{"id":2586,"date":"2021-11-17T15:07:14","date_gmt":"2021-11-17T15:07:14","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=2586"},"modified":"2021-11-17T15:07:25","modified_gmt":"2021-11-17T15:07:25","slug":"elk-stack-y-suricata-ids","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/","title":{"rendered":"ELK Stack y Suricata IDS"},"content":{"rendered":"\n

Bienvenid@s a otro art\u00edculo de Hardsoft Security, en esta ocasi\u00f3n os traemos la integraci\u00f3n del Elastic Stack con el famoso IDS Suricata. Para saber c\u00f3mo lo hacemos, no dejes de leer.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n\n\n\n\n

Como en todos los art\u00edculos, vamos hacer una introducci\u00f3n respecto a las tecnolog\u00edas que vamos a utilizar para entrar en materia, pero antes de comenzar, uno de los requisitos obvios es tener instalado Suricata IDS en nuestro servidor, para esto os dejo el siguiente enlace, donde en el punto 4 podr\u00e9is ver la gu\u00eda de instalaci\u00f3n de Suricata IDS: Instalaci\u00f3n de Suricata IDS.<\/a><\/p>\n\n\n\n

\u00bfQu\u00e9 es ELK Stack?<\/h2>\n\n\n\n

ELK Stack es un conjunto de 3 herramientas de c\u00f3digo abierto, estas son: Elasticsearch, Logstash y Kibana. Estas herramientas son administradas por la empresa Elastic.<\/p>\n\n\n\n

El poder de estas 3 herramientas reside en su combinaci\u00f3n, ya que gracias a esta combinaci\u00f3n nos proporcionar\u00e1 una gesti\u00f3n de logs, registros centralizados y finalmente una presentaci\u00f3n en dashboard.<\/p>\n\n\n\n

Lo que nos permitir\u00e1 extraer informaci\u00f3n en tiempo real y muy importante para nosotros, ya que esto nos permitir\u00e1 identificar y resolver problemas de nuestro sistemas y aplicaciones.<\/p>\n\n\n\n

\u00bfC\u00f3mo funciona cada herramienta?<\/h2>\n\n\n\n

Principalmente se diferencia cada herramienta debido a la funci\u00f3n que tiene cada una, a continuaci\u00f3n describimos brevemente cada funci\u00f3n:<\/p>\n\n\n\n

  • Elastisearch: Almacena, busca indexa los datos transformados de Logstash.<\/li>
  • Logstash: Recopila los registros, los analiza y los transforma en datos.<\/li>
  • Kibana: Usa Elasticsearch para explorar, visualizar y compartir la informaci\u00f3n.<\/li><\/ul>\n\n\n\n

    Ya hemos entrado relativamente algo en materia y sabemos que funci\u00f3n tiene cada herramienta dentro de la infraestructura que estamos montando junto a nuestro IDS.<\/p>\n\n\n\n

    Instalaci\u00f3n de ELK Stack<\/h2>\n\n\n\n

    Como podemos imaginar, el resultado final es integrar nuestro Suricata IDS con este Stack de herramientas, esto har\u00e1 que visualizar la cantidad de informaci\u00f3n que arroja Suricata, no solo sea informaci\u00f3n que se almacena en un fichero de los, si no, que pasar\u00e1 a ser informaci\u00f3n valiosa para interpretar lo que sucede dentro de nuestra infraestructura y poder llegar a tiempo frente ataques o anomal\u00edas de nuestra red.<\/p>\n\n\n\n

    Instalaci\u00f3n de Java<\/h3>\n\n\n\n

    Para instalar Java en nuestro servidor, primero vamos a actualizar los repositorios:<\/p>\n\n\n\n

    apt -y update<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Tras actualizar los repositorios, aplicaremos las actualizaciones encontradas:<\/p>\n\n\n\n

    apt -y upgrade<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Una vez actualizado nuestro sistema y nuestros repositorios, procedemos a la instalaci\u00f3n del jdk de Java en su versi\u00f3n 11:<\/p>\n\n\n\n

    apt -y install openjdk-11-jdk<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Comprobamos que se ha instalado correctamente Java. Esto lo vamos hacer comprobando la versi\u00f3n que ha instalado:<\/p>\n\n\n\n

    java –version<\/p><\/blockquote>\n\n\n\n

    <\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Instalaci\u00f3n de ELK Stack<\/h3>\n\n\n\n

