Elastic 6.8.7

[dougburks]

List of packages to be tested:

• securityonion-elastic - 20190510-1ubuntu1securityonion87

List of Docker images to be tested:

• Elasticsearch 6.8.7 (both OSS and Elastic Features versions)
• Logstash 6.8.7 (both OSS and Elastic Features versions)
• Kibana 6.8.7 (both OSS and Elastic Features versions)
• Freqserver
• Domainstats
• ElastAlert
• Curator

An overview of the testing process can be found in the comments below. For a complete list of Issues to be tested, please see the Testing/Tested columns at https://github.com/Security-Onion-Solutions/security-onion/projects/11

Please record all testing results via comments on this issue or the individual issues at https://github.com/Security-Onion-Solutions/security-onion/projects/11

Thanks in advance for your time and effort!

[dougburks]

How To Start Testing

• install the current 16.04 ISO image

• snapshot the VM if possible

• add the test PPA:

  sudo add-apt-repository -y ppa:securityonion/test

• change DOCKERHUB from "securityonionsolutions" to "securityonionsolutionstest" (OSS license):

  sudo sed -i 's|DOCKERHUB="securityonionsolutions"|DOCKERHUB="securityonionsolutionstest"|g' /etc/nsm/elasticdownload.conf

• update:

  sudo soup

[dougburks]

How To Verify Proper Elastic Operation

Please test in as many different combinations as possible:

• verify that traditional Logstash parsing correctly parses Zeek logs in JSON or TSV format

• verify that Elasticsearch Ingest parsing correctly parses Zeek logs in JSON format

• verify Kibana dashboards visualize those parsed logs correctly

• check elasticsearch, logstash, and kibana logs in /var/log/ for anything out of the ordinary

• so-import-pcap vs sosetup-minimal vs traditional Setup

• Setup GUI vs CLI

• Evaluation Mode vs Production Mode

• standalone vs distributed deployments

• new installation vs upgrade

• Elastic OSS vs Elastic Features license (use so-elastic-features to switch from OSS to Features)

• SSO vs Elastic native auth (use so-elastic-auth to switch to Elastic native auth)

[weslambert]

No issues during my testing 👍 .

[bryant-treacle]

No issues during testing.

[dougburks]

Thanks @weslambert and @bryant-treacle !

[dougburks]

Published: https://blog.securityonion.net/2020/03/elastic-687-now-available-for-security.html