IT environments are becoming increasingly large, distributed and difficult to manage. All system components must be protected and monitored against cyber threats. You need a scalable platform that can store and analyze logs, metrics and events. SIEM solutions can cost a lot of money. In this story we will take a look at the free solution available in Elastic Stack, which is Elastic SIEM.
Elastic Stack is a set of components: Elasticsearch, Kibana, Logstash and Beats. Brief information about what is used in this story:
I’ve created 3 virtual machines on the Azure cloud:
We’ll put a simple one node cluster. Here you can download Elasticsearch and Kibana deb files.
The installation:
sudo dpkg -i file_name.deb
#security #elasticsearch #elastic-stack