Integrations page in kibana on a distributed deployment

[8bitjoe]

Greetings,

We are aware that security onion will support elastic agent integrations in the next release (By the way is there an ETA on the beta for 3.7.4?), however, meanwhile we've been conducting labs with said integrations directly to Elasticsearch with succesful results, this tests were performed on a standalone deployment of Security Onion.

Right now we're testing a distributed deployment and we noticed that kibana no longer shows the APM, Fleet, Integrations modules on the navigation pane, is there any way to enable this through the salt configuration? Thank you.

[cm-ops]

Have you tried editing/creating spaces and enabling features?

[8bitjoe]

That was it! TY, solved.

[jcac100]

@8bitjoe I am attempting the same thing in an air gapped standalone deployment, very curious what your process was to get this to work. Any information you can share on adding a fleet server would be great

[8bitjoe]

currently im dealing with a permission issue to add the integration, but back on the standalone environment once you create the integration you add a standalone agent, create an api key for it and add the certificate found in the vm for elasticsearch

[jcac100]

@8bitjoe to be clear you're talking about adding an elastic fleet server and deploying elastic endpoint agents in a standalone SecurityOnion deployment correct? Because I'm struggling to add a fleet server and get the kibana ui to update and reflect a fleet server is part of the environment, additionally creating an so- firewall exception for 5601 and 8220 has been more difficult than expected ( though I think I have that part worked out) . I typically use https://github.com/peasead/elastic-container bur really want to use the elastic security and endpoint functionality with security onion. Is there already that support baked into SO 2.3 that I'm just unaware of, or do you need another container for your fleet server, and if so how do you implement it and get kibana to reflect it's present? Your post is the first I've heard of someone successfully implementing elastic fleet to SO so I'm very curious what it took to pull it off, thanks for your input and help

[8bitjoe]

There is a fleet server in security onion however in my tests i couldn't link it with elastic to manage integration agents.
The way i got it to work previously was without getting fleet involved, add the integration in kibana (this should create a pipeline, a dashboard, etc..) then proceed to install the agents in standalone mode (not centrally managed) you have to edit the configuration file to include an API key and the certificate for Elasticsearch, once the traffic gets to elastic it will create a data stream and start showing up in your indices.
as far as the firewall side of things, so-allow elastic and the ip of the agent should do the trick.

[8bitjoe]

Currently there's no support for elastic agents and integrations in Security onion, however it is indeed coming on the next big release (3.7.4) so something to look out for in the future.

[jcac100]

@8bitjoe I guess I'm a bit confused on the adding the integration to kibana part, and I have never deployed elastic agents in standalone mode, but is there much manual configuration needed to point them to the elasticsearch API port 9200 rather than the fleet API port of 8220?

[jcac100]

I'm curious if you have been able to use the elastic endpoint response actions and add the elastic defend Integration with the standalone agents. I don't know what dependencies those functionalities have, but elastic agents without the defend Integration or response actions seem like more complicated beats agents to me, so without that functionality I wonder if it is worth the hassle 🤔

[8bitjoe]

Exactly, just point the agent through the configuration file to security onion port 9200, add the cert and API key to the configuration file and that's it. i have not used any of the advanced elastic endpoint functionalities since the agent i used was mostly just to integrate a firewall and send the syslog messages to elastic. Those functionalities do sound like you need fleet to manage the agent remotely so in your case I'd do a little bit more digging on the fleet server part, i just skipped it altogether because it wasn't necessary for my use case.