Itx8071-graded-lab - Redigeerimiste ajalugu

Risto – 8. detsember 2025, kell 13:42

2025-12-08T13:42:39Z

Risto – 8. detsember 2025, kell 13:41

2025-12-08T13:41:17Z

Risto – 1. detsember 2025, kell 14:10

2025-12-01T14:10:06Z

Risto – 1. detsember 2025, kell 12:26

2025-12-01T12:26:06Z

Risto – 1. detsember 2025, kell 12:24

2025-12-01T12:24:41Z

Risto: Lehekülg asendatud tekstiga 'To be announced during the semester.'

2025-08-25T08:08:10Z

Lehekülg asendatud tekstiga 'To be announced during the semester.'

Risto – 10. detsember 2024, kell 13:45

2024-12-10T13:45:23Z

Risto – 10. detsember 2024, kell 13:44

2024-12-10T13:44:17Z

Risto: Lehekülg asendatud tekstiga 'To be announced.'

2024-08-13T12:34:18Z

Lehekülg asendatud tekstiga 'To be announced.'

Risto – 13. detsember 2023, kell 09:43

2023-12-13T09:43:36Z

@@ 53. rida: / 53. rida: @@
 After verifying that the web server and SSH events have been received by Kibana, you can create a dashboard for Apache web server events under the "Dashboard" selection of the Kibana pull-down menu.
-In order to create a dashboard for Suricata events, you can run Suricata in IDS mode as follows for creating events for that dashboard:
+In order to create a dashboard for Suricata IDS alerts, you can run Suricata in IDS mode as follows for creating events for that dashboard:
   suricata -c /etc/suricata/suricata.yaml -D --af-packet=enp0s8
@@ 59. rida: / 59. rida: @@
 If your virtual machine has some other interface than enp0s8 connected to Host-Only Network of VirtualBox, use that interface instead in the above command line!
-You can use the following test signature in /etc/suricata/rules/local.rules for generating Suricata events:
+You can use the following test signature in /etc/suricata/rules/local.rules for generating Suricata IDS alerts:
   alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"HTTP request for a picture file"; flow:established,to_server; pcre:"/\.(?:gif|jpg|png)$/Ui";classtype:web-application-attack; sid:1000002; rev:1;)
-Also, you can use other signatures from Suricata lab for generating events.
+Also, you can use other signatures from Suricata lab for generating additional alerts.
 Already existing Logstash configuration is parsing all Suricata events, and you can search Suricata IDS alerts in Kibana with the following query:

@@ 65. rida: / 65. rida: @@
 Also, you can use other signatures from Suricata lab for generating events.
-Already existing Logstash configuration is parsing all Suricata events, and you can search these events in Kibana with the following query:
+Already existing Logstash configuration is parsing all Suricata events, and you can search Suricata IDS alerts in Kibana with the following query:
   program:suricata AND suricata.event_type:alert

@@ 61. rida: / 61. rida: @@
 You can use the following test signature in /etc/suricata/rules/local.rules for generating Suricata events:
-  alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"HTTP request for a picture file"; flow:established,to_server; pcre:"/\.(?:gif|jpg|png)$/Ui";classtype:web-application-attack; sid:4000002; rev:1;)
+  alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"HTTP request for a picture file"; flow:established,to_server; pcre:"/\.(?:gif|jpg|png)$/Ui";classtype:web-application-attack; sid:1000002; rev:1;)
 Also, you can use other signatures from Suricata lab for generating events.

@@ 1. rida: / 1. rida: @@
 === Description of the graded lab ===
-During the graded lab, two Kibana dashboard have to be created, with each dashboard containing at least 7 visualizations that display different data. Note that each created dashboard must feature at least 5 different visualization types (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboards '''must''' be created for '''syslog events of one type received with Logstash''':
+During the graded lab, two Kibana dashboard have to be created, with each dashboard containing '''at least 7''' visualizations that display different data. Note that each created dashboard must feature '''at least 5''' different visualization types (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboards '''must''' be created for '''syslog events of one type received with Logstash''':
 * the first dashbord -- Apache web server events

