Elastic SIEM is a great way to provide security analytics and monitoring capabilities to small businesses and homes. Check out Part 7 of this series.

Hello, security enthusiasts! This is part seven (can you believe it?) of the Elastic SIEM for home and small business blog series. If you haven’t read the first six blogs in the series, you may want to before going any further. In the prerequisite blogs we <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-1-getting-started">created our Elasticsearch Service deployment</a> (part 1), <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-2-securing-cluster-access">secured access to our cluster</a> by restricting privileges for users and Beats (part 2), then we <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-3-geoip-data-and-beats-config-review">created an ingest pipeline for GeoIP data and reviewed our Beats configurations</a> (part 3). In the Beats blogs, we configured data collection from our <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-4-beats-on-windows">Windows</a>, <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-5-beats-on-centos">CentOS</a>, and <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-6-beats-on-mac">macOS</a> systems.
 <h2>Before we dive in...</h2>Now that we are collecting data from our systems, our hard work is about to pay off as we walk through the Elastic SIEM app!&nbsp;
If you have been following the blog series from the beginning, then you are most likely running <a href="https://www.elastic.co/blog/elastic-siem-7-4-0-released">Elastic SIEM version 7.4</a>. Even though version <a href="https://www.elastic.co/blog/elastic-security-7-5-0-released">7.5</a> and version <a href="https://www.elastic.co/blog/elastic-security-7-6-0-released">7.6</a> have been released, we will finish out this blog series with version 7.4 for version consistency. Now that <a href="https://www.elastic.co/blog/elastic-stack-7-6-0-released">Elastic SIEM is generally available in 7.6</a>, I highly recommend <a href="https://www.elastic.co/guide/en/cloud/current/ec-upgrade-deployment.html#ec-upgrade-deployment">upgrading your cluster</a> (especially since the <a href="https://github.com/elastic/elasticsearch/issues/46193">GeoIP issue</a> is <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.6/release-notes-7.6.0.html">fixed in 7.6</a>). If you have already upgraded your cluster or are running a newer version, some of the displays in Kibana may look different than what is available in 7.4.&nbsp;
Please keep in mind that while we configured data collection from our <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-4-beats-on-windows">Windows</a>, <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-5-beats-on-centos">CentOS</a>, and <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-6-beats-on-mac">macOS</a> systems, we have not completed collecting data from all of the devices on our network. For better visibility of your environment, you will want to collect data from other devices — especially <a href="https://www.elastic.co/guide/en/siem/guide/current/siem-overview.html#network-data-sources">network data sources</a> (for example a <a href="https://www.elastic.co/guide/en/beats/filebeat/7.4/filebeat-module-panw.html">Palo Alto Firewall</a>, a <a href="https://www.elastic.co/guide/en/beats/filebeat/7.4/filebeat-module-cisco.html">Cisco ASA</a>, or <a href="https://discuss.elastic.co/t/dec-9th-2018-en-elastic-stack-ubiquiti-metrics-in-the-elastic-stack/159986">Ubiquiti devices</a>). While we may add some standalone device collection blogs, I recommend taking a look at some of the ways you can collect data from your environment, including <a href="https://www.elastic.co/guide/en/logstash/7.4/input-plugins.html">Logstash Input Plugins</a> and <a href="https://www.elastic.co/guide/en/beats/filebeat/7.4/filebeat-modules.html">Filebeat Modules</a>. Remember that you will need to collect <a href="https://www.elastic.co/guide/en/ecs/master/index.html">ECS-compliant data</a> for it to be <a href="https://www.elastic.co/guide/en/siem/guide/7.4/siem-overview.html#ecs">displayed in the SIEM app</a>.
 <h2>Reviewing our data with all systems configured</h2>Since we will not make any administrative cluster changes during our review, we will sign in using the SIEM user account we created in <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-2-securing-cluster-access">blog 2</a>. After signing in with the SIEM user account (I will be using my <code>rob</code> account), click the SIEM app.&nbsp;