    Instalamos la llave de firma PGP de ELK Stack:<\/p>\n\n\n\n

    wget -qO – https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | apt-key add –<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Procedemos a la instalaci\u00f3n de los repositorios de ELK Stack:<\/p>\n\n\n\n

    apt install apt-transport-https<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Finalmente, a\u00f1adimos el repositorio al fichero source.list. Este fichero es donde tenemos declarados los repositorios a los cuales vamos a acceder a la hora de actualizar e instalar paquetes:<\/p>\n\n\n\n

    echo “deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main” | sudo tee \/etc\/apt\/sources.list.d\/elastic-7.x.list<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    De nuevo actualizamos para que tenga en cuenta los \u00faltimos cambios realizados:<\/p>\n\n\n\n

    apt -y update<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Comenzamos la instalaci\u00f3n de este Stack con la herramienta Elasticsearch:<\/p>\n\n\n\n

    apt -y install elasticsearch<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    A continuaci\u00f3n, procedemos a la configuraci\u00f3n de Elasticsearch, esto lo vamos hacer accediendo al siguiente fichero de configuraci\u00f3n:<\/p>\n\n\n\n

    nano \/etc\/elasticsearch\/elasticsearch.yml<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Localizamos la variable de configuraci\u00f3n “cluster.name” y establecemos un nombre:<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Posteriormente, buscaremos las variables de configuraci\u00f3n “network.host” la cual nos permite especificar desde que IP o IP’s podremos acceder a Elasticsearch y “http.port” donde especificamos el puerto de escucha de nuestra herramienta:<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Posteriormente, vamos a configurar la variable de configuraci\u00f3n “discovery.type” y a modificar “discovery.seed_host”:<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Tras realizar la configuraci\u00f3n, procederemos a habilitar la herramienta dentro de nuestro servidor, esto lo haremos de la siguiente manera:<\/p>\n\n\n\n

    systemctl enable –now elasticsearch<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Comprobamos que funcione correctamente con el siguiente comando (systemctl):<\/p>\n\n\n\n

    systemctl status elasticsearch <\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    El siguiente paso ser\u00e1 instalar la segunda herramienta que ser\u00e1 el panel web Kibana:<\/p>\n\n\n\n

    apt -y install kibana<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Procedemos a la configuraci\u00f3n de Kibana, accediendo al siguiente fichero de configuraci\u00f3n:<\/p>\n\n\n\n

    nano \/etc\/kibana\/kibana.yml<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Tras acceder al fichero de configuraci\u00f3n, vamos a configurar cual ser\u00e1 el puerto de escucha de Kibana y desde que IP’s se podr\u00e1 acceder al panel:<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Configuramos la variable de configuraci\u00f3n “elasticsearch.hosts” para que apunte al servidor donde lo tengamos instalado, en nuestro caso ser\u00e1 la IP de nuestro propio servidor, ya que todas las herramientas est\u00e1n instaladas en el mismo:<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Procedemos a habilitar Kibana en nuestro sistema:<\/p>\n\n\n\n

    systemctl enable –now kibana <\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Comprobamos el estado del servicio:<\/p>\n\n\n\n

    systemctl status kibana <\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Finalmente, la \u00faltima herramienta que vamos a instalar es logstash:<\/p>\n\n\n\n

    apt -y install logstash<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    Tras la instalaci\u00f3n del paquete de logstash, procedemos a la configuraci\u00f3n de entrada de informaci\u00f3n, indicando que est\u00e1 informaci\u00f3n la vamos a coger del fichero los de Suricata “eve.json”. Primero creamos el fichero de configuraci\u00f3n:<\/p>\n\n\n\n

    nano \/etc\/logstash\/conf.d\/logstash.conf<\/p><\/blockquote>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    A\u00f1adimos la siguiente configuraci\u00f3n de entrada de informaci\u00f3n:<\/p>\n\n\n\n

