Elastic Stack Tutorial | Create a Free SIEM Tool with Elasticsearch, Auditbeat, & Kibana | Part 1

Learn how to set up the Elastic Stack and send system logs that will provide important security information and visualizations.

In this video tutorial you'll be using Auditbeat, Elasticsearch, and Kibana to setup a free SIEM tool.

If you’ve ever wondered how security analysts know when an intruder has attacked, or how Security Operation Centers make stunning maps and graphs from security logs, then you want to watch this video.

Ivan will explain how you can install the Elastic Stack on a Linux server and configure it to receive logs from Windows/Linux endpoints using Beats.

Once he has that set up he will then teach you how to use the Elastic tool known as Kibana to visualize this data in maps and charts.

This is part 1 of a two part video.

Be sure to leave any questions or comments below!

[BAGofSARS]

Thanks for the video. A ELK tutorial, that actually explains something. GREAT!

[guerlineaurelus]

Hi . Thank you for the video but I am running to an error message when I do curl 127.0.0.1:9200. It replies with this message: "curl: (52) Empty message from server". Can you or anyone guide me please?

[mcastill]

Great video, thanks for sharing your knowledge in a clear way!!!

[sikanderali]

I successfully installed elasticSearch, Kibana and Auditbeat elasticsearch and Kibana working fine but once run auditbeat -e setup it is showing this error (couldn't connect to any of the configured Elasticsearch hosts. Errors:) three of software in the same machine even tried telnet to port 9200 it is working fine, i appreciate your help and quick response

[senjacybersec]

for os can it be replaced with xubuntu?

[comcousa]

Hye! great video. However I am facing some issue. When type in htp://127.0.0.1:5601 it throws an error {"statusCode":503, "error":"Service Unavailable", "message":"License is not available."}
Any help?

[maxzone]

Great Thank for the Tutorials.
One query, I've tried running " sudo auditbeat -e set up" and it comes up a connection error with elasticsearch when to load the index templates/patterns/dashboards and the connection refuses
Any idea whats wrong

[charlesq]

How would i go about combining this with the network monitoring project with zeek and suricata

[EverythingmeVlog]

The auditbeat -e setup, the very end it’s saying error.

[comcousa]

exception: Security must be explicitly enabled when using a [basic] license.

[AnilChauhan-xtsf]

No results match your search criteria while kibana discover click any idea what is wrong?

[DukeMusicShop]

Hi this is very informative, little query can we use this in aws s3

[hv]

Great video.Can you please provide the part 2 link.

[orfeasdn]

Hi, great tutorial.
Only one question. When you open kibana in the browser you can see a bunch of stuff, such as different logs or your PC in the host tab etc. In the other hand, I can't seem to find anything, . It's completely empty.
I also had to configure x-pack security to get the security options to work, but I don't think that makes a difference.
Again thanks a lot for the tutorial, keep it up!