Elastic 6.8.8

[dougburks]

https://www.elastic.co/guide/en/elasticsearch/reference/6.8/release-notes-6.8.8.html

https://www.elastic.co/guide/en/logstash/6.8/logstash-6-8-8.html

https://www.elastic.co/guide/en/kibana/6.8/release-notes-6.8.8.html

[dougburks]

List of packages to be tested:

• securityonion-elastic - 20190510-1ubuntu1securityonion90

List of Docker images to be tested:

• Elasticsearch 6.8.8 (both OSS and Elastic Features versions)
• Logstash 6.8.8 (both OSS and Elastic Features versions)
• Kibana 6.8.8 (both OSS and Elastic Features versions)
• Freqserver
• Domainstats
• ElastAlert
• Curator

An overview of the testing process can be found in the comments below. For a complete list of Issues to be tested, please see the Testing/Tested columns at https://github.com/Security-Onion-Solutions/security-onion/projects/12

Please record all testing results via comments on this issue or the individual issues at https://github.com/Security-Onion-Solutions/security-onion/projects/12

Thanks in advance for your time and effort!

[dougburks]

How To Start Testing

• install the current 16.04 ISO image

• snapshot the VM if possible

• add the test PPA:

  sudo add-apt-repository -y ppa:securityonion/test

• change DOCKERHUB from "securityonionsolutions" to "securityonionsolutionstest" (OSS license):

  sudo sed -i 's|DOCKERHUB="securityonionsolutions"|DOCKERHUB="securityonionsolutionstest"|g' /etc/nsm/elasticdownload.conf

• update:

  sudo soup

[dougburks]

How To Verify Proper Elastic Operation

Please test in as many different combinations as possible:

• verify that traditional Logstash parsing correctly parses Zeek logs in JSON or TSV format and Sysmon logs via Winlogbeat and Wazuh

• verify that Elasticsearch Ingest parsing correctly parses Zeek logs in JSON format and Sysmon logs via Winlogbeat and Wazuh

• verify Kibana dashboards visualize those parsed logs correctly

• check elasticsearch, logstash, and kibana logs in /var/log/ for anything out of the ordinary

• so-import-pcap vs sosetup-minimal vs traditional Setup

• Setup GUI vs CLI

• Evaluation Mode vs Production Mode

• standalone vs distributed deployments

• new installation vs upgrade

• Elastic OSS vs Elastic Features license (use so-elastic-features to switch from OSS to Features)

• SSO vs Elastic native auth (use so-elastic-auth to switch to Elastic native auth)

[weslambert]

No issues during my testing 👍

[dougburks]

Published: https://blog.securityonion.net/2020/04/elastic-688-now-available-for-security.html