search

philhagen / sof-elk

Configuration files for the SOF-ELK VM
GNU General Public License v3.0
1.46k stars 272 forks source link

Kape / File System Dashboard #242

Closed NassemKa closed 2 years ago

NassemKa commented 2 years ago

Hi Phil, I had run SOFELK_Parser module from Kape tool on both a live system and on mounted forensic image , so I can get a better view on sytem logs in ELK, I have dropped MFTECmd$MFT_Output,_EvtxECmd_Output,_LECmd_Output,_PECmd_Output files in /logstash/kape. The Eventlog Dashboard and LNK Dashboard are working great ,but in File System Dashboard I keep getting shards failed error caused by illegal_argument_exception in mapping script and reason is No field found for [source_geo.asn]. Is this an error? or File System Dashboard is not supposted to be used with this kind of data (Kape Output Data),also is there should data in syslog dashboard? thanks for your time and your effort, Best Regards 2022-02-02_03-56-49 2022-02-02_03-57-17 2022-02-02_04-04-41

philhagen commented 2 years ago

hi - this is a known error that is fixed upstream. im anticipating a new public release in the coming weeks that will address this, as well as several other items and add new features.

however, I've just cherry-picked those fixes onto public/v20211006 so assuming you're running that version, you should be able to run sudo sof-elk_update.sh, then sof-elk_clear.py -i filesystem and re-load your data files. (edit: corrected flag to lowercase -i)

I'll keep this open until confirmed but I believe that should do the trick.

NassemKa commented 2 years ago

Hi Phil, thanks for your response I'm running public/v20211006 and have tried your suggested solution and problem seems to be gone now. 2022-02-02_12-37-43

philhagen commented 2 years ago

excellent! thank you for the report and for confirming the fix. cheers!!