Integration between Suricata and ELK stack

Help
1

Like I saw in that project
GitHub - telekom-security/tpotce: šŸÆ T-Pot - The All In One Honeypot Platform šŸ an integration between Suricata and ELK stack.

How does ELK stack got the information from Suricata to show such a wonderful view?

Does it take the information from Suricata log? Or access to Suricata DB directly(Suricata using Elastic Search as a DB ,right?)

2

Getting an ELK stack up and running can be complicated, especially if not already familiar with the stack. But the basic components are:

  • Elasticsearch running on some server.
  • Kibana running, usually on the same server as Elasticsearch, connected to Elasticsearch.
  • Logstash or Filebeat running on your Suricata sensor forwarding the logs to Elasticsearch.

But then generally you are left on your own to build up nice Dashboards in Kibana, as Iā€™m not aware of a simple way to share pre-built ones. Or you could also try out something like SELKS (Stamus Networks | SELKS) which does all of the above for you with some nice Dashboards.

2 Likes