Integrate Ezeelogin SSH Jump host with ELK for SIEM
Integrating Ezeelogin SSH gateway with ELK stack for SIEM
In the example below, we would be installing ElasticSearch and Kibana on the monitoring server [monitor.eznoc.com ( Centos 7 OS)] and the Logstash daemon on the Ezeelogin Jumphost server.
- Install Java 8
[[email protected] ~]# yum install java-1.8.0-openjdk.x86_64
[[email protected] ~]# java -version
openjdk version "1.8.0_272"
OpenJDK Runtime Environment (build 1.8.0_272-b10)
OpenJDK 64-Bit Server VM (build 25.272-b10, mixed mode)
- Download the ElasticSearch
[[email protected] ~]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.9.2-x86_64.rpm
[[email protected] ~]# rpm -ivh elasticsearch-7.9.2-x86_64.rpm[[email protected] ~]# systemctl enable elasticsearch.service
[[email protected] ~]# service elasticsearch restart
- Edit the ElasticSearch Configuration file and set the following variables.
[[email protected] ~]# vi /etc/elasticsearch/elasticsearch.yml
cluster.name: elk-test
node.name: node-elk
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
discovery.type: single-node
[[email protected] ~]# service elasticsearch restart
- Test the ElasticSearch Response
[[email protected] ~]# curl -X GET ’http://localhost:9200’
{
"name" : "elk-test","cluster_name" : "elasticsearch",
5. Installing and Configuring Logstash on the Ezeelogin Jump Host server to send the Ezeelogin mysql table data ( fqn_sshlogs, fqn_gwactivity_logs, fqn_serveractivity_logs,fqn_webactivity_logs) to Elastic Search.[[email protected] ~]#rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
[[email protected] ~] vi /etc/yum.repos.d/logstash.repo
[logstash-7.x]
name=Elastic repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md[[email protected] ~] yum install logstash
5.A) Sending the mysql tables fqn_sshlogs from Jump Host server to Remote ElasticSearch server using Logstash.

5.B) Sending the mysql table fqn_gwactivity_logs from Jump Host server to Remote ElasticSearch server using Logstash.

5.C) Sending the mysql table fqn_serveractivity_logs from Ezeelogin Jump Host server to the monitor.eznoc.com server using Logstash.
5.D) Sending mysql table fqn_web_activity log from Jump Host server to Remote ElasticSearch server using Logstash.
Restart the logstash daemon
[[email protected] ~] systemctl restart logstash
6. Installing and Configuring the Kibana Dashboard on the monitoring server.
-
Refer the article
[[email protected] ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
[[email protected] ~]#vi /etc/yum.repos.d/kibana.repo
[kibana-7.x]
name=Kibana repository for 7.x packagesbaseurl=https://artifacts.elastic.co/packages/7.x/yumgpgcheck=1gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearchenabled=1autorefresh=1type=rpm-md[[email protected] ~]# yum install kibana
[[email protected] ~]# systemctl enable kibana.service;systemctl start kibana.service
Access the Kibana Dashboard http://monitor.eznoc.com/app/kibana#/management/kibana/index_patterns?_g=()
Click on the gw_ssh index pattern and you will be able to see the data from mysql table fqn_sshlogs belonging to Ezeelogin Jump Server database.
Once you have the data in ElasticSearch, you can verify the mysql data fetched under "Discovery"
You can create different type of Visualizations from data imported using the "Visualize" feature.
You can also create a dashboard for in Kibana to view the various graphical visualization that was created.