Closed antmar904 closed 2 years ago
Hello. So I keep getting asked to configure Kibana and I've tried numerous settings but I'm unable to get it to work
Hi, I've updated MemProcFS-Analyzer today. Please check out MemPorcFS-Analyzer-v0.4.
The ELK feature should also work again. The tutorial for setting up ELK will follow soon. You can use Timeline Explorer to analyze the new CSV output.
Closed.
Testing now
It's asking me for a username and password for elasticsearch...
Yea...Elastic changed a lot...new security features added. A pre-configuration is needed. I hope Ulf is writing a tutorial for this soon.
Ah ok. Ill hold off on using it and hopefully a tutorial is released soon on how to configure it. :) Thanks
I don't have any immediate plans on releasing a tutorial how to configure elasticsearch. I may have to look over some of the videos I have, but that will probably be later this fall at the earliest. I'm sure ElasticSearch have a tutorial though if needed.
Otherwise it's not too hard. When elasticsearch starts for the first time it will display a password for the user elastic in the console window. It will also present a configuration token for kibana.
Copy this information. Then start kibana. Input the auto-configuration token and see to it that you're logged on to kibana.
Then when ElasticSearch/Kibana is up and running enter the user name elastic and the password copied earlier on and things should work as before.
Unfortunately this is how things are. Elastic made it harder and there is not much I can do to simplify this.
I will have a look on it hopefully next week.
Looking forward to the next release as I love this tool and I'm not able to use it currently. :( Plus it's getting a lot of notice on Reddit and I've been advocating for the use of it also. I just need to get Elastic working.
I wrote a simple tutorial for Elastic: https://github.com/evild3ad/MemProcFS-Analyzer/wiki/Elasticsearch
It's working perfect, thanks again for the tutorial! :)
Awesome thanks. I’ll check it out tmrw.
On Mon, Jul 11, 2022 at 11:31 AM Martin Willing @.***> wrote:
Hi, I've updated MemProcFS-Analyzer today. Please check out MemPorcFS-Analyzer-v0.4.
The ELK feature should also work again. The tutorial for setting up ELK will follow soon. You can use Timeline Explorer to analyze the new CSV output.
— Reply to this email directly, view it on GitHub https://github.com/evild3ad/MemProcFS-Analyzer/issues/9#issuecomment-1180558010, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACBKBE655UNZTSAUVGWY5GDVTQ46TANCNFSM5VBVK7NQ . You are receiving this because you authored the thread.Message ID: @.***>
Hi. When running the script here is the output I am getting with Kibana and EvtxECmd:
MemProcFS-Analyzer v0.2 - Automated Forensic Analysis of Windows Memory Dumps for DFIR (c) 2021 Martin Willing (https://evild3ad.com/)
Analysis date: 2022-05-04 11:20:27 UTC
[Info] Current Version: MemProcFS v4.7 (2022-04-26) [Info] Latest Release: MemProcFS v4.7 (2022-01-30) [Info] You are running the most recent version of MemProcFS. [Info] Dokany File System Library NOT found. [Info] Latest Release: Dokany File System Library v1.4.0.1000 (2020-06-01) [Info] Please download/install the latest release of Dokany File System Library manually: https://github.com/dokan-dev/dokany/releases/tag/v1.4.0.1000 (DokanSetup_redist.exe) [Info] Current Version: Elasticsearch v8.1.3 [Info] Latest Release: Elasticsearch v8.2.0 (2022-05-03) [Info] Dowloading Latest Release ... [Info] Extracting Files ... [Info] Kibana NOT found. [Info] Latest Release: Kibana v8.2.0 (2022-05-03) [Info] Dowloading Latest Release ... [Info] Extracting Files ... Rename-Item : Cannot rename because item at 'E:\Tools\MemProcFS-Analyzer-v0.2\Tools\kibana-8.2.0-windows-x86_64' does not exist. At E:\Tools\MemProcFS-Analyzer-v0.2\MemProcFS-Analyzer.ps1:512 char:9
[Info] EvtxECmd NOT found. [Info] Dowloading Latest Release ... Invoke-WebRequest : { "code": "not_found", "message": "File with such name does not exist.", "status": 404 } At E:\Tools\MemProcFS-Analyzer-v0.2\MemProcFS-Analyzer.ps1:566 char:5