/open
14/4/2024 -- 01:37:07 -  -- Source tgreen/hunting enabled

$ suricata -T -c /etc/suricata/suricata.yaml -v
Notice: suricata: This is Suricata version 7.0.4 RELEASE running in SYSTEM mode
Info: cpu: CPUs/cores online: 2
Info: suricata: Running suricata under test mode
Info: suricata: Setting engine mode to IDS mode by default
Info: exception-policy: master exception-policy set to: auto
Info: logopenfile: fast output device (regular) initialized: fast.log
Info: logopenfile: eve-log output device (regular) initialized: eve.json
Info: logopenfile: stats output device (regular) initialized: stats.log
Info: detect: 1 rule files processed. 37144 rules successfully loaded, 0 rules failed, 0
Info: threshold-config: Threshold config parsed: 0 rule(s) found
Info: detect: 37147 signatures processed. 1194 are IP-only rules, 4892 are inspecting packet payload, 30849 inspect application layer, 108 are decoder event only
Notice: suricata: Configuration provided was successfully loaded. Exiting.

$ sudo systemctl start suricata

$ sudo systemctl status suricata

? suricata.service - Suricata Intrusion Detection Service
     Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; preset: disabled)
     Active: active (running) since Sun 2024-04-14 01:45:43 UTC; 4s ago
       Docs: man:suricata(1)
    Process: 6081 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, status=0/SUCCESS)
   Main PID: 6082 (Suricata-Main)
      Tasks: 1 (limit: 22569)
     Memory: 111.8M
        CPU: 4.318s
     CGroup: /system.slice/suricata.service
             ??6082 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -i eth0 --user suricata

Apr 14 01:45:43 suricata systemd[1]: Starting Suricata Intrusion Detection Service...
Apr 14 01:45:43 suricata systemd[1]: Started Suricata Intrusion Detection Service.
Apr 14 01:45:43 suricata suricata[6082]: i: suricata: This is Suricata version 7.0.4 RELEASE running in SYSTEM mode

Apr 15 02:20:13 suricata suricata[5554]: E: logopenfile: Error opening file: "/var/log/suricata//fast.log": Permission denied
Apr 15 02:20:13 suricata suricata[5554]: W: runmodes: output module "fast": setup failed
Apr 15 02:20:13 suricata suricata[5554]: E: logopenfile: Error opening file: "/var/log/suricata//eve.json": Permission denied
Apr 15 02:20:13 suricata suricata[5554]: W: runmodes: output module "eve-log": setup failed
Apr 15 02:20:13 suricata suricata[5554]: E: logopenfile: Error opening file: "/var/log/suricata//stats.log": Permission denied
Apr 15 02:20:13 suricata suricata[5554]: W: runmodes: output module "stats": setup failed

$ sudo chown -R suricata:suricata /var/log/suricata

$ sudo systemctl restart suricata

$ sudo tail -f /var/log/suricata/suricata.log

[5577 - Suricata-Main] 2024-04-15 02:22:52 Info: exception-policy: master exception-policy set to: auto
[5577 - Suricata-Main] 2024-04-15 02:22:52 Info: ioctl: eth0: MTU 1500
[5577 - Suricata-Main] 2024-04-15 02:22:52 Info: privs: dropped the caps for main thread
[5577 - Suricata-Main] 2024-04-15 02:22:52 Info: conf: Running in live mode, activating unix socket
[5577 - Suricata-Main] 2024-04-15 02:22:52 Info: logopenfile: fast output device (regular) initialized: fast.log
[5577 - Suricata-Main] 2024-04-15 02:22:52 Info: logopenfile: eve-log output device (regular) initialized: eve.json
[5577 - Suricata-Main] 2024-04-15 02:22:52 Info: logopenfile: stats output device (regular) initialized: stats.log
[5577 - Suricata-Main] 2024-04-15 02:23:03 Info: detect: 1 rule files processed. 37144 rules successfully loaded, 0 rules failed, 0
[5577 - Suricata-Main] 2024-04-15 02:23:03 Info: threshold-config: Threshold config parsed: 0 rule(s) found
[5577 - Suricata-Main] 2024-04-15 02:23:04 Info: detect: 37147 signatures processed. 1194 are IP-only rules, 4892 are inspecting packet payload, 30849 inspect application layer, 108 are decoder event only
[5577 - Suricata-Main] 2024-04-15 02:23:32 Info: runmodes: eth0: creating 2 threads
[5577 - Suricata-Main] 2024-04-15 02:23:32 Info: unix-manager: unix socket '/var/run/suricata/suricata-command.socket'
[5577 - Suricata-Main] 2024-04-15 02:23:32 Notice: threads: Threads created -> W: 2 FM: 1 FR: 1   Engine started.

