cobrijani / elusive Goto Github PK

Write in a document all rule cases for apache server logs

Write rule cases for firewall logs

Cause of Elk docker image being really huge splitting into 3 separate Docker images is advised.

Send logs from Firewall to Logstash.

Write a document explaining all that was done in this project.

Send logs from Linux OS to Logstash.

Logstash fails to parse apache logs.

Firewall watches use query terms gt and lt for strings. Check firewall pattern in
Elusive\deployment\logstash\pipeline\02-firewall-input.conf. FLAG can be NUMBER or '-' so you need to check this term like strings, not integers. You need to replace:
"range": { "size": { "gt": 15 } } with some query that will match strings. Also replace range greater than 15 with greater than 18 because this watch is very often triggered.

Insert all firewall rules specified in document.

Winlogbeat doesn't send logs to Logstash!

Create Dockerfile for filebeat.

Add x-pack installation for whole elk stack and basic authentication. @

Create Winlogbeat configuration and integrate it in Winlogbeat installation.

Napisati pravila u xpacku za apache web server na kome se nalazi aplikacija za krajnje korisnike.

Instead of creating Signed certificates with Root Ca create Intermediate CA that is responsible for singing future certificates.

Firewall, Linux logs, Windows Events, Application Logs.

Each logs should have their index, some of them already have their index but others needs to have it configured, in order to do that this link explains it which attributes needs to be changed in logstash Logstash output for filebeat.

If you have any questions regarding this task, contact me.

Write rule cases for application server logs

Write logstash configuration for transforming sys log files into objects

Write rule cases for windows event logs

Create kibana dashboard for firebeat index.

Napraviti log generator za apache web server na kome se nalazi aplikacija koja sluzi za pristup glavnom serveru. Toj aplikaciji pristupaju kranji korisnici.

Encrypt sensitive configuration data in elasticsearch

Instead of username password authentication change that kibana and logstash authenticate to elasticsearch via pki authentication.

Create simple basic rule with x-pack

Basic kibana dashboard for apachebeat index.