How To Build A SIEM with Suricata and Elastic Stack on Ubuntu 20.04

Introduction

The previous tutorials in this series guided you through installing, configuring, and running Suricata as an Intrusion Detection (IDS) and Intrusion Prevention (IPS) system. You also learned about Suricata rules and how to create your own.

In this tutorial you will explore how to integrate Suricata with Elasticsearch, Kibana, and Filebeat to begin creating your own Security Information and Event Management (SIEM) tool using the Elastic stack and Ubuntu 20.04. SIEM tools are used to collect, aggregate, store, and analyze event data to search for security threats and suspicious activity on your networks and servers.

The components that you will use to build your own SIEM tool are:

• Elasticsearch to store, index, correlate, and search the security events that come from your Suricata server.
• Kibana to display and navigate around the security event logs that are stored in Elasticsearch.
• Filebeat to parse Suricata’s eve.json log file and send each event to Elasticsearch for processing.
• Suricata to scan your network traffic for suspicious events, and either log or drop invalid packets.

First you’ll install and configure Elasticsearch and Kibana with some specific authentication settings. Then you’ll add Filebeat to your Suricata system to send its eve.json logs to Elasticsearch.

Finally, you’ll learn how to connect to Kibana using SSH and your web browser, and then load and interact with Kibana dashboards that show Suricata’s events and alerts.