    input {\nfile {\n    path => [\"\/var\/log\/suricata\/eve.json\"]\n    codec =>  \"json\"\n    type => \"SuricataIDPS\"\n}\n\n}\n\nfilter {\nif [type] == \"SuricataIDPS\" {\n    date {\n    match => [ \"timestamp\", \"ISO8601\" ]\n    }\n    ruby {\n    code => \"\n        if event.get('[event_type]') == 'fileinfo'\n        event.set('[fileinfo][type]', event.get('[fileinfo][magic]').to_s.split(',')[0])\n        end\n    \"\n    }\n\n    ruby{\n    code => \"\n        if event.get('[event_type]') == 'alert'\n        sp = event.get('[alert][signature]').to_s.split(' group ')\n        if (sp.length == 2) and \/\\A\\d+\\z\/.match(sp[1])\n            event.set('[alert][signature]', sp[0])\n        end\n        end\n        \"\n    }\n}\n\nif [src_ip]  {\n    geoip {\n    source => \"src_ip\"\n    target => \"geoip\"\n    #database => \"\/opt\/logstash\/vendor\/geoip\/GeoLiteCity.dat\"\n    add_field => [ \"[geoip][coordinates]\", \"%{[geoip][longitude]}\" ]\n    add_field => [ \"[geoip][coordinates]\", \"%{[geoip][latitude]}\"  ]\n    }\n    mutate {\n    convert => [ \"[geoip][coordinates]\", \"float\" ]\n    }\n    if ![geoip.ip] {\n    if [dest_ip]  {\n        geoip {\n        source => \"dest_ip\"\n        target => \"geoip\"\n        #database => \"\/opt\/logstash\/vendor\/geoip\/GeoLiteCity.dat\"\n        add_field => [ \"[geoip][coordinates]\", \"%{[geoip][longitude]}\" ]\n        add_field => [ \"[geoip][coordinates]\", \"%{[geoip][latitude]}\"  ]\n        }\n        mutate {\n        convert => [ \"[geoip][coordinates]\", \"float\" ]\n        }\n    }\n    }\n}\n}<\/code><\/pre>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Y la siguiente configuraci\u00f3n de salida. de informaci\u00f3n:<\/p>\n\n\n\n
    output {\nelasticsearch {\n    hosts => \"localhost\"\n}\n}<\/code><\/pre>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    Tras a\u00f1adir la configuraci\u00f3n, nos aseguramos de que el log de Suricata “eve.json” tenga permisos suficientes para que acceda desde logstash, esto lo haremos con el siguiente comando:<\/p>\n\n\n\n
    chmod 775 \/var\/log\/suricata\/eve.json<\/p><\/blockquote>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Iniciamos el servicio, habilitamos y comprobamos su estado:<\/p>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Tras comprobar que logstash funciona correctamente, podemos acceder al panel web de Kibana, esto lo haremos accediendo a la direcci\u00f3n IP de nuestro servidor en el puerto 5601:<\/p>\n\n\n\n
    IP:5601<\/p><\/blockquote>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    Tras seleccionar le men\u00fa de opciones, nos vamos a dirigir la la opci\u00f3n Management -> Stack Management:<\/p>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Tras entrar, nos dirigimos a la opci\u00f3n Kibana -> Index Patterns:<\/p>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Creamos un nuevo \u00edndice pulsando en el bot\u00f3n “Cr\u00e9ate index patean”:<\/p>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Escribimos el nombre del \u00edndice que ha creado por defecto, que este ser\u00e1 donde se aloje toda la informaci\u00f3n de Suricata y pulsamos en “Create index pattern”:<\/p>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    A continuaci\u00f3n, se presentar\u00e1 todos los campos de informaci\u00f3n que podemos seleccionar:<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    Una vez configurado el index, vamos al men\u00fa de nuevo y nos dirigimos a Analytics -> Discover:<\/p>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Y finalmente, podremos ver toda la informaci\u00f3n:<\/p>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n
    Ahora solo queda crear diferentes dashboard y nuevos paneles de discover para analizar mucho mejor toda la informaci\u00f3n de Suricata.<\/p>\n\n\n\n
    Tengo que destacar la importancia de implementaci\u00f3n de este tipo de herramientas a la hora de centralizaci\u00f3n de informaci\u00f3n, ya que nos permite analizar mucho mejor todos los datos que probablemente si se analizase a mano, pasar\u00edan desapercibidos.<\/p>\n\n\n\n
    Con esto finaliza el art\u00edculo de hoy, espero ver vuestro comentario de como implement\u00e1is este tipo de herramientas.<\/p>\n\n\n\n
    Un saludo, David.<\/p>\n","protected":false},"excerpt":{"rendered":"
