JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Import from ElasticSearch with Authentication #88

Closed DennisLund closed 3 years ago

DennisLund commented 4 years ago

Hi.

This tool looks really promising, but I am having an issue importing data from my elasticsearch cluster.

It seems that there is no options for inputting elasticsearch credentials (I might be wrong). This means that I would have to remove authentication from my elasticsearch cluster in order to use this tool.?

I have had a quick look at the code, and I dont seem to be able to spot where to implement authentication.

Normally I would do something like this: context=create_default_context(cafile=ssl_cert_path) client = Elasticsearch([es_api_url1,es_api_url2],http_auth=(es_api_username,es_api_password),scheme="https",port=es_port,ssl_context=context)

I will try to dive a bit deeper, to see if I can implement elastic-auth into the code, but any help would be appreciated.

shu-tom commented 4 years ago

Added the authentication function when importing to Elasticsearch. Please try current version.

DennisLund commented 4 years ago

Thanks for the quick response.

Unfortunately I am not having any luck with the new version, as I am still getting a AuthenticationException(401, 'security_exception', 'missing authentication credentials for REST request [/winlogbeat-*/_search?size=1000&scroll=5m]') response.

I have looked through the code, and it seems you forgot to add the ES_PASSWORD variable, but adding that myself still gives the same response.

Once again, I will try and look at it myself, but just wanted to let you know, and thank you for the quick update on my issue.

duanshuaimin commented 3 years ago

I have the same problem

duanshuaimin commented 3 years ago

client = Elasticsearch(hosts=['elastic:password@ip:9200']) resolves 401 problem and then it works well

shu-tom commented 3 years ago

@duanshuaimin Thanks. I pushed your workaround.