 <h3>SIEM Overview page</h3>The first page we are taken to in the SIEM app is the Overview page. Here is the data from the last 24 hours from my systems:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt608bb226585b3fe2/5e5835ae9437900dbf81eb44/01_siem-overview.png" data-sys-asset-uid="blt608bb226585b3fe2" alt="01_siem-overview.png" style="display: block; margin: auto;"> 
Next we will look at the Hosts and Network pages for more information.
 <h3>SIEM Hosts page</h3><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt2e388dbb947cfc61/5e5835c906f84d0d618dbf3b/02_host-summary-1.png" data-sys-asset-uid="blt2e388dbb947cfc61" alt="02_host-summary-1.png" style="display: block; margin: auto;"> 
Here I am glad to see there are no authentication failures. I can also see the list of hosts that have reported in, as well as the last time they sent data to my cluster:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt58612ca8b47b3efd/5e5835df5eb8900d450c19fb/03_host-list-1.png" data-sys-asset-uid="blt58612ca8b47b3efd" alt="03_host-list-1.png" style="display: block; margin: auto;"> 
By default, the SIEM app shows us the last 24 hours’ worth of data, but we have more than that in our cluster. I’m going to select <code>Month to date</code> in the time picker to see what data has been collected during this month:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltf79e824d5c3dd29c/5e5835fd43aa3a0d529625aa/04_month-date-time-picker.png" data-sys-asset-uid="bltf79e824d5c3dd29c" alt="04_month-date-time-picker.png" style="display: block; margin: auto;">
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt33158a1f4a56b86e/5e58361263fdbd0db5745ffb/05_host-summary-2.png" data-sys-asset-uid="blt33158a1f4a56b86e" alt="05_host-summary-2.png" style="display: block; margin: auto;">
I’m going to set my time selection back to the last 24 hours, since our time selection will be remembered when we move to the Network page. I am also going to try to sign in with the incorrect username and password on a device, to see if I can raise any authentication failures in the SIEM app.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt1fefaf5e244dfd4d/5e583622eb1b970da9df8ac7/06_host-summary-3.png" data-sys-asset-uid="blt1fefaf5e244dfd4d" alt="06_host-summary-3.png" style="display: block; margin: auto;"> 
This data was expected, as the authentication failures were generated by me attempting to access one of my systems.
 <h3>SIEM Network page</h3>On the SIEM Network page, we are presented with both a map to correlate GeoIP data, as well as an overview of the data collected.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt36fded79a6c95121/5e58368607dae60d5b824888/07_network-map-1.png" data-sys-asset-uid="blt36fded79a6c95121" alt="07_network-map-1.png" style="display: block; margin: auto;">
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltb47ba8b97a3011de/5e58369e6148a40d9331b16f/08_network-summary-1.png" data-sys-asset-uid="bltb47ba8b97a3011de" alt="08_network-summary-1.png" style="display: block; margin: auto;"> 
Next, I will select <code>Week to date</code> in the time picker to see what data has been collected during this week:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltb9bf867abf53e068/5e5836b77569ef0d9eca794b/09_network-map-2.png" data-sys-asset-uid="bltb9bf867abf53e068" alt="09_network-map-2.png" style="display: block; margin: auto;">
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt864d7f07b8c9d74f/5e5836c87c30c50dca6637b3/10_network-summary-2.png" data-sys-asset-uid="blt864d7f07b8c9d74f" alt="10_network-summary-2.png" style="display: block; margin: auto;"> 
 <h2>Elastic SIEM Timeline</h2>Next, we will dig further into our data via the SIEM Timeline. We will go back to the Hosts page and scroll down to the “Authentications” section. Here I see the user <code>Rob</code> has a few authentication failures. I will filter for this user by entering <code>user.name:”Rob”</code> in the filter:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltc7041a6c046e6b4b/5e5836e96148a40d9331b177/11_siem-search-bar.png" data-sys-asset-uid="bltc7041a6c046e6b4b" alt="11_siem-search-bar.png" style="display: block; margin: auto;">
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt60bfd29575299d8a/5e5836f83f8e8a0d4b9a6120/12_siem-result-host-overview.png" data-sys-asset-uid="blt60bfd29575299d8a" alt="12_siem-result-host-overview.png" style="display: block; margin: auto;">
