ELK Stack, Wazuh 연동 (최종)

timedatectl sudo timedatectl set-timezone Asia/Seoul timedatectl

apt-get update

apt-get install -y apt-transport-https zip unzip lsb-release curl gnupg

curl -s https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/elasticsearch.gpg --import && chmod 644 /usr/share/keyrings/elasticsearch.gpg

echo "deb [signed-by=/usr/share/keyrings/elasticsearch.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main" | tee /etc/apt/sources.list.d/elastic-7.x.list

apt-get update

apt-get install elasticsearch=7.16.2

sudo vi /etc/elasticsearch/elasticsearch.yml

systemctl daemon-reload systemctl enable elasticsearch systemctl start elasticsearch

systemctl status elasticsearch curl -XGET http://localhost:9200

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

apt-get update

apt-get install -y wazuh-manager=4.5.4-1

systemctl daemon-reload systemctl enable wazuh-manager systemctl start wazuh-manager

systemctl status wazuh-manager

apt-get install filebeat=7.16.2

curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.5/tpl/elastic-basic/filebeat_all_in_one.yml

curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.5.4/extensions/elasticsearch/7.x/wazuh-template.json chmod go+r /etc/filebeat/wazuh-template.json

curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.2.tar.gz | tar -xvz -C /usr/share/filebeat/module

sudo vi /etc/filebeat/filebeat.yml

systemctl daemon-reload systemctl enable filebeat systemctl start filebeat

filebeat test output

apt-get install kibana=7.16.2

mkdir /usr/share/kibana/data chown -R kibana:kibana /usr/share/kibana

cd /usr/share/kibana sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.5.4_7.16.2-1.zip

sudo vi /etc/kibana/kibana.yml

systemctl daemon-reload systemctl enable kibana systemctl start kibana

sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/elastic-7.x.list apt-get update

Sysmon.exe -i -accepteula

<localfile> <location>Microsoft-Windows-Sysmon/Operational</location> <log_format>eventchannel</log_format> </localfile>

sudo /var/ossec/bin/manage_agents A

E

sudo systemctl stop wazuh-manager sudo rm /var/ossec/queue/db/global.db sudo systemctl start wazuh-manager

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

apt-get update

WAZUH_MANAGER="<Wazuh_manager_ip>" apt-get install wazuh-agent=4.5.4-1

sudo vi /var/ossec/etc/ossec.conf

sudo /var/ossec/bin/manage_agents A E

sudo /var/ossec/bin/manage_agents I

systemctl daemon-reload systemctl enable wazuh-agent systemctl start wazuh-agent

sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list apt-get update

apt-get remove wazuh-agent

curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.5.4-1_amd64.deb && sudo WAZUH_AGENT_GROUP='default' WAZUH_AGENT_NAME='WDB' dpkg -i ./wazuh-agent.deb

systemctl disable wazuh-agent systemctl daemon-reload

https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.16.2-windows-x86_64.zip

https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.16.2-windows-x86_64.zip

packetbeat.exe setup -e

packetbeat.exe -e

Set-ExecutionPolicy Unrestricted -Scope CurrentUser

.\install-service-packetbeat.ps1

Start-Service packetbeat

curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.16.2-linux-x86_64.tar.gz tar xzvf packetbeat-7.16.2-linux-x86_64.tar.gz

cd packetbeat-7.16.2-linux-x86_64 ./packetbeat devices

seccomp: default_action: allow

./packetbeat setup -e

./packetbeat -e

sudo vi /etc/systemd/system/packetbeat.service

[Unit] Description=Packetbeat Service Documentation=https://www.elastic.co/guide/en/beats/packetbeat/current/index.html Wants=network-online.target After=network-online.target [Service] ExecStart=/home/kisec/packetbeat-7.16.2-linux-x86_64/packetbeat -c /home/kisec/packetbeat-7.16.2-linux-x86_64/packetbeat.yml -e Restart=always User=root Group=root Environment="GODEBUG=netdns=go" [Install] WantedBy=multi-user.target /root/packetbeat-7.16.2-linux-x86_64

sudo chmod 644 /etc/systemd/system/packetbeat.service

sudo systemctl daemon-reload sudo systemctl enable packetbeat sudo systemctl start packetbeat

sudo systemctl status packetbeat