observabiltiy and security firewall questions

[banderson443]

I am trying to get system logs from linux syslog and windows into kibana but couldn't figure out the so-allow/so-firewall syntax to open the ports. I'm running 1 master server and we already have it digesting all network traffic which works great.

Also what settings do i put in filebeat.yml to send to the elasticsearch in security onion?

Thanks,

[dougburks]

If you're sending via syslog protocol, run so-allow and choose the s option.

If you're sending via Elastic beats, run so-allow and choose the b option.

Configure filebeat to send to Logstash rather than Elasticsearch.

For more information, please see:
https://docs.securityonion.net/en/2.3/so-allow.html?highlight=so-allow
https://docs.securityonion.net/en/2.3/beats.html

[banderson443]

Thanks Doug!

I'll check these out.

[banderson443]

I got my windows test host to work but my linux test host is not showing up in hosts in security onion. FIlebeat seems to be configured correctly on the linux host and i tried syslog as well. Both so-allow options i allowed the vlan that both hosts are on.

[dougburks]

What exactly do you mean by not showing up in hosts?

How exactly did you configure Filebeat?