Aktuelle Version vom 19. April 2025, 10:08 Uhr

@@ Zeile 1: / Zeile 1: @@
+*[[Elastic Stack]]
-=Install elasticsearch=
+*[[ELK Kali Purple Installation]]
-*sudo apt update && sudo apt upgrade
+*[[Kali Purple Fleet Server]]
-*sudo bash -c "export HOSTNAME=purple.cyber.local; apt-get install elasticsearch -y"
+*[[Kali Purple Fleet Windows Defend Integration]]
-'''take note of "elastic" user password'''
+*[[Stack Monitoring mit Metricbeat]]
-;Example: The generated password for the elastic built-in superuser is : '''Wb-6=0u*y4OJDDSkHYza'''
+*[[ELK Kali Purple Erste Schritte]]
-;Reset:
+*[[Fleet]]
-<pre>
-You can complete the following actions at any time:
-Reset the password of the elastic built-in superuser with
-'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.
-Generate an enrollment token for Kibana instances with
- '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.
-Generate an enrollment token for Elasticsearch nodes with
-'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.
-</pre>
-=Convert to single-node setup (or replace fqdn name in initial_master_nodes list with IP address)=
-*sudo sed -e '/cluster.initial_master_nodes/ s/^#*/#/' -i /etc/elasticsearch/elasticsearch.yml
-*echo "discovery.type: single-node" | sudo tee -a /etc/elasticsearch/elasticsearch.yml
-=Install Kibana=
-*sudo apt install kibana
-*sudo /usr/share/kibana/bin/kibana-encryption-keys generate -q
-==Add keys to /etc/kibana/kibana.yml==
-*echo "server.host: \"kali-purple.kali.purple\"" | sudo tee -a /etc/kibana/kibana.yml
-==Ensure kali-purple.kali.purple is only mapped to 192.168.253.5 in /etc/hosts in order to bind Kibana to that interface==
-*sudo systemctl enable elasticsearch kibana --now
-=Enroll Kibana=
-*sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
- #open browser and navigate to http://192.168.253.5:5601 enter username=elastic and password as displayed after installation paste token from above
-*sudo /usr/share/kibana/bin/kibana-verification-code
- #enter verification code into Kibana when prompted
-=Enable HTTPS for Kibana=
-*sudo /usr/share/elasticsearch/bin/elasticsearch-certutil ca
-*sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --dns kali-purple.kali.purple,elastic.kali.purple,kali-purple --out kibana-server.p12
-*sudo openssl pkcs12 -in /usr/share/elasticsearch/elastic-stack-ca.p12 -clcerts -nokeys -out /etc/kibana/kibana-server_ca.crt
-*sudo openssl pkcs12 -in /usr/share/elasticsearch/kibana-server.p12 -out /etc/kibana/kibana-server.crt -clcerts -nokeys
-*sudo openssl pkcs12 -in /usr/share/elasticsearch/kibana-server.p12 -out /etc/kibana/kibana-server.key -nocerts -nodes
-*sudo chown root:kibana /etc/kibana/kibana-server_ca.crt
-*sudo chown root:kibana /etc/kibana/kibana-server.key
-*sudo chown root:kibana /etc/kibana/kibana-server.crt
-*sudo chmod 660 /etc/kibana/kibana-server_ca.crt
-*sudo chmod 660 /etc/kibana/kibana-server.key
-*sudo chmod 660 /etc/kibana/kibana-server.crt
-*echo "server.ssl.enabled: true" | sudo tee -a /etc/kibana/kibana.yml
-*echo "server.ssl.certificate: /etc/kibana/kibana-server.crt" | sudo tee -a /etc/kibana/kibana.yml
-*echo "server.ssl.key: /etc/kibana/kibana-server.key" | sudo tee -a /etc/kibana/kibana.yml
-*echo "server.publicBaseUrl: \"https://kali-purple.kali.purple:5601\"" | sudo tee -a /etc/kibana/kibana.yml
-*sudo /usr/share/kibana/bin/kibana-encryption-keys generate
- #Copy the generated keys into /etc/kibana/kibana.yml
-*sudo systemctl restart kibana
 =Links=
 *https://gitlab.com/kalilinux/kali-purple/documentation/-/wikis/301_31:-Elastic-Stack-Installation
+*https://github.com/ScioShield/Kali-Purple-Elastic-Install

ELK Kali Purple: Unterschied zwischen den Versionen

Aktuelle Version vom 19. April 2025, 10:08 Uhr

Links

Navigationsmenü

Suche