$ curl http://testmynids.org/uid/index.html

uid=0(root) gid=0(root) groups=0(root)

$ grep 2100498 /var/log/suricata/fast.log

02/22/2022-23:24:33.997371  [] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 2600:9000:2204:5c00:0018:30b3:e400:93a1:80 -> 2a03:b0c0:0002:00d0:0000:0000:0fc2:b001:41468

02/22/2022-23:21:46.783476  [] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 204.246.178.81:80 -> 164.90.192.1:36364

$ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

$ sudo nano /etc/yum.repos.d/elasticsearch.repo

[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

$ sudo dnf install --enablerepo=elasticsearch elasticsearch kibana

--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : ilc+Gju=gZTxQHI4cSkF

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token '
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with 
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with 
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with 
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.
-------------------------------------------------------------------------------------------------

$ ip -brief address show
lo               UNKNOWN        127.0.0.1/8 ::1/128 
eth0             UP             37.27.84.123/32 2a01:4f9:c012:db02::1/64 fe80::9400:3ff:fe34:d589/64 
eth1             UP             10.0.0.2/32 fe80::8400:ff:fe84:5baf/64

$ sudo nano /etc/elasticsearch/elasticsearch.yml

# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
#network.host: 192.168.0.1
network.bind_host: ["127.0.0.1", "your_private_IP"]
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:

. . .
discovery.type: single-node

#cluster.initial_master_nodes: ["elastic"]

$ sudo nano /etc/elasticsearch/jvm.options.d/jvm-heap.options

-Xms3g
-Xmx3g

$ sudo firewall-cmd --permanent --zone=internal --change-interface=eth1
$ sudo firewall-cmd --permanent --zone=internal --add-service=elasticsearch
$ sudo firewall-cmd --permanent --zone=internal --add-service=kibana
$ sudo firewall-cmd --permanent --add-port=5601/tcp
$ sudo firewall-cmd --reload

$ sudo systemctl daemon-reload

$ sudo systemctl enable elasticsearch --now

$ sudo systemctl status elasticsearch
? elasticsearch.service - Elasticsearch
     Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; preset: disabled)
     Active: active (running) since Sun 2024-04-14 03:51:12 UTC; 1min 20s ago
       Docs: https://www.elastic.co
   Main PID: 5987 (java)
      Tasks: 74 (limit: 22569)
     Memory: 3.4G
        CPU: 50.532s
     CGroup: /system.slice/elasticsearch.service

$ sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -i
This tool will reset the password of the [elastic] user.
You will be prompted to enter the password.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]: 
Re-enter password for [elastic]: 
Password for the [elastic] user successfully reset.

$ sudo curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
{
  "name" : "elastic",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "VSP7LEZURF6SR8I1BPF9RQ",
  "version" : {
    "number" : "8.13.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "16cc90cd2d08a3147ce02b07e50894bc060a4cbf",
    "build_date" : "2024-04-05T14:45:26.420424304Z",
    "build_snapshot" : false,
    "lucene_version" : "9.10.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

$ sudo cp /etc/elasticsearch/certs/http_ca.crt /etc/kibana/

$ sudo /usr/share/kibana/bin/kibana-encryption-keys generate -q

xpack.encryptedSavedObjects.encryptionKey: fdce3576894a0a7b12a639a40f643acd
xpack.reporting.encryptionKey: 92f426be0f487b7d8dd191b86443f2a6
xpack.security.encryptionKey: 34bf00781dbe85d1dcd99dc94ef1c9b7

$ sudo nano /etc/kibana/kibana.yml

. . .

