Security center

Using Logstash receiver and Elasticsearch , Snort add-on on Pfsenese Firewall and Barnyard2 sends syslogs sends to Logstasth act as syslog listener and store into elasticsearch Added few screenshot for configuratiuon tips , and in addition my Logstash input file config

Logstash config file

Author: Tal Bar-Or

Email: tbaror@dalet.com

Last Update: 11/18/2016

This conf file is based on accepting logs for snort

input { udp { port => 5142 type => snort } } filter { if [host] =~ /172.17.37.2/ or [host] =~ /10.0.8.2/ or [host] =~ /10.0.11.2/ or [host] =~ /10.0.10.2/ or [host] =~ /10.0.12.2/ or [host] =~ /10.0.14.2/ or [host] =~ /10.0.15.2/{ # This is the initial parsing of the log grok { match => { "message" => "|%{SPACE}[%{WORD:msg_source}[%{WORD:msg}]:%{SPACE}[%{GREEDYDATA:sensor_name}]%{SPACE}]%{SPACE}||%{SPACE}%{TIMESTAMP_ISO8601:event_timestamp}%{SPACE}%{INT:event_priority}%{SPACE}[%{INT:gid}:%{INT:sid}:%{INT:rev}]%{SPACE}%{DATA:alert_description}||%{SPACE}%{DATA:classification}%{SPACE}||%{SPACE}%{INT:protocol}%{SPACE}%{IP:SrcIp}%{SPACE}%{IP:DstIp}%{SPACE}||%{SPACE}%{INT:SrcPort}%{SPACE}%{INT:DstPort}%{SPACE}"} } # If you'd like to collect the DNS name for the SrcIP keep this section. Caution, this can cause an attacker to go into hiding. # If you do not want reverse DNS lookups of IPs keep this uncommented. #mutate { # add_field => { "SrcIP-resolved" => "%{SrcIp}" } #} #dns { # reverse => [ "[SrcIP-resolved]" ] # action => "replace" #}

# This will attempt to do a geoip lookup against the SrcIP
geoip {
  source => "SrcIp"
  target => "SrcGeoip"
  database => "/etc/logstash/GeoLite2-City.mmdb"
  add_field => [ "[SrcGeoip][coordinates]", "%{[geoip][longitude]}" ]
  add_field => [ "[SrcGeoip][coordinates]", "%{[geoip][latitude]}"  ]
}
mutate {
  convert => [ "[SrcGeoip][coordinates]", "float"]
}
#geoip {
#  source => "[SrcIp]"
#  target => "SrcGeo"
#}
If you'd like to collect the DNS name for the DstIP keep this section.  Caution, this can cause an attacker to go into hiding.
If you do not want reverse DNS lookups of IPs keep this uncommented.
#mutate {
add_field => { "DstIP-resolved" => "%{DstIp}" }
#}
#dns {
reverse => [ "[DstIP-resolved]" ]
action => "replace"
#}
This will attempt to do a geoip lookup against the DstIP
geoip {
source => "DstIp"
target => "DstGeoip"
database => "/etc/logstash/GeoLite2-City.mmdb"
add_field => [ "[DstGeoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[DstGeoip][coordinates]", "%{[geoip][latitude]}"  ]
}
mutate {
convert => [ "[DstGeoip][coordinates]", "float"]
}
#geoip {
source => "[DstIp]"
target => "DstGeo"
#}
If the alert is a Snort GPL alert break it apart for easier reading and categorization
if [alert_description] =~ "GPL " {
This will parse out the category type from the alert
grok {
match => { "alert" => "GPL\s+%{DATA:category}\s" }
}
This will store the category
mutate {
add_field => { "rule_type" => "Snort GPL" }
lowercase => [ "category"]
}
}
If the alert is an Emerging Threat alert break it apart for easier reading and categorization
if [alert_description] =~ "ET " {
This will parse out the category type from the alert
grok {
match => { "alert" => "ET\s+%{DATA:category}\s" }
}
This will store the category
mutate {
add_field => { "rule_type" => "Emerging Threats" }
lowercase => [ "category"]
}
}
I recommend changing the field types below to integer so searches can do greater than or less than
and also so math functions can be ran against them
mutate {
convert => [ "SrcPort", "integer" ]
convert => [ "DstPort", "integer" ]
convert => [ "event_priority", "integer" ]
convert => [ "protocol", "integer" ]
remove_field => [ "message"]
}
This will translate the priority field into a severity field of either High, Medium, or Low
if [event_priority] == 1 {
mutate {
add_field => { "severity" => "High" }
}
}
if [event_priority] == 2 {
mutate {
add_field => { "severity" => "Medium" }
}
}
if [event_priority] == 3 {
mutate {
add_field => { "severity" => "Low" }
}
}
This section adds URLs to lookup information about a rule online
mutate {
add_field => [ "ET_Signature_Info", "http://doc.emergingthreats.net/%{sid}" ]
add_field => [ "Snort_Signature_Info", "https://www.snort.org/search?query=%{gid}-%{sid}" ]

}
#protocol type detection
if [protocol] == 17 {
mutate {
replace => { "protocol" => "UDP" }
}
}
if [protocol] == 6 {
mutate {
replace => { "protocol" => "TCP" }
}
}
if [protocol] == 1 {
mutate {
replace => { "protocol" => "ICMP" }
}
}
if [protocol] == 2 {
mutate {
replace => { "protocol" => "IGMP" }
}
}

} }

output { if [msg_source]== "SNORTIDS" { elasticsearch { index => "ids_sensors" hosts => ["localhost:9200"]} stdout { codec => rubydebug }

} }