    Bienvenid@s a otro art\u00edculo de Hardsoft Security, en esta ocasi\u00f3n os traemos la integraci\u00f3n del Elastic Stack con el famoso IDS Suricata. Para saber c\u00f3mo lo hacemos, no dejes de …<\/p>\n","protected":false},"author":1,"featured_media":2587,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"\u00bfQuieres centralizar la informaci\u00f3n de Suricata IDS? En este art\u00edculo te ense\u00f1o como. ELK Stack y Suricata IDS.","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[3,7],"tags":[288,285,289,287,106,162,286,284],"class_list":["post-2586","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guias","category-seguridad-informatica","tag-elasticsearch","tag-elk-stack","tag-kibana","tag-logstash","tag-mikrotik","tag-suricata","tag-suricata-elk-stack","tag-suricata-ids"],"yoast_head":"\nELK Stack y Suricata IDS - Hardsoft Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ELK Stack y Suricata IDS - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Bienvenid@s a otro art\u00edculo de Hardsoft Security, en esta ocasi\u00f3n os traemos la integraci\u00f3n del Elastic Stack con el famoso IDS Suricata. Para saber c\u00f3mo lo hacemos, no dejes de ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-17T15:07:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-11-17T15:07:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"ELK Stack y Suricata IDS\",\"datePublished\":\"2021-11-17T15:07:14+00:00\",\"dateModified\":\"2021-11-17T15:07:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/\"},\"wordCount\":1162,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/elkStack.png?fit=600%2C200&ssl=1\",\"keywords\":[\"Elasticsearch\",\"ELK Stack\",\"Kibana\",\"Logstash\",\"mikrotik\",\"suricata\",\"Suricata ELK Stack\",\"Suricata IDS\"],\"articleSection\":[\"Gu\u00edas\",\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/\",\"name\":\"ELK Stack y Suricata IDS - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/elkStack.png?fit=600%2C200&ssl=1\",\"datePublished\":\"2021-11-17T15:07:14+00:00\",\"dateModified\":\"2021-11-17T15:07:25+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/elkStack.png?fit=600%2C200&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/elkStack.png?fit=600%2C200&ssl=1\",\"width\":600,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2021\\\/11\\\/17\\\/elk-stack-y-suricata-ids\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ELK Stack y Suricata IDS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ELK Stack y Suricata IDS - Hardsoft Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/","og_locale":"es_ES","og_type":"article","og_title":"ELK Stack y Suricata IDS - Hardsoft Security","og_description":"Bienvenid@s a otro art\u00edculo de Hardsoft Security, en esta ocasi\u00f3n os traemos la integraci\u00f3n del Elastic Stack con el famoso IDS Suricata. Para saber c\u00f3mo lo hacemos, no dejes de ...","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2021-11-17T15:07:14+00:00","article_modified_time":"2021-11-17T15:07:25+00:00","og_image":[{"width":600,"height":200,"url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"7 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"ELK Stack y Suricata IDS","datePublished":"2021-11-17T15:07:14+00:00","dateModified":"2021-11-17T15:07:25+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/"},"wordCount":1162,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1","keywords":["Elasticsearch","ELK Stack","Kibana","Logstash","mikrotik","suricata","Suricata ELK Stack","Suricata IDS"],"articleSection":["Gu\u00edas","Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/","name":"ELK Stack y Suricata IDS - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1","datePublished":"2021-11-17T15:07:14+00:00","dateModified":"2021-11-17T15:07:25+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1","width":600,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/17\/elk-stack-y-suricata-ids\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"ELK Stack y Suricata IDS"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-FI","jetpack-related-posts":[{"id":2504,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2021\/11\/08\/suricata-ips-y-mikrotik\/","url_meta":{"origin":2586,"position":0},"title":"Suricata IPS y Mikrotik","author":"david","date":"noviembre 8, 2021","format":false,"excerpt":"Hola a tod@s, hoy os traigo un post bastante interesante de como integrar un IDS en este caso Suricata con los Routers Mikrotik, esto es algo bastante interesante ya que por defecto Mikrotik no trae muchas facilidades para realizar esta integraci\u00f3n. Para comenzar con este post tenemos que explicar