1.
Security Event Monitoring,Log
Management Describe:
“LogStash,Elastic & Kibana"
Present & Gathered by:
Reza Adineh
Cyber Security Specialist
SOC Expert
Forensic Researcher
Contact me:
https://ir.linkedin.com/in/rezaadineh
Feb-2018

2.
Module 1:Elastic: Product Portfolio

3.
Phases : How to implement

4.
Heart of ELK stack: Elasticsearch
Based on Apache Lucene
Shay Banon, Compass to Elasticsearch, released in 2010
In 2012 Elastic was founded in Amsterdam
RESTful search & Analytics engine

5.
The Journey of an Event in elastic:

6.
Plugin Ecosystem:
Rich Integration & Processing
200+ plugins
Extensible framework to easily build your own plugin
Logstash Plugins Maintainer Program

7.
Module 2:What is ELK Stack ?

8.
Need for log analysis
Lets understand why do we need log analysis ?

9.
Needs for Log analysis

10.
Problems with log analysis
Lets understand what problems occurred with log analysis ?

11.
Log management tool

12.
Lets now understand what exactly is ELK Stack.

13.
Elastic Search

14.
LogStash

15.
Kibana

16.
How exactly ELK Stack works ?

17.
Many Companies use ELK Stack

18.
Visualizing logs using ElasticSearch, Logstach & Kibana &
saving millions !

19.
Keep a deeper look at Logs & how implement
ElasticSearch, Logstach & Kibana
Logs & Log structures:

20.
A log is human readable …
A human readable, machine parsable representation of an
event.

21.
Regex ?!
How to parse logs ?
OR Indexing & Labeling

22.
Thinking open source :
Logstash
Graylog
Logalyse
Scribe
Hadooooop
Did you like it ?
Lets look at Logstash …

23.
Logstash Architecture

24.
Logstash Architecture :

25.
Scaling Deployment:

26.
Summary of Log’s Lifecycle:

27.
Lets look at some
examples:

28.
Define Some output:

29.
Kibana custom dashboards :

30.
Logstash- Twitter Input

31.
Already have central Rsyslog/SyslogNg Server ?

32.
Also you can use it as Central Syslog Server
It is too good for Appliances

33.
Use matching input & outputs to Sendfile contents to
another log stash for processing.

34.
Further reading on :
logstash.net
logstashbook.com
Juju charms.com/charms/precise/logstash-indexer
Logstash puppet module(github/electrical)

35.
Any question ?
Contact me:
https://ir.linkedin.com/in/
rezaadineh