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt8b5b3e2615583f0a/5e58371363fdbd0db5746003/13_search-result-user-auths.png" data-sys-asset-uid="blt8b5b3e2615583f0a" alt="13_search-result-user-auths.png" style="display: block; margin: auto;"> 
Next, we will click and drag the user <code>Rob</code> over to the <code>Timeline</code> box on the right-hand side:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt6f7b2bdef77fe7a7/5e583732aa10350d40dea123/14_moving-user-to-timeline.png" data-sys-asset-uid="blt6f7b2bdef77fe7a7" alt="14_moving-user-to-timeline.png" style="display: block; margin: auto;"> 
Let’s drop this into the “Timeline” box and see what information is available. It looks like we have almost 1,300 events from today in this timeline:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltaef1de173a993b32/5e58374318f75a0d4c86b75c/15_timeline-overview-1.png" data-sys-asset-uid="bltaef1de173a993b32" alt="15_timeline-overview-1.png" style="display: block; margin: auto;">
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltcc65be0879d8e81a/5e58375207dae60d5b82488e/16_timeline-overview-2.png" data-sys-asset-uid="bltcc65be0879d8e81a" alt="16_timeline-overview-2.png" style="display: block; margin: auto;"> 
Let’s name this Timeline “Rob Auth's” and give it a description of “Authentication events for the user Rob”. Lastly, we’ll add a note that we’ve added these to the timeline from the events today.
After we add our note, let’s click “Add Note.” Then we can close out of the note and Timeline, then review the “Timelines” page. In the “Timelines” page, we will be able to see any of the timelines we create from our data:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt7b4e1acbd0501a89/5e58376b63fdbd0db5746009/17_timeline-overview-3.png" data-sys-asset-uid="blt7b4e1acbd0501a89" alt="17_timeline-overview-3.png" style="display: block; margin: auto;"> 
This is just the beginning — so much more has been added in <a href="https://www.elastic.co/blog/elastic-security-7-5-0-released">version 7.5</a> and <a href="https://www.elastic.co/blog/elastic-security-7-6-0-released">version 7.6</a>!&nbsp; You can now leverage the power of <a href="https://www.elastic.co/siem">Elastic SIEM</a> to monitor activity for your home or small business network.
 <h2>Next steps: Our data in Elastic Maps</h2>I recommend reading through the Elastic SIEM <a href="https://www.elastic.co/guide/en/siem/guide/7.4/install-siem.html">Get up and running guide</a> to see what options are available for collecting data from the remaining devices in your network. In the next blog, we will review our data in Elastic Maps. We’ll then finish up the series by reviewing ways to maintain our Elasticsearch Service deployment.&nbsp;
Follow along with this Elastic SIEM for home and small business blog series as we develop a powerful, yet simple, security solution at home (or for your small business). Remember that once we install and configure Beats on our systems, we can go to the SIEM app to see what data is available.
<ul>
	<li>Part 1: <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-1-getting-started">Getting started</a></li>
	<li>Part 2: <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-2-securing-cluster-access">Securing cluster access</a></li>
	<li>Part 3: <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-3-geoip-data-and-beats-config-review">GeoIP data and Beats config</a></li>
	<li>Part 4: <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-4-beats-on-windows">Beats on Windows</a></li>
	<li>Part 5: <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-5-beats-on-centos">Beats on CentOS</a></li>
	<li>Part 6: <a href="https://www.elastic.co/blog/elastic-siem-for-small-business-and-home-6-beats-on-mac">Beats on macOS</a></li>
	<li>Part 7: SIEM overview</li>
</ul>
<h2>A few last things...</h2>If you run into any issues, the first place we’d recommend turning is to our <a href="https://www.elastic.co/guide/index.html">documentation</a>. It can help with many common issues. If you still have outstanding questions, check out our <a href="https://discuss.elastic.co/">Elastic forums</a> for additional help. Or, if you want to talk to the Elastic Support team directly, you have direct access to a team of experts if you’ve deployed on <a href="https://www.elastic.co/cloud/">Elasticsearch Service</a>. If you are self-hosting, you can start an <a href="https://www.elastic.co/subscriptions">Elastic subscription</a> today and have direct access to our support team. Be safe out there!