los\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":1376,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2017\/10\/31\/instalacion-de-suricata-ids-y-mikrotik\/","url_meta":{"origin":2586,"position":1},"title":"Instalaci\u00f3n de Suricata IDS y Mikrotik","author":"david","date":"octubre 31, 2017","format":false,"excerpt":"Hola a tod@s de nuevo, tras un tiempo sin publicar nada por el blog, hoy voy a publicar un peque\u00f1o documento, donde explico como instalar Suricata IDS sobre CentOS 7 y interceptar el tr\u00e1fico de nuestro router Mikrotik. Aqu\u00ed adjunto el documento PDF: Gracias por ver el blog. Saludos David.","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2017\/10\/suricata.png?fit=1051%2C421&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":2921,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/04\/10\/elk-stack-en-ciberseguridad\/","url_meta":{"origin":2586,"position":2},"title":"ELK Stack en Ciberseguridad: Fortalece tu Seguridad Inform\u00e1tica","author":"david","date":"abril 10, 2023","format":false,"excerpt":"Descubre c\u00f3mo utilizar ELK Stack en seguridad inform\u00e1tica con nuestro \u00faltimo post en el blog. Aprende c\u00f3mo la combinaci\u00f3n de Elasticsearch, Logstash y Kibana puede ayudarte a monitorear, analizar y responder en tiempo real a las amenazas de seguridad. 1. Introducci\u00f3n a ELK Stack: Qu\u00e9 es y para qu\u00e9 sirve.\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":1522,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2018\/06\/04\/hids-instalacion-centralizada-de-ossec\/","url_meta":{"origin":2586,"position":3},"title":"HIDS, Instalaci\u00f3n centralizada de OSSEC.","author":"david","date":"junio 4, 2018","format":false,"excerpt":"Hola a tod@s, hoy os traigo un post donde vamos a explicar que es un HIDS (Host Intrusion Detection System) y ha instalar el HIDS OSSEC de manera centralizada, es decir Cliente - Servidor. Empezamos por describir lo m\u00e1s b\u00e1sico, es decir que es un IDS (Intrusion Detection System), un\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/06\/ossec-ubuntu-logo-1.jpg?fit=500%2C236&ssl=1&resize=350%2C200","width":350,"height":200},"classes":[]},{"id":3638,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/01\/25\/como-usar-sqlmap-guia-con-caso-practico\/","url_meta":{"origin":2586,"position":4},"title":"\u00bfC\u00f3mo usar SQLMap? Gu\u00eda con caso pr\u00e1ctico.","author":"david","date":"enero 25, 2024","format":false,"excerpt":"\u00a1Hola! Hoy vamos a sumergirnos en el fascinante mundo de SQLMap, una herramienta indispensable para aquellos que se dedican a garantizar la seguridad de las bases de datos y, por supuesto, para los curiosos del pentesting. Imagina tener una navaja suiza que puede detectar y explotar vulnerabilidades en bases de\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/01\/image-2.png?fit=724%2C362&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/01\/image-2.png?fit=724%2C362&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/01\/image-2.png?fit=724%2C362&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/01\/image-2.png?fit=724%2C362&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3991,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/08\/26\/offensive-ai-vulnerable-mcp-server-lab\/","url_meta":{"origin":2586,"position":5},"title":"Offensive AI – Vulnerable MCP Server Lab","author":"david","date":"agosto 26, 2026","format":false,"excerpt":"A self-hosted, intentionally vulnerable MCP (Model Context Protocol) server for security research and education. This lab demonstrates how MCP servers can be enumerated, interacted with, and exploited using common vulnerability classes. WARNING:\u00a0This lab is intentionally vulnerable. Run it in an isolated environment only. Do not expose it to the internet.\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/08\/image.png?fit=753%2C271&ssl=1&resize=700%2C400 2x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2021\/11\/elkStack.png?fit=600%2C200&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/2586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=2586"}],"version-history":[{"count":4,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/2586\/revisions"}],"predecessor-version":[{"id":2626,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/2586\/revisions\/2626"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/2587"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=2586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=2586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=2586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}