安装部署disem项目

|
| 字数统计: 429

项目部署

偶然在推上看到这个github项目

image-20220412215025909

image-20220412215040680

于是希望进行学习研究

采用docker部署的方法部署该项目

https://github.com/defenxor/dsiem/blob/master/docs/installation.md

其中安装环境为centos7

1
2
3
4
5
6
7
8
9
unzip dsiem-master.zip && cd dsiem-master

export PROMISC_INTERFACE=enp0s5

cd deployments/docker && \
sudo chown root $(find conf/filebeat/ conf/filebeat-es/ -name "*.yml") 

docker-compose pull
docker-compose up

照着安装步骤安装

其中若docker无法启动就看docker-compose up的日志（比如filebeat无法启动）

image-20220412220745359

Dsiem web UI http://localhost:8080/ui

Elasticsearch http://localhost:9200

Kibana http://localhost:5601

image-20220412221031601

载入kibana的dsiem dashoboard

首先打开kibana的网页 http://localhost:5601

kibana的页面可能很久才能打开，要多等一会

然后终端运行如下命令

1
./scripts/kbndashboard-import.sh localhost ./deployments/kibana/dashboard-siem.json

image-20220412223634116

项目解构

image-20220413153604065

image-20220413153718704

查看docker-compose.yml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
filebeat:
  container_name: filebeat
  image: docker.elastic.co/beats/filebeat:7.4.0
  user: root
  networks:
    - siemnet
  volumes:
    - filebeat-data:/usr/share/filebeat/data
    - ./conf/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml
    - dsiem-log:/var/log/dsiem
    - suricata-log:/var/log/suricata

filebeat-es:
  container_name: filebeat-es
  image: docker.elastic.co/beats/filebeat:7.4.0
  user: root
  networks:
    - siemnet
  volumes:
    - ./conf/filebeat-es/filebeat.yml:/usr/share/filebeat/filebeat.yml
    - ./conf/filebeat-es/fields.yml:/usr/share/filebeat/fields.yml
    - ./conf/filebeat-es/module:/usr/share/filebeat/module
    - ./conf/filebeat-es/modules.d:/usr/share/filebeat/modules.d
    - filebeat-es-data:/usr/share/filebeat/data
    - dsiem-log:/var/log/dsiem

其中filebeat-data:/usr/share/filebeat/data指的是将主机的/var/lib/docker/volumes/docker_filebeat-data/_data映射到filebeat中的/usr/share/filebeat/data

simple-arch.png

filebeat是左边这个搜集suricate的，filebeat-es是搜集右边这个dsiem的日志系统