前言
沒有永遠的安全,如何在被攻擊的情況下,快速響應和快速溯源分析攻擊動作是個重要的話題。想要分析攻擊者做了什麼、怎麼攻擊進來的、還攻擊了誰,那麼日誌是必不可少的一項,因此我們需要儘可能採集多的日誌來進行分析攻擊者的動作,甚至在攻擊者剛落腳的時候就阻斷攻擊者。
安裝Elastic+Kibana
Docker安裝
這邊根據官方文檔:https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html 使用Docker安裝了Elastic和Kibana
# 安裝es docker network create elastic docker pull docker.elastic.co/elasticsearch/elasticsearch:8.12.1 docker run --name es01 --net elastic -p 9200:9200 -it -m 1GB docker.elastic.co/elasticsearch/elasticsearch:8.12.1 # 記錄es的密碼和註冊kibana所需要的token # 測試es是否正確運行 export ELASTIC_PASSWORD="es_your_password" docker cp es01:/usr/share/elasticsearch/config/certs/http_ca.crt . curl --cacert http_ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200 # 安裝kibana docker pull docker.elastic.co/kibana/kibana:8.12.1 docker run --name kib01 --net elastic -p 5601:5601 docker.elastic.co/kibana/kibana:8.12.1 會給出kibana的註冊地址,訪問填入上述記錄的token即可。
不知道是機器性能問題還是Docker安裝的問題,es容器經常會掛掉。
RPM安裝
根據https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html、https://www.elastic.co/guide/en/kibana/current/rpm.html官方文檔,可以yum install安裝。因爲公司訪問鏡像源被封,因此使用上述文檔中下載rpm安裝:
# 安裝es wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.12.1-x86_64.rpm wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.12.1-x86_64.rpm.sha512 shasum -a 512 -c elasticsearch-8.12.1-x86_64.rpm.sha512 sudo rpm --install elasticsearch-8.12.1-x86_64.rpm 安裝kibana wget https://artifacts.elastic.co/downloads/kibana/kibana-8.12.1-x86_64.rpm wget https://artifacts.elastic.co/downloads/kibana/kibana-8.12.1-x86_64.rpm.sha512 shasum -a 512 -c kibana-8.12.1-x86_64.rpm.sha512 sudo rpm --install kibana-8.12.1-x86_64.rpm
依然在安裝es的rpm時,會吐出es/kibana的密碼:
The generated password for the elastic built-in superuser is : Fq*S7jxCjFfPu6nN8NG8
es服務可能啓動不了,但是安裝時會給出啓動命令:
sudo systemctl daemon-reload sudo systemctl enable elasticsearch.service
測試es啓動是否正常:
export ELASTIC_PASSWORD="Fq*S7jxCjFfPu6nN8NG8" curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200
記得改下配置文件,使其監聽在0.0.0.0上面:
# /etc/elasticsearch/elasticsearch.yml # Allow HTTP API connections from anywhere # Connections are encrypted and require user authentication http.host: 0.0.0.0 # Allow other nodes to join the cluster from anywhere # Connections are encrypted and mutually authenticated transport.host: 0.0.0.0
kibana一樣,記得改下配置文件,使其監聽在0.0.0.0上面:
# /etc/kibana/kibana.yml server.host: "0.0.0.0"
安裝Fleet和Elastic Agent
在Kibana上,Management->Fleet->Add Fleet Server,先安裝Fleet Server,URL填寫https協議,端口可以填默認的8220。裝好Fleet Server後再裝Elastic Agent,Fleet Server也是一個Agent,因此不能在同一臺機器上同時裝Fleet Server和Elastic Agent。
爲了使其Elastic Agent附帶Security能力,可以添加各式各樣的integrations集成,如到Security->Manage->Get started->Add security integrations安裝安全集成:
測試告警
注意,如果有如下錯誤需解決,否則會無法查閱規則:
【---- 幫助網安學習,以下所有學習資料免費領!領取資料加 we~@x:dctintin,備註 “開源中國” 獲取!】
① 網安學習成長路徑思維導圖
② 60 + 網安經典常用工具包
③ 100+SRC 漏洞分析報告
④ 150 + 網安攻防實戰技術電子書
⑤ 最權威 CISSP 認證考試指南 + 題庫
⑥ 超 1800 頁 CTF 實戰技巧手冊
⑦ 最新網安大廠面試題合集(含答案)
⑧ APP 客戶端安全檢測指南(安卓 + IOS)
有些規則沒開,記得開下,比如我把reverse shell規則打開後:Security->Dashboards->Detection & Response可以看到一些概覽:
記錄Windows事件管理器日誌
安裝
Windows事件管理器日誌不是單純的文本,因此需要藉助一些工具來幫助我們完成採集的目的。這裏使用winlogbeat(https://www.elastic.co/cn/beats/winlogbeat)完成。官方提供了很詳細的安裝文檔(https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html),核心就是配置想要記錄的日誌類型和對外傳輸的方案,這裏我使用的方案爲:
-
記錄的日誌類型,我沒改,默認就是Security、Application,甚至還有Sysmon
-
對外傳輸,我使用了傳輸到elastic
配置好winlogbeat.yml
後可以進行測試配置文件對不對:
.\winlogbeat.exe test config -c .\winlogbeat.yml -e
下面爲我的配置文件信息:
