SOC Challenge/Day 4-Kibana Installation Guide

D4 - Kibana Installation Guide (Debian/Ubuntu)

Explanation

Kibana is the web graphical user interface for ELK stack and to access elasticsearch we interact with the kibana.

1. Download and Install Kibana

Download Kibana and its SHA512 checksum, verify the integrity of the package, and install it:

wget https://artifacts.elastic.co/downloads/kibana/kibana-8.15.2-amd64.deb wget https://artifacts.elastic.co/downloads/kibana/kibana-8.15.2-amd64.deb.sha512 shasum -a 512 kibana-8.15.2-amd64.deb sudo dpkg -i kibana-8.15.2-amd64.deb

2. Configure Kibana and Start Services

Set up the configuration and start Kibana:

cd /etc/kibana nano kibana.yml # Configure IP address and port settings systemctl daemon-reload systemctl enable kibana.service systemctl start kibana.service

3. Allow Kibana Port in the Firewall

Allow the Kibana port (5601) through the firewall to grant access:

ufw allow 5601 # Allow TCP access from your IP address

4. Access the Kibana GUI

Once the firewall is configured, log in to the Kibana GUI using the assigned IP and port.

5. Create Elasticsearch Enrollment Token

Generate an enrollment token to link Kibana to Elasticsearch:

cd /usr/share/elastic/bin ./elasticsearch-create-enrollment-token --scope kibana

6. Generate Kibana Verification Code

Create a verification code to complete the Kibana setup:

cd /usr/share/kibana/bin ./kibana-verification-code

7. Create Persistence Key for Alerts

Generate an encryption key for handling alerts within the Kibana security section:

cd /usr/share/kibana/bin ./kibana-encryption-keys generate ./kibana-keystore add "key names" # Enter key values when prompted

8. Restart Kibana Service

Restart the Kibana service to apply all changes:

systemctl restart kibana.service

Conclusion

By following these steps, you will successfully install and configure Kibana for use in your Elastic Stack environment.

Yorumlar