search

Cyb3rWard0g / HELK

The Hunting ELK
GNU General Public License v3.0
3.73k stars 675 forks source link

Use an ELK or opendistro cluster #522

Closed badroum closed 3 years ago

badroum commented 3 years ago

Describe the problem

Hello, Sorry to open a second exit, but I didn't get an answer when the first one closed. The purpose of my question is twofold, as I already have an ELK cluster on other VMs, I would like to use them already present on it with HELK. Then, to know if HELK is compatible with open distro.

Several solutions can be envisaged but the one that interests me would be the following architecture

Logstash => Elasticsearch <=kibana ^ HELK(with out elasticsearch)

priamai commented 3 years ago

On a related question could we add an option to run OpenElasticSearch instead of the current ElasticSearch?

priamai commented 3 years ago

By the way I am attempting to replace the vanilla ES with the Open Distro ES, will see if that works and keep an update log here.

badroum commented 3 years ago

Thanks for your feedback, how are you progressing with the integration of opendistro?

priamai commented 3 years ago

Got a HDD failure (bad sectors) on my server machine, waiting for replacement on Monday. Will update later. Cheers!

Cyb3rWard0g commented 3 years ago

Hello @badroum @priamai . I have not worked on opendistro ES, and I do not think I would be able to get to it. Is this something that is still under development? or we can close this issue? Thank you all!

badroum commented 3 years ago

Hi @Cyb3rWard0g I'm still debugging on this installation, considering the latest news about ELK, I think it's not useless to have an idea about the integration with opendistro. I'll let you know as soon as I've implemented this modification.

priamai commented 3 years ago

Hi there, quick feedback on this I dropped the task for two reasons (1) as you mentioned after the skirmish AWS vs Elastic they have decided to split (2) there was quite a lot of things to fix to make it work. Personally I would not use OpenDistro anymore. Cheers.

neu5ron commented 3 years ago

this is going to become near impossible to maintain the two together, I have spent a lot of time following everything with elastic and opendistro and things in general around ELK. as of right now I still have no great answer on what to do - I think the best solution is HELK without Kibana and possibly without Elasticsearch. can still branch the elastic elaticsearch of HELK but make the main repo have ability to use all the things that differentiate HELK from every other commodity ELK and Elastic build (logstash, sigma, kafka, ksql, jupyter, etc..)

closing this, I imagine things in the future will be worked around this....