Elasticsearch / Kibana (ELK) Integration¶
What does ELK integration with Scrutinizer do?
What is ELK?¶
Elasticsearch - A searching service to look through the stored data collected by Logstash.
Logstash - A means to collect logs and events (like syslogs) and filter them in a specific way to be stored for later analysis.
Kibana - Front-end to present data by creating dashboards and visualizations, similar to Scrutinizer’s dashboards and gadgets.
The following configuration instructions apply to Scrutinizer v16.7 and later. If an earlier version of Scrutinizer is installed, contact plixer for assistance.
Kibana Searches from Scrutinizer Reports and Alarms¶
The following steps will walk through how to search Kibana’s database from Scrutinizer reports.
Select a Scrutinizer report that includes IP addresses
- Select a host of interest and click on it
- Select ‘Other Options’ from the Reports menu
- Select ‘Kibana (ELK)’
The IP address and report timeframe are passed to Kibana’s search engine for detailed Kibana reporting.
For more detail (from Kibana) on Scrutinizer Alarms, follow these steps.
Go to the Alarms tab in Scrutinizer and select either:
- Bulletin Board by Violator : Select a violator
- Bulletin Board by Policy : Select the policy
In the Bulletin Board Events view that opens, click on the dropdown arrow to the left of the Message column for the alarm that was selected.
Select ‘Kibana (ELK)’ from the Available Options menu and the Violator’s IP address and timeframe of the violation are passed to Kibana.
- If the Violator’s IP address and an alarm time (not timeframe) are being passed, then 30 minutes before and after the alarm time is searched.
Scrutinizer Reporting from within Kibana¶
Within the Kibana (ELK) integration with Scrutinizer, dashboards can be setup which include:
- Scrutinizer Vitals information
- Flow Analytics TopN Algorithms
The Scrutinizer Vitals dashboard in Kibana can include:
- Disk Usage
- Flows per collector
- Status per collector
Dashboards created with the TopN Algorithm gadgets from Flow Analytics include:
- Top Applications
- Top Countries
- Top Rev 2nd lvl Domains (Top reverse 2nd level domains)
- Top Flows
- Top Hosts
- Top Jitter
- Top Networks
How to Configure ELK Integration with Scrutinizer¶
There are two components to the ELK Integration.
- Preparing Scrutinizer
- Importing the necessary files into Kibana’s UI
Flow Analytics must be enabled and collecting statistics for the Top X Algorithms.
Log on to the Scrutinizer server with administrative permissions
Open the Interactive scrut_util.exe prompt with the following command:
SCRUTINIZER> enable elk http://<ip:port>
<ip:port> is the ELK server’s IP address and port
After a few moments, Scrutinizer will begin to send events to ELK.
To test the data export, from within the scrut_util shell, run:
collect elk <elk_ip>
To disable the data export, run:
disable elk http://<ip:port>
Integrating ELK with Scrutinizer displays details in Kibana that have been collected and processed by Scrutinizer.
After enabling the ELK integration on Scrutinizer, refresh the index on Logstash in order to get Scrutinizer’s fields to show up. In Kibana, go to Indices > Logstash. Click on the Reload field list icon at the center top of the screen.
Download the Kibana Integration Plugin from the Elasticsearch / Kibana Integration page.
- Extract the files from the scrutinizer-elk.zip file.
In Kibana, go to Settings > Objects > Import > Visualizations and navigate to the elk-scrutinizer-visualizations.json file extracted in Step 2a above and click Open.
Go to Settings > Objects > Import > Dashboards and navigate to the elk-scrutinizer-dashboards.json file extracted in Step 2a above and click Open.
The Kibana dashboards and visualizations are now all imported and events have been configured to be coming from Scrutinizer.
From the Visualize tab, scroll to the bottom and filter for a specific visualization. Typing Scrutinizer in the filter for example, will show all of the Scrutinizer visualizations.
From the Dashboard tab, navigate around the various Scrutinizer dashboards imported.