←Vanem redaktsioon		Redaktsioon: 1. detsember 2025, kell 12:24
1. rida:		1. rida:
−	To be ~~announced during~~ the ~~semester~~.	+	=== Description of the graded lab ===
		+
		+	During the graded lab, two Kibana dashboard have to be created, with each dashboard containing at least 7 visualizations that display different data. Note that each created dashboard must feature at least 5 different visualization types (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboards '''must''' be created for '''syslog events of one type received with Logstash''':
		+
		+	* the first dashbord -- Apache web server events
		+	* the second dashboard -- Suricata IDS alerts
		+
		+	Dashboards created for events received from Filebeat are '''not accepted'''.
		+
		+	=== Instructions for setting up the course virtual machine for the graded lab ===
		+
		+	Since the course virtual machine needs more resources for the graded lab than pre-configured defaults, increase the amount of RAM to at least 4GB and the number of CPUs to at least 2.
		+
		+	Start Elasticsearch:
		+
		+	systemctl start elasticsearch
		+
		+	Start Kibana:
		+
		+	systemctl start kibana
		+
		+	Start Logstash:
		+
		+	systemctl start logstash
		+
		+	Make sure you can access Kibana web interface via following URL: https://ipaddress_of_your_vm:5601 (login: elastic, password: default-root-password-of-the-VM). Note that the startup process of Kibana might take several minutes before the web interface will become available.
		+
		+	In order to receive syslog events from local rsyslog, configure it to send all events to Logstash. For example, set up the file /etc/rsyslog.d/logstash.conf with the following content:
		+
		+	global(maxMessageSize="1024k")
		+	. @127.0.0.1:10514
		+
		+	The global(maxMessageSize="1024k") directive configures the syslog message size to be higher than the default 8KB, since Suricata can produce syslog messages which are larger than 8KB.
		+
		+	After creating that file, don't forget to restart rsyslog:
		+
		+	systemctl restart rsyslog
		+
		+	In Kibana, select "Stack Management" from the pull-down menu on the top left corner in the Kibana interface. Note that "Stack Management" is the last selection in the pull-down menu!
		+
		+	Then go to Kibana->Data Views, and select Create Data View:
		+	* for "Name", select logstash*
		+	* for "Index pattern", select logstash*
		+	* for "Timestamp field", select @timestamp
		+	* after setting the above fields, select "Save data view to Kibana"
		+
		+	Generate some syslog events by accessing the web server of the virtual machine and logging in into the virtual machine over SSH. Note that already existing Logstash configuration is parsing these events. For seeing the events, select "Discover" in the Kibana pull-down menu. The web server and SSH events can be searched with the following queries:
		+
		+	program:apache
		+
		+	program:sshd
		+
		+	After verifying that the web server and SSH events have been received by Kibana, you can create a dashboard for Apache web server events under the "Dashboard" selection of the Kibana pull-down menu.
		+
		+	In order to create a dashboard for Suricata events, you can run Suricata in IDS mode as follows for creating events for that dashboard:
		+
		+	suricata -c /etc/suricata/suricata.yaml -D --af-packet=enp0s8
		+
		+	If your virtual machine has some other interface than enp0s8 connected to Host-Only Network of VirtualBox, use that interface instead in the above command line!
		+
		+	You can use the following test signature in /etc/suricata/rules/local.rules for generating Suricata events:
		+
		+	alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"HTTP request for a picture file"; flow:established,to_server; pcre:"/\.(?:gif\|jpg\|png)$/Ui";classtype:web-application-attack; sid:4000002; rev:1;)
		+
		+	Also, you can use other signatures from Suricata lab for generating events.
		+
		+	Already existing Logstash configuration is parsing all Suricata events, and you can search these events in Kibana with the following query:
		+
		+	program:suricata AND suricata.event_type:alert

