https://wiki.ixheim.de/index.php?action=history&feed=atom&title=ELK_%C3%9Cbungen 2026-06-29T04:08:55Z Versionsgeschichte dieser Seite in Xinux Wiki MediaWiki 1.35.1 https://wiki.ixheim.de/index.php?title=ELK_%C3%9Cbungen&diff=64652&oldid=prev 2025-09-14T12:17:50Z

<p><span dir="auto"><span class="autocomment">Suricata-Events</span></span></p> <table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="de"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 14. September 2025, 12:17 Uhr</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l5" >Zeile 5:</td> <td colspan="2" class="diff-lineno">Zeile 5:</td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Suricata-Events ==</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Suricata-Events ==</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* Filtere in Discover alle Suricata-Events.</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* Filtere in Discover alle Suricata-Events.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>&lt;!-- Lösung: <del class="diffchange diffchange-inline">Filter hinzufügen → event.dataset : &quot;</del>suricata<del class="diffchange diffchange-inline">&quot;</del>. <del class="diffchange diffchange-inline">Ergebnis: Nur IDS/IPS</del>-Events <del class="diffchange diffchange-inline">sichtbar</del>, <del class="diffchange diffchange-inline">z</del>. <del class="diffchange diffchange-inline">B</del>. <del class="diffchange diffchange-inline">logs-pfelk-suricata-Index</del>. --&gt;</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>&lt;!-- Lösung: <ins class="diffchange diffchange-inline">In Discover das Data View *-pfelk-</ins>suricata<ins class="diffchange diffchange-inline">* auswählen</ins>.  </div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Dadurch werden automatisch nur Suricata</ins>-Events <ins class="diffchange diffchange-inline">angezeigt. </ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Zusätzlich wichtige Felder einblenden (source.ip</ins>, <ins class="diffchange diffchange-inline">destination</ins>.<ins class="diffchange diffchange-inline">ip, destination</ins>.<ins class="diffchange diffchange-inline">port, rule.description, event.severity), </ins></div></td></tr> <tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">um Angriffe und Warnungen im Detail zu sehen</ins>. --&gt;</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== SSH-Zugriffe ==</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== SSH-Zugriffe ==</div></td></tr> </table>

Thomas.will https://wiki.ixheim.de/index.php?title=ELK_%C3%9Cbungen&diff=64651&oldid=prev 2025-09-14T12:13:31Z

<p></p> <table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="de"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 14. September 2025, 12:13 Uhr</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1" >Zeile 1:</td> <td colspan="2" class="diff-lineno">Zeile 1:</td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">= ELK Übungen =</del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2"> </td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Zeitfilter ==</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Zeitfilter ==</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* Stelle in Kibana Discover die Zeitspanne auf ''Last 7 days''.</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* Stelle in Kibana Discover die Zeitspanne auf ''Last 7 days''.</div></td></tr> </table>

Thomas.will https://wiki.ixheim.de/index.php?title=ELK_%C3%9Cbungen&diff=64650&oldid=prev 2025-09-14T12:13:22Z

<p>Die Seite wurde neu angelegt: „ = ELK Übungen = == Zeitfilter == * Stelle in Kibana Discover die Zeitspanne auf &#039;&#039;Last 7 days&#039;&#039;. &lt;!-- Lösung: Oben rechts Zeitfilter öffnen → &#039;&#039;Last 7 d…“</p> <p><b>Neue Seite</b></p><div><br /> = ELK Übungen =<br /> <br /> == Zeitfilter ==<br /> * Stelle in Kibana Discover die Zeitspanne auf ''Last 7 days''.<br /> &lt;!-- Lösung: Oben rechts Zeitfilter öffnen → ''Last 7 days'' auswählen → Refresh. Danach werden alle Suricata- und Firewall-Events der letzten Woche angezeigt. --&gt;<br /> <br /> == Suricata-Events ==<br /> * Filtere in Discover alle Suricata-Events.<br /> &lt;!-- Lösung: Filter hinzufügen → event.dataset : &quot;suricata&quot;. Ergebnis: Nur IDS/IPS-Events sichtbar, z. B. logs-pfelk-suricata-Index. --&gt;<br /> <br /> == SSH-Zugriffe ==<br /> * Zeige alle Suricata-Events, die Port 22 betreffen.<br /> &lt;!-- Lösung: Filter → destination.port : 22. Ergebnis: Erkennbar sind SSH-Scan-Versuche oder Brute-Force-Tests. --&gt;<br /> <br /> == Firewall-Blocks ==<br /> * Filtere alle Firewall-Events mit geblockten Aktionen.<br /> &lt;!-- Lösung: Filter → event.dataset : &quot;firewall&quot; AND action : &quot;block&quot;. Ergebnis: Nur Events, bei denen die OPNsense-Verbindung abgelehnt hat. --&gt;<br /> <br /> == IDS und Firewall zusammen ==<br /> * Zeige alle HTTP-Zugriffe (Port 80), egal ob von Suricata oder Firewall geloggt.<br /> &lt;!-- Lösung: Kombi-Filter → (event.dataset:&quot;suricata&quot; AND destination.port:80) OR (event.dataset:&quot;firewall&quot; AND destination.port:80). Ergebnis: Alle HTTP-Events im Zusammenhang sichtbar. --&gt;<br /> <br /> == Top Talker ==<br /> * Finde die häufigsten Quell-IPs in Suricata-Events.<br /> &lt;!-- Lösung: In ''Visualize (Lens)'' wechseln → Aggregation ''Top values of source.ip''. Ergebnis: Liste mit den 5 meistgenannten Angreifer-IPs. --&gt;<br /> <br /> == Zeitliche Entwicklung ==<br /> * Stelle die Anzahl Suricata-Events über Zeit dar.<br /> &lt;!-- Lösung: In ''Visualize'' → X-Achse @timestamp (Date Histogram), Y-Achse Count. Ergebnis: Zeitreihe, Peaks zeigen Scans oder Angriffe. --&gt;<br /> <br /> == Unknown-Events ==<br /> * Finde heraus, welche Events im Index ''logs-pfelk-unknown-*'' liegen.<br /> &lt;!-- Lösung: In Discover Data View ''logs-pfelk-*'' wählen → Filter auf event.dataset:&quot;unknown&quot;. Ergebnis: Events sichtbar, die nicht sauber gemappt wurden. --&gt;</div>

Thomas.will