Install BEATS

Filebeat 

• Configure o filebeat

Versão 7

# apt install filebeat

# vi /etc/filebeat/filebeat.yml

#========= Filebeat inputs =================

filebeat.inputs:

- type: log                                                   

   enabled: true                                             

   paths:

    - /var/log/*.log

    - /var/log/syslog

    - /var/log/messages

    #- /var/log/debug

    exclude_files: ['.gz$','.1$']

#================ General ====================

#name: <NOME DO HOST>                                                <- Opcional

#================= Outputs ====================

# Decidir qual utilizar, Elasticsearch ou logstash

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

  hosts: ["<IP_SERVER_ELK>:9200"]

#-------------------- Logstash output ------------------------

#output.logstash:                                

  #hosts: ["<IP_SERVER_ELK>:5044"]

  # List of root certificates for HTTPS server verifications

  # Copiar a chave gerada no servidor do logstash e disponibilizar com permissao 644 

  #ssl.certificate_authorities: ["/etc/ssl/certs/logstash.pem.crt"]   

•  Reiniciar o serviço

# systemctl daemon-reload && systemctl enable filebeat.service && systemctl restart filebeat.service && systemctl status filebeat.service

• Testar a configuração do filebeat

# /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -e -v -d "*"

• Acompanhar log

# tail /var/log/syslog | grep filebeat

# tail -f /var/log/filebeat/filebeat

Link: 1 / 2

Winlogbeat

• O Winlogbeat serve para coletar os logs do Windows.

• Baixe o arquivo do Winlogbeat zip da página.

• Extraia em C: ou em C:\Program Files e renomei para winlogbeat.

• Abra o PowerShell como administrador e execute:

PS > cd 'C:\Winlogbeat'

• Com o comando abaixo é possivel descobrir quais são as saídas de log para poder configurar o arquivo winlogbeat.yml.

PS C:\winlogbeat> Get-EventLog *

  Max(K) Retain OverflowAction        Entries Log

  ------ ------ --------------        ------- ---

  20.480      0 OverwriteAsNeeded      39.362 Application

  20.480      0 OverwriteAsNeeded           0 HardwareEvents

     512      7 OverwriteOlder              0 Internet Explorer

  20.480      0 OverwriteAsNeeded           0 Key Management Service

  20.480      0 OverwriteAsNeeded      29.150 Security

  20.480      0 OverwriteAsNeeded      63.349 System

  15.360      0 OverwriteAsNeeded      11.285 Windows PowerShell

• Abra o arquivo winlogbeat.yml no notepad e edite.

# ======================== Winlogbeat specific options =========================

  - name: Application

    ignore_older: 24h

....

  - name: System

    ignore_older: 24h

....

  - name: Security

    ignore_older: 24h

....

  - name: ForwardedEvents

    ignore_older: 24h

....

  - name: Setup

    ignore_older: 24h

  - name: Windows Server Update Services

    ignore_older: 24h

  - name: Administrative Events

    ignore_older: 24h

# ================================= Dashboards =================================

setup.dashboards.enabled: true                        <- Opcional

# =================================== Kibana ===================================

setup.kibana:

  host: "10.132.17.102:5601"

# ================================== Outputs ===================================

# Decidir qual utilizar, Elasticsearch ou logstash

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

  hosts: ["<IP_SERVER>:9200"]

# ------------------------------ Logstash Output -------------------------------

#output.logstash:

  #hosts: ["<IP_SERVER>:5044"]

# ================================== Logging ===================================

logging.level: info

logging.to_files: true

logging.files:

  path: C:\winlogbeat\Logs

• Testar a configuração

PS C:\winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e

• Configurar o serviço no Start-Service

PS C:\winlogbeat> .\install-service-winlogbeat.ps1

Status   Name               DisplayName

------   ----               -----------

Stopped  winlogbeat         winlogbeat

• Iniciar o serviço

PS C:\winlogbeat> Start-Service winlogbeat

Link: 1 / 2 

Metricbeat

• O Winlogbeat serve para coletar as metricas do Windows para monitoramento.

• Baixe o arquivo do Metricbeat zip da página.

• Extraia em C: ou em C:\Program Files e renomei para metricbeat.

• Abra o PowerShell como administrador e execute:

PS > cd 'C:\metricbeat'

• Abra o arquivo metricbeat.yml no notepad e edite.

# =================================== Kibana ===================================

setup.kibana:

  host: "<IP_SERVER>:5601"

# ================================== Outputs ===================================

# Decidir qual utilizar, Elasticsearch ou logstash

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

  hosts: ["<IP_SERVER>:9200"]

# ------------------------------ Logstash Output -------------------------------

#output.logstash:

#  hosts: ["<IP_SERVER>:5044"]

• Iniciar o modulos   

PS C:\metricbeat> .\metricbeat.exe modules enable windows

system

• Editar o arquivo C:\metricbeat\modules.d\windows.yml e deixar somente a linha abaixo descomentada

- module: windows

  period: 1m

• Testar a configuração

PS C:\metricbeat> .\metricbeat.exe test config -c .\metricbeat.yml -e

PS C:\metricbeat> .\metricbeat.exe setup -e

• Configurar o serviço no Start-Service

PS C:\metricbeat> .\install-service-metricbeat.ps1

Status   Name               DisplayName

------   ----               -----------

Stopped  metricbeat         metricbeat

• Iniciar o serviço

PS C:\metricbeat> Start-Service metricbeat

Link: 1 / 2 / 3 /

TESTAR

winlogbeat.event_logs:

  - name: Application

    level: critical, error, warning

    ignore_older: 48h

  - name: Security

    processors:

        - drop_event.when.not.or:

            - equals.event_id: 129

            - equals.event_id: 141

            - equals.event_id: 1102

            - equals.event_id: 4648

            - equals.event_id: 4657

            - equals.event_id: 4688

            - equals.event_id: 4697

            - equals.event_id: 4698

            - equals.event_id: 4720

            - equals.event_id: 4738

            - equals.event_id: 4767

            - equals.event_id: 4728

            - equals.event_id: 4732

            - equals.event_id: 4634

            - equals.event_id: 4735

            - equals.event_id: 4740

            - equals.event_id: 4756

    level: critical, error, warning, information

    ignore_older: 48h

  - name: System

    processors:

        - drop_event.when.not.or:

            - equals.event_id: 129

            - equals.event_id: 1022

            - equals.event_id: 1033

            - equals.event_id: 1034

            - equals.event_id: 4624

            - equals.event_id: 4625

            - equals.event_id: 4633

            - equals.event_id: 4719

            - equals.event_id: 4738

            - equals.event_id: 7000

            - equals.event_id: 7022

            - equals.event_id: 7024

            - equals.event_id: 7031

            - equals.event_id: 7034-7036

            - equals.event_id: 7040

            - equals.event_id: 7045

    level: critical, error, warning

    ignore_older: 48h