←Vanem redaktsioon		Redaktsioon: 25. august 2025, kell 08:08
1. rida:		1. rida:
−	~~=== Description of the graded lab ===~~	+	To be announced during the semester.
−
−	During the graded lab, a Kibana dashboard has to be created which contains '''at least 10 visualizations''' that display different data. Note that the created dashboard must feature '''at least 5 different visualization types''' (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboard '''must''' be created for '''syslog events of one type received with Logstash''', for example:
−
−	* Apache web server events
−	* Suricata IDS alerts
−	* Iptables events
−
−	~~Dashboards created for events received from Filebeat are '''not accepted'''.~~
−
−	~~=== Instructions for setting up the course virtual machine for the graded lab ===~~
−
−	~~Since the course virtual machine needs more resources for the graded lab than pre-configured defaults, increase the amount of RAM to at least 4GB and the number of CPUs to at least 2.~~
−
−	~~Start Elasticsearch:~~
−
−	~~systemctl start elasticsearch~~
−
−	~~Start Kibana:~~
−
−	~~systemctl start kibana~~
−
−	~~Start Logstash:~~
−
−	~~systemctl start logstash~~
−
−	Make sure you can access Kibana web interface via following URL: https://ipaddress_of_your_vm:5601 (login: elastic, password: default-root-password-of-the-VM). Note that the startup process of Kibana might take several minutes before the web interface will become available.
−
−	~~In order to receive syslog events from local rsyslog, configure it to send all events to Logstash. For example, set up the file /etc/rsyslog.d/logstash.conf with the following content:~~
−
−	~~global(maxMessageSize="1024k")~~
−	. @127.0.0.1:10514
−
−	~~The global(maxMessageSize="1024k") directive configures the syslog message size to be higher than the default 8KB, since Suricata can produce syslog messages which are larger than 8KB.~~
−
−	~~After creating that file, don't forget to restart rsyslog:~~
−
−	~~systemctl restart rsyslog~~
−
−	~~In Kibana, select "Stack Management" from the pull-down menu on the top left corner in the Kibana interface. Note that "Stack Management" is the last selection in the pull-down menu!~~
−
−	~~Then go to Kibana->Data Views, and select Create Data View:~~
−	~~* for "Name", select logstash*~~
−	~~* for "Index pattern", select logstash*~~
−	* for "Timestamp field", select @timestamp
−	* after setting the above fields, select "Save data view to Kibana"
−
−	Generate some syslog events by accessing the web server of the virtual machine and logging in into the virtual machine over SSH. Note that already existing Logstash configuration is parsing these events. For seeing the events, select "Discover" in the Kibana pull-down menu. The web server and SSH events can be ~~searched with the following queries:~~
−
−	~~program:apache~~
−
−	~~program:sshd~~
−
−	~~After verifying that the web server and SSH events have been received by Kibana, you can create dashboards for these events under the "Dashboard" selection of the Kibana pull-down menu.~~
−
−	~~In order to create a dashboard for Suricata events, you can run Suricata in IDS mode as follows for creating events for that dashboard:~~
−
−	~~suricata -c /etc/suricata/suricata.yaml -D --af-packet=enp0s8~~
−
−	~~If your virtual machine has some other interface than enp0s8 connected to Host-Only Network of VirtualBox, use that interface instead in the above command line!~~
−
−	~~You can use the following test signature in /etc/suricata/rules/local.rules for generating Suricata events:~~
−
−	alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"HTTP request for a picture file"; flow:established,to_server; pcre:"/\.(?:gif\|jpg\|png)$/Ui";classtype:web-application-attack; sid:4000002; rev:1;)
−
−	~~Also, you can use other signatures from Suricata lab for generating events.~~
−
−	~~Already existing Logstash configuration is parsing all Suricata events, and you can search these events in Kibana with~~ the ~~following query:~~
−
−	~~program:suricata AND suricata~~.~~event_type:alert~~

@@ 1. rida: / 1. rida: @@
 === Description of the graded lab ===
-During the graded lab, a Kibana dashboard has to be created which contains at least 10 visualizations that display different data. Note that the created dashboard must feature at least 5 different visualization types (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboard '''must''' be created for '''syslog events of one type received with Logstash''', for example:
+During the graded lab, a Kibana dashboard has to be created which contains '''at least 10 visualizations''' that display different data. Note that the created dashboard must feature '''at least 5 different visualization types''' (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboard '''must''' be created for '''syslog events of one type received with Logstash''', for example:
 * Apache web server events

