ELK 安装-siem

这篇主要是为了给自己记笔记，有点粗糙，不建议观看

安装elk

下载 curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-7.6.1-x86_64.rpm

sudo rpm -vi auditbeat-7.6.1-x86_64.rpm

下面是需要用到的软件包，用上面的方法下载

{elasticsearch-7.6.1-x86_64.rpm kibana-7.6.1-x86_64.rpm filebeat-7.6.1-x86_64.rpm logstash-7.6.1.rpm

auditbeat-7.6.1-x86_64.rpm packetbeat-7.6.1-x86_64.rpm}

主机上传es kibana 软件包 7.6版本elasticsearch-7.6.1-x86_64.rpm kibana-7.6.1-x86_64.rpm

#yum install -y elasticsearch-7.6.1-x86_64.rpm kibana-7.6.1-x86_64.rpm

# vim /etc/elasticsearch/elasticsearch.yml

cluster.name: my-siem

node.name: node-1

network.host: 0.0.0.0

cluster.initial_master_nodes: node-1

# systemctl start elasticsearch

curl http://localhost:9200

{ "name" : "node-1", "cluster_name" : "my-siem", "cluster_uuid" : "jD1WhvTsQaSXPsk1ZzCEsA", "version" : { "number" : "7.6.1", "build_flavor" : "default", "build_type" : "rpm", "build_hash" : "aa751e09be0a5072e8570670309b1f12348f023b", "build_date" : "2020-02-29T00:15:25.529771Z", "build_snapshot" : false, "lucene_version" : "8.4.0", "minimum_wire_compatibility_version" : "6.8.0", "minimum_index_compatibility_version" : "6.0.0-beta1" }, "tagline" : "You Know, for Search" }

#vim /etc/kibana/kibana.yml

server.host: "192.168.0.60"

elasticsearch.hosts: ["http://localhost:9200"]

i18n.locale: "zh-CN"

#systemctl start kibana

#systemctl status kibana

访问 192.168.0.60:5601

节点1

上传包或直接下载

auditbeat-7.6.1-x86_64.rpm

filebeat-7.6.1-x86_64.rpm

packetbeat-7.6.1-x86_64.rpm

#yum install -y auditbeat-7.6.1-x86_64.rpm filebeat-7.6.1-x86_64.rpm packetbeat-7.6.1-x86_64.rpm

#vim /etc/auditbeat/auditbeat.yml

hosts: ["192.168.0.60:9200"]

host: "192.168.0.60:5601"

tags: ["ebank1", "dengbao3"] --这块 可以忽略，也可打开自己修改，定义，没太懂，，

#auditbeat setup

#systemctl start auditbeat

#vim /etc/packetbeat/packetbeat.yml

host: "192.168.0.60:5601"

hosts: ["192.168.0.60:9200"]

#packetbeat setup

#systemctl start packetbeat

回到网页，刷新，能看到数据了