For this project, I have set up a home lab using Elastic SIEM and a Kali VM. I forwarded data from the Kali VM to the SIEM using the Elastic Beats agent, generated security events on the Kali VM using Nmap, and queried and analyzed the logs in the SIEM using the Elastic web interface.
- VirtualBox
- Elastic Cloud
- SIEM
- Kali Linux
Before starting up any virtual machine for the first time, I will tweak my settings to suit my needs and take a screenshot. Every system is different, so be sure to change your settings accordingly.
A screenshot will allow us to revert back to this point later on if something goes wrong. Remember to take screenshots often so you don't lose your work!
The setup is very easy, just select "Graphical Install" and go through the installation steps. Use the default for most settings and check out the online resources if you have any questions!
This is where you will decide your desktop environment, which has a large effect in how your desktop will look and feel. I like xfce but I encourage everyone to experiment!
An agent is a software program that is installed on a device, such as a server or endpoint, to collect and send data to a centralized system for analysis and monitoring. In the context of Elastic SIEM, an agent is used to collect and forward security-related events from your endpoints to your Elastic SIEM instance.
Here we install the Elastic agent on our Linux VM.
We run this command on our Linux machine which shows that the Elastic service is up and running.
We will now run some Nmap scans on the agent to generate activity for our service to recieve.
Back on the Elastic side we can see the activity that was generated and we can click to find more details about each event.
Here you can see that our SIEM is able to tell us the exact command that was run on the agent machine, in this instance "sudo nmap -sS localhost"