←Vanem redaktsioon		Redaktsioon: 10. detsember 2024, kell 13:44
1. rida:		1. rida:
−	To be ~~announced~~.	+	=== Description of the graded lab ===
		+
		+	During the graded lab, a Kibana dashboard has to be created which contains at least 10 visualizations that display different data. Note that the created dashboard must feature at least 5 different visualization types (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboard '''must''' be created for '''syslog events of one type received with Logstash''', for example:
		+
		+	* Apache web server events
		+	* Suricata IDS alerts
		+	* Iptables events
		+
		+	Dashboards created for events received from Filebeat are '''not accepted'''.
		+
		+	=== Instructions for setting up the course virtual machine for the graded lab ===
		+
		+	Since the course virtual machine needs more resources for the graded lab than pre-configured defaults, increase the amount of RAM to at least 4GB and the number of CPUs to at least 2.
		+
		+	Start Elasticsearch:
		+
		+	systemctl start elasticsearch
		+
		+	Start Kibana:
		+
		+	systemctl start kibana
		+
		+	Start Logstash:
		+
		+	systemctl start logstash
		+
		+	Make sure you can access Kibana web interface via following URL: https://ipaddress_of_your_vm:5601 (login: elastic, password: default-root-password-of-the-VM). Note that the startup process of Kibana might take several minutes before the web interface will become available.
		+
		+	In order to receive syslog events from local rsyslog, configure it to send all events to Logstash. For example, set up the file /etc/rsyslog.d/logstash.conf with the following content:
		+
		+	global(maxMessageSize="1024k")
		+	. @127.0.0.1:10514
		+
		+	The global(maxMessageSize="1024k") directive configures the syslog message size to be higher than the default 8KB, since Suricata can produce syslog messages which are larger than 8KB.
		+
		+	After creating that file, don't forget to restart rsyslog:
		+
		+	systemctl restart rsyslog
		+
		+	In Kibana, select "Stack Management" from the pull-down menu on the top left corner in the Kibana interface. Note that "Stack Management" is the last selection in the pull-down menu!
		+
		+	Then go to Kibana->Data Views, and select Create Data View:
		+	* for "Name", select logstash*
		+	* for "Index pattern", select logstash*
		+	* for "Timestamp field", select @timestamp
		+	* after setting the above fields, select "Save data view to Kibana"
		+
		+	Generate some syslog events by accessing the web server of the virtual machine and logging in into the virtual machine over SSH. Note that already existing Logstash configuration is parsing these events. For seeing the events, select "Discover" in the Kibana pull-down menu. The web server and SSH events can be searched with the following queries:
		+
		+	program:apache
		+
		+	program:sshd
		+
		+	After verifying that the web server and SSH events have been received by Kibana, you can create dashboards for these events under the "Dashboard" selection of the Kibana pull-down menu.
		+
		+	In order to create a dashboard for Suricata events, you can run Suricata in IDS mode as follows for creating events for that dashboard:
		+
		+	suricata -c /etc/suricata/suricata.yaml -D --af-packet=enp0s8
		+
		+	If your virtual machine has some other interface than enp0s8 connected to Host-Only Network of VirtualBox, use that interface instead in the above command line!
		+
		+	You can use the following test signature in /etc/suricata/rules/local.rules for generating Suricata events:
		+
		+	alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"HTTP request for a picture file"; flow:established,to_server; pcre:"/\.(?:gif\|jpg\|png)$/Ui";classtype:web-application-attack; sid:4000002; rev:1;)
		+
		+	Also, you can use other signatures from Suricata lab for generating events.
		+
		+	Already existing Logstash configuration is parsing all Suricata events, and you can search these events in Kibana with the following query:
		+
		+	program:suricata AND suricata.event_type:alert

