Making Your Home Lab: Elastic Stack SIEM

December 3, 2024

Here is my Guide to Setting up your Own Lab as a SIEM with Elastic Stack

Setting Up a Home Lab SIEM with Elastic Stack

Prerequisites:

A computer running a Linux-based OS (e.g., Ubuntu, Debian) or a virtual machine.
Basic understanding of Linux commands and network concepts.

Step 1: Install the Elastic Stack

Add the Elastic Repository:

sudo apt-get install apt-transport-https
curl -fsSL https://artifacts.elastic.co/GPG-KEY-public | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list

Update the Package Lists:
```
sudo apt update
```

Install Elasticsearch, Logstash, and Kibana:

sudo apt install elasticsearch logstash kibana

Step 2: Configure Elasticsearch

Edit the Configuration File:

sudo nano /etc/elasticsearch/elasticsearch.yml

Set the Network Interface: Uncomment the network.host line and set it to 0.0.0.0 to allow connections from other machines.
Start Elasticsearch:
```
sudo systemctl start elasticsearch
```

Step 3: Configure Logstash

Create a Logstash Pipeline: Create a new configuration file (e.g., /etc/logstash/conf.d/siem.conf) and add the following configuration:

input {
    stdin {
        codec => json
    }
}

filter {
    # Add filters here, e.g., grok, dissect, mutate
}

output {
    elasticsearch {
        hosts => ["localhost:9200"]
    }
}

Start Logstash:
```
sudo systemctl start logstash
```

Step 4: Configure Kibana

Start Kibana:
```
sudo systemctl start kibana
```
Access Kibana: Open a web browser and go to http://localhost:5601.

Step 5: Ingest Sample Data

Generate Sample Data: You can use tools like tcpdump, wireshark, or syslog-ng to generate sample network traffic or system logs.
Send Data to Logstash: Use tools like nc or logger to send the data to Logstash’s input port.
Visualize Data in Kibana: Explore the Discover tab to view the ingested data. Create visualizations and dashboards to analyze the data.

Additional Tips:

Elastic Agent: For easier data collection, consider using the Elastic Agent to collect logs from various sources and forward them to Elasticsearch.
Elastic Security: This pre-built solution offers advanced security analytics capabilities, including threat detection, investigation, and response.
Security Best Practices:
- Secure your Elastic Stack deployment.
- Implement strong access controls.
- Keep software and plugins up-to-date.
- Monitor for vulnerabilities and threats.

By following these steps, you’ll have a basic SIEM environment up and running. Experiment with different data sources, filters, and visualizations to gain hands-on experience with security analytics.