Skip to content

Initialize docs for secops #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 30, 2019
Merged

Initialize docs for secops #189

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added docs/en/secops/images/secops-architecture.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
17 changes: 17 additions & 0 deletions docs/en/secops/index.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
:doctype: book
:sec: SecOps
:sec-soln: security monitoring
:sec-ui: SecOps

= Security Monitoring Guide

include::{asciidoc-dir}/../../shared/versions.asciidoc[]

include::{asciidoc-dir}/../../shared/attributes.asciidoc[]

include::overview.asciidoc[]

include::installation.asciidoc[]

include::sec-ui.asciidoc[]

42 changes: 42 additions & 0 deletions docs/en/secops/installation.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
[[install-sec-monitoring]]
[role="xpack"]
== Get up and running

beta[]

To get up and running with security monitoring, you need:

* An Elasticsearch cluster and Kibana (version 6.x or later) with a basic
license. To learn how to get started quickly, see
{stack-gs}/get-started-elastic-stack.html[Getting started with the {stack}].
+
[TIP]
==============
You can skip installing {es} and {kib} by using our
https://www.elastic.co/cloud/elasticsearch-service[hosted {es} Service] on
Elastic Cloud. The {es} Service is available on both AWS and GCP.
https://www.elastic.co/cloud/elasticsearch-service/signup[Try the {es}
Service for free].
==============

* {beats} shippers (version 6.x or later) installed on each system you want to
monitor

You might need to modify UI settings in {kib} to change default behaviors,
such as the index pattern used to query the data, and the timestamp field used
for sorting. For more information, see {kib}.

[float]
[[install-beats-for-sec]]
=== Install {beats} shippers

To populate the security UI with metrics and
log data, you need to install and configure the following shippers:

* https://www.elastic.co/products/beats/packetbeat[{packetbeat}] for analyzing
network packets
* https://www.elastic.co/products/beats/filebeat[{filebeat}] for forwarding and
centralizing logs and files
* https://www.elastic.co/products/beats/auditbeat[{auditbeat}] for monitoring
directories for file changes

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to split this apart and describe what the options are for host security monitoring and the options for the network security monitoring. We could list the products and what data they provide.

Host Security Monitoring

Network Security Monitoring

  • Filebeat Bro Module
  • Filebeat Suricata Module
  • Filebeat Netflow Input
  • Filebeat IPTables Module
  • Packetbeat
  • Auditbeat System Socket Module
  • Any ECS compatible data source

Another way to present the information would be to turn it around and list the things you can monitor like processes, packages, and flows; and then list all things that can be used to monitor them. This might present better as a matrix with the features on the left and products across the top.

Host Security Monitoring

  • Processes - Auditbeat / Filebeat Santa
  • Network Connections - Auditbeat System Sockets Module / Winlogbeat + Sysmon
  • System Changes - Auditbeat System Host Module
  • Users - Auditbeat System User Module
  • Logins / Logoffs - Auditbeat Login Module
  • Packages - Auditbeat System Package Module

Network Security Monitoring

  • Flows - Packetbeat / Filebeat Netflow / Filebeat Bro / Filebeat Suricata
  • Firewalls
    • IPTables - Filebeat
  • Deep Packet Inspection
    • DHCP - Packetbeat
    • DNS - Packetbeat / Filebeat Bro / Filebeat Suricata
    • HTTP - Packetbeat / Filebeat Bro
    • TLS - Packetbeat / Filebeat Bro
    • ICMP - Packetbeat

@karenzone I'll let you decide on what's the best way to present the information. I can help with filling in the details. We could merge this as and then continue to iterate from here or make the changes now.

20 changes: 20 additions & 0 deletions docs/en/secops/overview.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
[[sec-monitoring-overview]]
[role="xpack"]
== Overview

beta[]

{sec} gives you a comprehensive view into your security operations.

The UI in {kib} UI to brings together data
from a variety of sources, making it easier for you
to identify and resolve security issues.

[float]
[[secops-components]]
=== Security monitoring components

Security monitoring requires the following {stack} components.

image::images/secops-architecture.png[]

14 changes: 14 additions & 0 deletions docs/en/secops/sec-ui.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
[[sec-ui-overview]]
[role="xpack"]
== {sec-ui} UI

beta[]

After you have security monitoring <<install-sec-monitoring,up and
running>> and data is streaming to {es}, use the {sec-ui} UI in {kib} to monitor
and identify security problems in real time.

For more information about working with the {sec-ui} UI, see the
{kib} documentation.