←Vanem redaktsioon		Redaktsioon: 13. august 2024, kell 12:34
1. rida:		1. rida:
−	~~=== Description of the graded lab ===~~	+	To be announced.
−
−	~~During the graded lab, a Kibana dashboard has to~~ be ~~created which contains at least 10 visualizations that display different data~~. Note that the created dashboard must feature at least 5 different visualization types (for example, pie chart, bar chart, table, event counter, etc.). The Kibana dashboard '''must''' be created for '''syslog events of one type received with Logstash''', for example:
−
−	* Apache web server events
−	* Suricata IDS alerts
−	* Iptables events
−
−	~~Dashboards created for events received from Filebeat are '''not accepted'''.~~
−
−	~~=== Instructions for setting up the course virtual machine for the graded lab ===~~
−
−	~~Since the course virtual machine needs more resources for the graded lab than pre-configured defaults, increase the amount of RAM to at least 4GB and the number of CPUs to at least 2.~~
−
−	~~Start Elasticsearch:~~
−
−	~~systemctl start elasticsearch~~
−
−	~~Start Kibana:~~
−
−	~~systemctl start kibana~~
−
−	~~Start Logstash:~~
−
−	~~systemctl start logstash~~
−
−	Make sure you can access Kibana web interface via following URL: https://ipaddress_of_your_vm:5601 (login: elastic, password: default-root-password-of-the-VM). Note that the startup process of Kibana might take several minutes before the web interface will become available.
−
−	~~In order to receive syslog events from local rsyslog, configure it to send all events to Logstash. For example, set up the file /etc/rsyslog.d/logstash.conf with the following content:~~
−
−	. @127.0.0.1:10514
−
−	~~After creating that file, don't forget to restart rsyslog:~~
−
−	~~systemctl restart rsyslog~~
−
−	~~In Kibana, select "Stack Management" from the pull-down menu on the top left corner in the Kibana interface. Note that "Stack Management" is the last selection in the pull-down menu!~~
−
−	~~Then go to Kibana->Data Views, and select Create Data View:~~
−	~~* for "Name", select logstash*~~
−	~~* for "Index pattern", select logstash*~~
−	* for "Timestamp field", select @timestamp
−	* after setting the above fields, select "Save data view to Kibana"
−
−	Generate some syslog events by accessing the web server of the virtual machine and logging in into the virtual machine over SSH. Note that already existing Logstash configuration is parsing these events. For seeing the events, select "Discover" in the Kibana pull-down menu. The web server and SSH events can be searched with the following queries:
−
−	~~program:apache~~
−
−	~~program:sshd~~
−
−	~~After verifying that the web server and SSH events have been received by Kibana, you can create dashboards for these events under the "Dashboard" selection of the Kibana pull-down menu.~~
−
−	~~In order to create a dashboard for Suricata events, you can run Suricata in IDS mode as follows for creating events for that dashboard:~~
−
−	~~suricata -c /etc/suricata/suricata.yaml -D --af-packet=enp0s8~~
−
−	~~If your virtual machine has some other interface than enp0s8 connected to Host-Only Network of VirtualBox, use that interface instead in the above command line!~~
−
−	~~You can use the following test signature in /etc/suricata/rules/local.rules for generating Suricata events:~~
−
−	alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"HTTP request for a picture file"; flow:established,to_server; pcre:"/\.(?:gif\|jpg\|png)$/Ui";classtype:web-application-attack; sid:4000002; rev:1;)
−
−	~~Also, you can use other signatures from Suricata lab for generating events.~~
−
−	~~Already existing Logstash configuration is parsing all Suricata events, and you can search these events in Kibana with the following query:~~
−
−	~~program:suricata AND suricata.event_type:alert~~

←Vanem redaktsioon		Redaktsioon: 13. detsember 2023, kell 09:43
8. rida:		8. rida:

	Dashboards created for events received from Filebeat are '''not accepted'''.		Dashboards created for events received from Filebeat are '''not accepted'''.
−
−	~~'''To receive points for the graded lab, the dashboard has to be presented to the lecturers for evaluation during the lab in ICT-401, and any other submissions are not accepted.'''~~

	=== Instructions for setting up the course virtual machine for the graded lab ===		=== Instructions for setting up the course virtual machine for the graded lab ===