blog-banner-castle-tower.jpg

blog-thumb-castle-tower.jpg

Elastic SIEM for home and small business: SIEM overview

Elastic SIEM is a great way to provide security analytics and monitoring capabilities to small businesses and homes. Check out Part 6 of this series.

blog-thumb-apple-sliced.jpg

Elastic SIEM for home and small business: Beats on Mac

Elastic SIEM is a great way to provide security analytics and monitoring capabilities to small businesses and homes. Check out Part 5 of this series.

blog-thumb-penguins-on-snow.jpg

Elastic SIEM for home and small business: Beats on CentOS

Elastic SIEM is a great way to provide security analytics and monitoring capabilities to small businesses and homes. Check out Part 4 of this series.

pexels-photo-316085_full.jpeg

blog-thumb-windows-skyscraper.jpg

Elastic SIEM for home and small business: Beats on Windows

Elastic SIEM is a great way to provide security analytics and monitoring capabilities to small businesses and homes. Check out Part 3 of this series.

Elastic SIEM for home and small business: GeoIP data and Beats config review

Elastic SIEM is a great way to provide security analytics and monitoring capabilities to small businesses and homes. Check out Part 2 of this series.

blog-thumb-keys-gray-wood.jpg

Elastic SIEM for home and small business: Securing cluster access

Elastic SIEM is a great way to provide security analytics and monitoring capabilities to small businesses and homes. Check out Part 1 of this series on SIEM for home networks and small businesses.

SIEM-home-blog-thumb.jpg

Elastic SIEM for home and small business: Getting started

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Rob Waight

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

제출하면 귀하가 <a href="/kr/legal/elastic-cloud-account-terms" target="_self">Elastic 서비스 약관</a>을 읽고 이에 동의하며, 위에 제공된 연락처로 <a href="/kr/legal/privacy-statement#how-we-use-the-information" target="_self">선택한 커뮤니케이션</a>을 수신하는 데 동의한 것으로 간주됩니다. 언제든지 수신을 거부할 수 있으며 자세한 내용은 <a href="/kr/legal/privacy-statement/" target="_self">Elastic 개인정보 취급방침</a>을 참조하시기 바랍니다.

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

제출하면 귀하가 Elastic <a href="/kr/legal/serverless-preview-terms" target="_self">서비스 약관</a>을 읽고 이에 동의하며, 위에 제공된 세부 정보를 사용하여 Elastic이 관련 제품 및 서비스에 대해 귀하에게 <a href="/kr/legal/privacy-statement#how-we-use-the-information" target="_self">연락할 수 있음</a>을 이해한 것으로 간주됩니다. 언제든지 수신을 거부할 수 있으며 자세한 내용은 <a href="/kr/legal/privacy-statement/" target="_self">Elastic 개인정보 취급방침</a>을 참조하시기 바랍니다.

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

제출하면 <a href="/kr/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud 서비스 약관</a>에 동의하시게 됩니다. 개인 데이터는 <a href="/kr/legal/privacy-statement">Elastic의 개인정보 취급방침</a>에 따라 처리됩니다.

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

제출하면 귀하가 Elastic <a href="/kr/legal/terms-of-use" target="_self">서비스 약관</a>을 읽고 이에 동의하며, 위에 제공된 세부 정보를 사용하여 Elastic이 관련 제품 및 서비스에 대해 귀하에게 <a href="/kr/legal/privacy-statement#how-we-use-the-information" target="_self">연락할 수 있음</a>을 이해한 것으로 간주됩니다. 언제든지 수신을 거부할 수 있으며 자세한 내용은 <a href="/kr/legal/privacy-statement/" target="_self">Elastic 개인정보 취급방침</a>을 참조하시기 바랍니다.

Explore similar demos

Overview

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

이 페이지의 콘텐츠는 선택하신 언어로 제공되지 않습니다. Elastic은 다양한 언어로 콘텐츠를 제공하기 위해 최선을 다하고 있습니다.조금만 더 기다려주세요!

Author

Articles by

Learn more

Watch now (no PT)

Watch now

See all top stories

All (no PT translation)

Contact information

Press Release

Share on Reddit

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Load More

Share on LinkedIn

Follow us on LinkedIn

Search Integrations

All Solutions

Video for

Follow us on Twitter

See when this webinar starts in my time zone

내 표준 시간대로 웨비나 시작 시간 확인하기

Register to Watch

Register now

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

참여가 어려우신가요? 등록하시면 녹화 자료를 보내드리겠습니다. 이메일로 관련 콘텐츠도 받아보실 수 있습니다.

Small image for

On-demand webinar

Featured webinar

Register to Attend

Share on Facebook

Reset all

Upcoming webinar

View more posts

Print

Hosted by

Sign In to Attend

View next

Follow us on Facebook

Share

Highlights

Read less

You'll also receive an email with related content

이메일을 통해 관련 내용을 보내드리겠습니다.

Thank you for registering. We will send you a confirmation email soon.

등록해 주셔서 감사합니다. 곧 확인 이메일을 보내드리겠습니다.

Author

Articles by Rob Waight

Elastic SIEM for home and small business: SIEM overview

Elastic SIEM for home and small business: Beats on Mac

Elastic SIEM for home and small business: Beats on CentOS

Elastic SIEM for home and small business: Beats on Windows

Elastic SIEM for home and small business: GeoIP data and Beats config review

Elastic SIEM for home and small business: Securing cluster access

Elastic SIEM for home and small business: Getting started

Sign up for Elastic Cloud free trial