###################### Winlogbeat Configuration Example ######################## # This file is an example configuration file highlighting only the most common # options. The winlogbeat.reference.yml file from the same directory contains # all the supported options with more comments. You can use it as a reference. # # You can find the full configuration reference here: # https://www.elastic.co/guide/en/beats/winlogbeat/index.html # ======================== Winlogbeat specific options ========================= # event_logs specifies a list of event logs to monitor as well as any # accompanying options. The YAML data type of event_logs is a list of # dictionaries. # # The supported keys are name, id, xml_query, tags, fields, fields_under_root, # forwarded, ignore_older, level, event_id, provider, and include_xml. # The xml_query key requires an id and must not be used with the name, # ignore_older, level, event_id, or provider keys. Please visit the # documentation for the complete details of each option. # https://go.es.io/WinlogbeatConfig winlogbeat.event_logs: - name: Application ignore_older: 72h - name: System - name: Security - name: Microsoft-Windows-Sysmon/Operational - name: Windows PowerShell event_id: 400, 403, 600, 800 - name: Microsoft-Windows-PowerShell/Operational event_id: 4103, 4104, 4105, 4106 - name: ForwardedEvents tags: [forwarded] # ====================== Elasticsearch template settings ======================= setup.template.settings: index.number_of_shards: 1 #index.codec: best_compression #_source.enabled: false # ================================== General =================================== # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. #name: # The tags of the shipper are included in their field with each # transaction published. #tags: ["service-X", "web-tier"] # Optional fields that you can specify to add additional information to the # output. #fields: # env: staging # ================================= Dashboards ================================= # These settings control loading the sample dashboards to the Kibana index. Loading # the dashboards is disabled by default and can be enabled either by setting the # options here or by using the `setup` command. #setup.dashboards.enabled: false # The URL from where to download the dashboard archive. By default, this URL # has a value that is computed based on the Beat name and version. For released # versions, this URL points to the dashboard archive on the artifacts.elastic.co # website. #setup.dashboards.url: # =================================== Kibana =================================== # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API. # This requires a Kibana endpoint configuration. setup.kibana: # Kibana Host # Scheme and port can be left out and will be set to the default (http and 5601) # In case you specify and additional path, the scheme is required: http://localhost:5601/path # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601 #host: "localhost:5601" # Kibana Space ID # ID of the Kibana Space into which the dashboards should be loaded. By default, # the Default Space will be used. #space.id: # =============================== Elastic Cloud ================================ # These settings simplify using Winlogbeat with the Elastic Cloud (https://cloud.elastic.co/). # The cloud.id setting overwrites the `output.elasticsearch.hosts` and # `setup.kibana.host` options. # You can find the `cloud.id` in the Elastic Cloud web UI. #cloud.id: # The cloud.auth setting overwrites the `output.elasticsearch.username` and # `output.elasticsearch.password` settings. The format is `<user>:<pass>`. #cloud.auth: # ================================== Outputs =================================== # Configure what output to use when sending the data collected by the beat. # ---------------------------- Elasticsearch Output ---------------------------- output.elasticsearch: # Array of hosts to connect to. hosts: ["your_ip:9200"] # Protocol - either `http` (default) or `https`. #protocol: "https" # Authentication credentials - either API key or username/password. #api_key: "id:api_key" username: "elastic" password: "passwords" # Pipeline to route events to security, sysmon, or powershell pipelines. pipeline: "winlogbeat-%{[agent.version]}-routing" # ------------------------------ Logstash Output ------------------------------- #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" # ================================= Processors ================================= processors: - add_host_metadata: when.not.contains.tags: forwarded - add_cloud_metadata: ~ # ================================== Logging =================================== # Sets log level. The default log level is info. # Available log levels are: error, warning, info, debug #logging.level: debug # At debug level, you can selectively enable logging only for some components. # To enable all selectors, use ["*"]. Examples of other selectors are "beat", # "publisher", "service". #logging.selectors: ["*"] # ============================= X-Pack Monitoring ============================== # Winlogbeat can export internal metrics to a central Elasticsearch monitoring # cluster. This requires xpack monitoring to be enabled in Elasticsearch. The # reporting is disabled by default. # Set to true to enable the monitoring reporter. #monitoring.enabled: false # Sets the UUID of the Elasticsearch cluster under which monitoring data for this # Winlogbeat instance will appear in the Stack Monitoring UI. If output.elasticsearch # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch. #monitoring.cluster_uuid: # Uncomment to send the metrics to Elasticsearch. Most settings from the # Elasticsearch outputs are accepted here as well. # Note that the settings should point to your Elasticsearch *monitoring* cluster. # Any setting that is not set is automatically inherited from the Elasticsearch # output configuration, so if you have the Elasticsearch output configured such # that it is pointing to your Elasticsearch monitoring cluster, you can simply # uncomment the following line. #monitoring.elasticsearch: # ============================== Instrumentation =============================== # Instrumentation support for the winlogbeat. #instrumentation: # Set to true to enable instrumentation of winlogbeat. #enabled: false # Environment in which winlogbeat is running on (eg: staging, production, etc.) #environment: "" # APM Server hosts to report instrumentation results to. #hosts: # - http://localhost:8200 # API Key for the APM Server(s). # If api_key is set then secret_token will be ignored. #api_key: # Secret token for the APM Server(s). #secret_token: # ================================= Migration ================================== # This allows to enable 6.7 migration aliases #migration.6_to_7.enabled: true
數據檢索
這時候,可能elastic上面搜不到數據,是因爲winlogbeat使用了他自己的索引,默認爲winlogbeat-version,筆者測試時,發現kibana上遲遲出現不了該索引,還以爲數據傳輸沒成功呢,因此通過如下手段進行排查,先獲取es上面的索引信息:
http://your_ip:9200/_cat/indices?v
發現有類似winlogbeat的索引信息:
yellow open .ds-winlogbeat-8.12.0-2024.02.03-000001 UpWhWCpdR-2WgMVe_kiH9A 1 1 192705 0 131.1mb 131.1mb
後面嘗試在kibana上創建一個新的索引即可,v7.17.12版本的kibana創建索引的過程如下:discover->選項->View Discover settings
找到“索引模式”創建一個新的索引即可:
這時候就可以檢索事件管理器日誌了: