Plit00's Story

ELK Stack - DC Server Packetbeat 연동 본문

Security/Elasticsearch

ELK Stack - DC Server Packetbeat 연동

plit00 2022. 4. 15. 16:56

https://www.elastic.co/kr/downloads/beats/packetbeat

 

Download Packetbeat | Elastic

Download Packetbeat, the open source tool for getting insight into your network data, including protocols like HTTP, DNS, and MySQL, traveling over the wire in real time.

www.elastic.co

1. 해당 서버에 npcap가 설치가 되어있지않다면, 설치해주시면됩니다.


2. Packetbeat 설치

PS C:\packetbeat-8.1.1-windows-x86_64 > .\install-service-packerbeat.ps1


# ELK 연결 :: packetbeat.yml

setup.kibana:
   host: "Your_IP:5601"

output.elasticsearch:
   hosts: ["Your_IP:9200"]
   allow_older_versions: true


# packetbeat.interfaces.device 설정 
.\packetbeat.exe devies 를 통해 해당 device에 따라 *packetbeat.interfaces.dervice: ? 로 설정해주시면 됩니다.

PS C:\packetbeat-8.1.1-windows-x86_64 > .\packetbeat.exe setup -e
PS C:\packetbeat-8.1.1-windows-x86_64 > .\packetbeat -e -c packetbeat.yml
PS C:\packetbeat-8.1.1-windows-x86_64 > Strat-Service packetbeat

'Security > Elasticsearch' 카테고리의 다른 글

[Node.js] - Elasticsearch 페이지 출력  (0) 2023.01.25
[Node.js] - Elasticsearch query  (0) 2022.12.18
ELK Stack - Winlogbeat, Sysmon연동  (0) 2022.04.15
ELK Stask 구축 [원격 설정]  (0) 2022.04.15
ElK Stack 구축 중 Logstash 오류  (0) 2022.04.15
'Security/Elasticsearch' Related Articles more
Comments