Closed kmz161 closed 2 years ago
Can you show me a sample of some of the Sagan logs?
Yes.
{ "timestamp": "2021-01-27T14:40:33.523208+0300", "flow_id": 1362230216, "in_iface": "logs", "event_type": "alert", "src_ip": "192.168.1.16", "src_port": 514, "dest_ip": "192.168.1.16", "dest_port": 22, "proto": "TCP", "payload": "IFVzZXIgdWJ1bnR1IG5vdCBhbGxvd2VkIGJlY2F1c2Ugc2hlbGwgL2V0Yy9wYXNzd2QgaXMgbm90IGV4ZWN1dGFibGU=", "stream": "0", "xff": "127.0.0.1", "facility": "UNDEFINED", "priority": "UNDEFINED", "level": "UNDEFINED", "program": "sshd", "host": "default_sensor_name", "alert": { "action": "allowed", "gid": 1, "signature_id": 5000077, "signature_triggered": "YWxlcnQgYW55ICRFWFRFUk5BTF9ORVQgYW55IC0+ICRIT01FX05FVCBhbnkgKG1zZzoiW09QRU5TU0hdIEF0dGVtcHQgdG8gbG9naW4gdXNpbmcgYSBkZW5pZWQgdXNlciI7IGNvbnRlbnQ6ICJub3QgYWxsb3dlZCBiZWNhdXNlIjsgZGVmYXVsdF9wcm90bzogdGNwOyBkZWZhdWx0X2RzdF9wb3J0OiAkU1NIX1BPUlQ7IGNsYXNzdHlwZTogdW5zdWNjZXNzZnVsLXVzZXI7IHByb2dyYW06IHNzaGQ7IHJlZmVyZW5jZTogdXJsLHdpa2kucXVhZHJhbnRzZWMuY29tL2Jpbi92aWV3L01haW4vNTAwMDA3Nzsgc2lkOjUwMDAwNzc7IHJldjozOyk=", "rev": 3, "signature": "[OPENSSH] Attempt to login using a denied user", "category": "Unsuccessful User Privilege Gain", "severity": 1 }, "normalize": null }
I had that issue too. Only in a different setup. The issue was related to the fact that the account you use to access your index is not sufficient enough to read/write to your index. Voila
Closing. This sounds like it may have been more of an Elasticsearch/Filebeat issue.
I using docker-compose for deploying elasticsearch and evebox
And I using filebeat for sending Sagan log to elasticsearch
Elasticsearch contains data but evebox has error
WARN evebox::elastic::eventstore: Elasticsearch response has no aggregations
What do I need for working evebox?