# Maximum number of documents loaded by each shard to generate autocomplete suggestions.
# This value must be a whole number greater than zero. Defaults to 100_000
#unifiedSearch.autocomplete.valueSuggestions.terminateAfter: 100000

xpack.encryptedSavedObjects.encryptionKey: fdce3576894a0a7b12a639a40f643acd
xpack.reporting.encryptionKey: 92f426be0f487b7d8dd191b86443f2a6
xpack.security.encryptionKey: 34bf00781dbe85d1dcd99dc94ef1c9b7

# Kibana is served by a back end server. This setting specifies the port to use.
#server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
#server.host: "localhost"
server.host: "your_private_IP"

telmetry.optIn: false
telmetry.allowChangingOptInStatus: false

elasticsearch.ssl.certificateAuthorities: [ "/etc/kibana/http_ca.crt" ]

$ sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
eyJ2ZXIiOiI4LjEzLjIiLCJhZHIiOlsiMzcuMjcuODQuMTIzOjkyMDAiXSwiZmdyIjoiMmI2ZjhhOWRiOWJjMDU5NDk0NGE0OGFkMjMxODg2NzYxNTViZGViN2U5YjY4MmY3N2MzYmI3ZDk2Nzc3YjY0NyIsImtleSI6InppVU0zSTRCOE5lSHBLU3k2T0owOnBLNHJiWjBZVHYybWNTbmxrTXlqbncifQ==

$ sudo systemctl enable kibana --now

$ sudo systemctl status kibana
? kibana.service - Kibana
     Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: disabled)
     Active: active (running) since Sun 2024-04-14 04:25:54 UTC; 963ms ago
       Docs: https://www.elastic.co
   Main PID: 6464 (node)
      Tasks: 7 (limit: 22569)
     Memory: 48.2M
        CPU: 1.238s
     CGroup: /system.slice/kibana.service
             ??6464 /usr/share/kibana/bin/../node/bin/node /usr/share/kibana/bin/../src/cli/dist

Apr 14 04:25:54 elastic systemd[1]: Started Kibana.
.....

$ ssh -L 5601:your_private_IP:5601 navjot@your_public_IP -N

$ sudo nano /etc/yum.repos.d/nginx.repo

[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=http://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

$ sudo dnf install -y nginx

$ nginx -v
nginx version: nginx/1.25.4

$ sudo systemctl enable nginx --now

$ sudo firewall-cmd --permanent --add-service=http
$ sudo firewall-cmd --permanent --add-service=https

$ sudo firewall-cmd --reload

$ sudo dnf install -y epel-release

$ sudo dnf install -y certbot python3-certbot-nginx

$ sudo certbot certonly --nginx --agree-tos --no-eff-email --staple-ocsp --preferred-challenges http -m [email protected] -d kibana.example.com

$ sudo openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096

$ sudo systemctl enable certbot-renew.timer
$ sudo systemctl start certbot-renew.timer

$ sudo systemctl list-timers
NEXT                        LEFT         LAST                        PASSED    UNIT                         ACTIVATES
---------------------------------------------------------------------------------------------------------------------------------
Mon 2024-04-15 00:00:00 UTC 19min left   Sun 2024-04-14 08:20:34 UTC 15h ago   logrotate.timer              logrotate.service
Mon 2024-04-15 00:43:16 UTC 1h 2min left Sun 2024-04-14 09:01:33 UTC 14h ago   fstrim.timer                 fstrim.service
Mon 2024-04-15 00:44:47 UTC 1h 4min left Sun 2024-04-14 23:30:19 UTC 10min ago dnf-makecache.timer          dnf-makecache.service
Mon 2024-04-15 06:52:31 UTC 7h left      -                           -         certbot-renew.timer          certbot-renew.service

$ sudo certbot renew --dry-run

$ sudo nano /etc/nginx/conf.d/kibana.conf

server {
  listen 80; listen [::]:80;
  server_name kibana.example.com;
  return 301 https://$host$request_uri;
}

server {
  server_name kibana.example.com;
  charset utf-8;

  listen 443 ssl;
  listen [::]:443 ssl;
  http2 on;
  http3 on;
  quic_retry on;

  access_log /var/log/nginx/kibana.access.log;
  error_log /var/log/nginx/kibana.error.log;

  ssl_certificate /etc/letsencrypt/live/kibana.example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/kibana.example.com/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/kibana.example.com/chain.pem;
  ssl_session_timeout 1d;
  ssl_session_cache shared:MozSSL:10m;
  ssl_session_tickets off;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
  ssl_prefer_server_ciphers off;

  resolver 8.8.8.8;

