Cyberx Documentation Release Latest
Total Page:16
File Type:pdf, Size:1020Kb
CyberX Documentation Release latest Aug 26, 2021 Contents 1 About 1 2 Introduction 3 2.1 Elasticsearch...............................................4 2.2 Kibana..................................................4 2.3 Logstash.................................................4 2.4 ELK...................................................5 3 Data source and application management7 3.1 Data source................................................7 3.2 System services.............................................7 3.3 First configuration steps.........................................8 3.4 First login................................................. 14 3.5 Index selection.............................................. 16 3.6 Changing default users for services................................... 17 3.7 Custom installation the CyberX..................................... 18 3.8 Plugins management in the Elasticsearch................................ 22 3.9 ROOTless management......................................... 23 3.10 CyberX Elasticsearch encryption.................................... 24 3.11 Transport layer encryption........................................ 26 3.12 HTTP layer encryption.......................................... 26 3.13 Browser layer encryption......................................... 28 3.14 Index rollover............................................... 29 3.15 Default home page............................................ 29 4 Discovery 31 4.1 Time settings and refresh......................................... 31 4.2 Fields................................................... 33 4.3 Filtering and syntax building....................................... 34 4.4 Saving and deleting queries....................................... 36 4.5 Manual incident............................................. 38 4.6 Change the default width of columns.................................. 38 5 Visualizations 41 5.1 Creating visualization.......................................... 41 5.2 Vizualization types............................................ 43 5.3 Edit visualization and saving....................................... 43 i 5.4 Dashboards................................................ 46 5.5 Sharing dashboards............................................ 47 5.6 Dashboard drilldown........................................... 48 5.7 Sound notification............................................ 52 6 Reports 55 6.1 CSV Report............................................... 56 6.2 PDF Report................................................ 59 6.3 Scheduler Report (Schedule Export Dashboard)............................. 61 7 User roles and object management 65 7.1 Users, roles and settings......................................... 65 7.2 Creating a User (Create User)...................................... 67 7.3 Create, modify and delete a role (Create Role), (Role List)....................... 68 7.4 Default user and passwords....................................... 71 7.5 Changing password for the system account............................... 72 7.6 Module Access.............................................. 73 8 Settings 75 8.1 General Settings............................................. 75 8.2 License (License Info).......................................... 77 8.3 Special accounts............................................. 78 9 Alert Module 79 9.1 Enabling the Alert Module........................................ 79 9.2 SMTP server configuration........................................ 80 9.3 Creating Alerts.............................................. 80 9.4 Alerts status............................................... 84 9.5 Alert Types................................................ 84 9.6 Alert Methods.............................................. 88 9.7 Alert Content............................................... 90 9.8 Example of rules............................................. 91 9.9 Playbooks................................................ 97 9.10 Risks................................................... 100 9.11 Incidents................................................. 106 9.12 Indicators of compromise (IoC)..................................... 112 9.13 Calendar function............................................ 113 10 SIEM Plan 115 10.1 System security.............................................. 115 10.2 Security rules............................................... 126 11 Archive 127 11.1 Configuration............................................... 127 11.2 Archive Task............................................... 127 11.3 Archive Search.............................................. 129 11.4 Archive Upload.............................................. 130 11.5 Command Line tools........................................... 131 12 Intelligence Module 133 12.1 The fixed part of the screen....................................... 135 12.2 Screen content for regressive algorithms................................. 138 12.3 Screen content for the Trend algorithm................................. 140 12.4 Screen content for the neural network (MLP) algorithm........................ 142 12.5 AI Rules List............................................... 144 ii 12.6 AI Learn................................................. 146 12.7 AI Learn Tasks.............................................. 148 12.8 Scenarios of using algorithms implemented in the Intelligence module................. 149 12.9 Scheduler Module............................................ 150 12.10 Permission................................................ 152 12.11 Register new algorithm.......................................... 152 13 Verification steps and logs 157 13.1 Verification of Elasticsearch service................................... 157 13.2 Verification of Logstash service..................................... 158 14 Building a cluster 161 14.1 Node roles................................................ 161 14.2 Naming convention............................................ 161 14.3 Config files................................................ 162 14.4 Example setup.............................................. 162 14.5 Adding a new node to existing cluster.................................. 163 14.6 Cluster HOT-WARM-COLD architecture................................ 164 15 Integration with AD 165 15.1 AD configuration............................................. 165 15.2 Configure SSL suport for AD authentication.............................. 167 15.3 Role mapping............................................... 174 15.4 Password encryption........................................... 174 16 Integration with Radius 177 16.1 Configuration............................................... 177 17 Integration with LDAP 179 17.1 Configuration............................................... 179 18 Configuring Single Sign On (SSO) 181 18.1 Configuration steps............................................ 181 18.2 Client (Browser) Configuration##.................................... 183 19 Configure email delivery 189 19.1 Configure email delivery for sending PDF reports in Scheduler..................... 189 19.2 Basic postfix configuration........................................ 192 19.3 Example of postfix configuration with SSL encryption enabled..................... 192 20 Wiki 195 20.1 Wiki.js.................................................. 195 21 API 209 21.1 Kibana API................................................ 209 21.2 Elasticsearch API............................................. 210 21.3 Elasticsearch Index API......................................... 210 21.4 Elasticsearch Document API....................................... 213 21.5 Elasticsearch Cluster API........................................ 216 21.6 Elasticsearch Search API......................................... 216 21.7 Elasticsearch - Mapping, Fielddata and Templates........................... 217 21.8 AI Module API.............................................. 219 21.9 Alert module API............................................ 228 21.10 Reports module API........................................... 230 21.11 License module API........................................... 231 iii 21.12 User Module API............................................. 232 22 Logstash 233 22.1 Logstash - Input “beats”......................................... 233 22.2 Logstash - Input “network”....................................... 235 22.3 Logstash - Input SNMP......................................... 235 22.4 Logstash - Input HTTP / HTTPS..................................... 235 22.5 Logstash - Input File........................................... 236 22.6 Logstash - Input database........................................ 236 22.7 Logstash - Input CEF........................................... 238 22.8 Logstash - Input OPSEC......................................... 238 22.9 Logstash - Input SDEE.......................................... 248 22.10 Logstash - Input XML.......................................... 249 22.11 Logstash - Input WMI.......................................... 249 22.12 Logstash - Filter “beats syslog”..................................... 250 22.13 Logstash - Filter “network”....................................... 252 22.14 Logstash - Filter “geoip”......................................... 254 22.15 Logstash avoiding duplicate documents................................. 255 22.16 Logstash data enrichment........................................ 255 22.17 Logstash - Output to Elasticsearch.................................... 260 22.18 Logstash