Видео

For this particular video there is no configuration for logstash, based on the logs you would like to send you can configure it. Check out other videos from channel you will find logstash configuration

I’m using Mac terminal to SSH into a Ubuntu machine

@CyberToolGuardian does it matter if it's mac or windows?

It doesn’t matter if you are using Mac or windows to SSH into a Ubuntu machine, but yes make sure of the architecture if the CPU you are using

Thanks for pointing out, this is already corrected in other video

Link is in the description

Glad that the video was helpful, please consider to subscribe to the channel and share it

Can you tell exactly what you are asking or drop a mail

I love u. Ty so muchhhhh ❤❤❤

Hey, I'm not exactly sure why this is happening can you send me a mail of screenshot at cybertoolguardian@gmail.com

@@CyberToolGuardian I have sent you an email, check your email sir.

Can you be specific how you want to integrate both of them

@@CyberToolGuardian I want to see the wazuh alerts collected on Kibanba, You can refer to " Elastic Stack integration ", I watched it and didn't understand how they instructed, I hope you can make a video about it as soon as possible. Ty so much again

Glad it helped

Install it on separate VM if you ask me, because that will help in keeping everything separate and safe

UTM

Here I haven’t used Ubuntu Server, I have used Ubuntu 22.04 LTS

I'm unsure that if you can use Zeek for blocking IPs because zeek works as a network monitoring tool, but if you have any idea on how to do this, let me know I will work on it and I will share

Sure thing, Check out latest video

Can you tell how you are sending logs? And when did you start sending logs

@@CyberToolGuardian Thanks. Finally I was able to make it work but the timestamp was latest one instead of the one from pcap file.

Happy for you

hi can u help me how to read pcap file with zeek?

Send a mail

That’s not an issue, interface can be different just make sure you specify the correct interface you have in the configuration file

This issue many are facing not sure why. But check out other method to install zeek video in the channel

sure I will make a video soon

There's no uninstall target in zeek distribution, but uninstalling should be pretty straightforward. Assuming you installed from source: - Simply rm -rf the zeek directory you installed into If you used zkg: - If you installed it from pip, "pip uninstall zkg" - If you have a ~/.zkg folder, rm -rf that as well.

Yes logstash PID keeps changing, can you DM on Instagram, I can help you there

Find the medium post link in bio, there all commands are listed

@@CyberToolGuardian says to find it in the medium post and yet their post is pay-walled lol. 0/10 and a downvote.

@Fish4Joe If you don’t have medium membership you can go ahead and find my blogger page and the link is the description where the article is free to view, Thanks for the information given ✌️

Thanks for reaching out. Looks like opensearch has ran out of space. I would recommend using a virtual machine with enough storage. I’m not sure how to fix but check current partitions using the command: df -kh Note down the path.data from opensearch.yml Then run, du -h --max-depth=1 <path.data value> You should be sure that partition where path.data resides has more than 15% free space according to how you created the filesystem or the opensearch won't be able to create any new indices, causing it to stop working. If this is the case, you may need to add more storage space to the indexer's partition or delete data manually.

Can you share the error screenshot on Instagram

I’m not sure about the process but I would suggest, create a super user account using x-pack and use those details to login and from Kibana UI reset passwords or else turn off x-pack security and then try to reset the password. Reach out on Instagram if issue persists

@@CyberToolGuardian hi, i also working on this project . But how can we do a simulation for the attack. For example, i want to get zeek log based on attack i did. How can i demo the attack, so i can get the zeek log from the attack? and display it to SIEM

@ehsanizzuddinaziz5347 I suppose you can do that, write the zeek scripts based on what attacks you want to detect and make sure the script generates logs when a attack is detected, you can send these logs to ELK

​@@CyberToolGuardianHi again, may i know if you can do tutorial how to use zeek with pcap file dataset. Becauss I'm tried to use pcap dataset. Zeek will generate the logs and display in Kibana but i still can't fix the problem because it won't show in Kibana. Can you help me?

Send a mail with the problem you are facing

Sorry, but I have done the installation in Ubuntu Server I have done in normal Ubuntu Workstation. If you are facing any trouble send the screenshot in Instagram as DM

The make command takes a lot of time to compete, if you turn off then the command may get stuck, once give some time and see if you get. If still doesn’t work then run configure command and then again make command

If you still get stuck DM with screenshot in Instagram

Thanks