  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_dhparam /etc/ssl/certs/dhparam.pem;

  location / {
    proxy_pass http://your_private_IP:5601;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

$ sudo nano /etc/nginx/nginx.conf

server_names_hash_bucket_size 64;

$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

$ sudo systemctl start nginx

$ sudo nano /etc/kibana/kibana.yml

server.publicBaseUrl: "https://kibana.example.com"

$ sudo systemctl restart kibana

$ sudo setsebool -P httpd_can_network_connect 1

$ sudo /usr/share/kibana/bin/kibana-verification-code
Your verification code is:  232 001

$ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

$ sudo nano /etc/yum.repos.d/elasticsearch.repo

[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

$ sudo dnf install --enablerepo=elasticsearch filebeat

$ scp username@your_public_ip:/etc/elasticsearch/certs/http_ca.crt /etc/filebeat

$ sudo nano /etc/filebeat/filebeat.yml

. . .
# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"
  host: "your_private_IP:5601"
  protocol: "http"
  ssl.enabled: true
  ssl.certificate_authorities: ["/etc/filebeat/http_ca.crt"]

. . .

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["your_private_IP:9200"]
  
  # Performance preset - one of "balanced", "throughput", "scale",
  # "latency", or "custom".
  preset: balanced

  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: ""
  ssl.certificate_authorities: ["/etc/filebeat/http_ca.crt"]
  ssl.verification_mode: full

setup.ilm.overwrite: true

$ sudo curl -v --cacert /etc/filebeat/http_ca.crt https://your_private_ip:9200 -u elastic

Enter host password for user 'elastic':
*   Trying 10.0.0.2:9200...
* Connected to 10.0.0.2 (10.0.0.2) port 9200 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/filebeat/http_ca.crt
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=elastic
*  start date: Apr 14 08:37:21 2024 GMT
*  expire date: Apr 14 08:37:21 2026 GMT
*  subjectAltName: host "10.0.0.2" matched cert's IP address!
*  issuer: CN=Elasticsearch security auto-configuration HTTP CA
*  SSL certificate verify ok.
* Server auth using Basic with user 'elastic'
* TLSv1.2 (OUT), TLS header, Unknown (23):
> GET / HTTP/1.1
> Host: 10.0.0.2:9200
> Authorization: Basic ZWxhc3RpYzpsaWZlc3Vja3M2NjIwMDI=
> User-Agent: curl/7.76.1
> Accept: */*
> 
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Unknown (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< X-elastic-product: Elasticsearch
< content-type: application/json
< content-length: 532
< 
{
  "name" : "elastic",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "vnUn8l1bQ1qkF-VjCoiWmQ",
  "version" : {
    "number" : "8.13.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "16cc90cd2d08a3147ce02b07e50894bc060a4cbf",
    "build_date" : "2024-04-05T14:45:26.420424304Z",
    "build_snapshot" : false,
    "lucene_version" : "9.10.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}
* Connection #0 to host 10.0.0.2 left intact

$ sudo filebeat modules enable suricata
Enabled suricata

$ sudo nano /etc/filebeat/modules.d/suricata.yml

# Module: suricata
# Docs: https://www.elastic.co/guide/en/beats/filebeat/8.10/filebeat-module-suricata.html

- module: suricata
  # All logs
eve:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/suricata/eve.json"]

$ sudo filebeat setup

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
Loaded Ingest pipelines

$ sudo systemctl enable filebeat --now

$ sudo systemctl status filebeat
? filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; preset: disabled)
     Active: active (running) since Sun 2024-04-14 10:12:51 UTC; 31s ago
       Docs: https://www.elastic.co/beats/filebeat
   Main PID: 7299 (filebeat)
      Tasks: 8 (limit: 22569)
     Memory: 407.2M
        CPU: 7.640s
     CGroup: /system.slice/filebeat.service
             ??7299 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat..........