jpcertcc / sysmonsearch Goto Github PK

Investigate suspicious activity by visualizing Sysmon's event log

License: Other

Dockerfile 0.04% Python 13.19% JavaScript 75.65% Shell 0.17% CSS 2.51% HTML 8.36% Less 0.01% SCSS 0.06%

security kibana elasticsearch sysmon stix stix2

sysmonsearch's Introduction

SysmonSearch

SysmonSearch make event log analysis more effective and less time consuming, by aggregating event logs generated by Microsoft's Sysmon.

System Overview

SysmonSearch uses Elasticserach and Kibana (and Kibana plugin).

Elasticserach
Elasticsearch collects/stores Sysmon's event log.
Kibana
Kibana provides user interface for your Sysmon's event log analysis. The following functions are implemented as Kibana plugin.
- Visualizes Function
  This function visualizes Sysmon's event logs to illustrate correlation of processes and networks.
- Statistical Function
  This function collects the statistics of each device or Sysmon's event ID.
- Monitor Function
  This function monitor incoming logs based on the preconfigured rules, and trigers alert.
StixIoC server
You can add search/monitor condition by uploading STIX/IOC file. From StixIoC server Web UI, you can upload STIXv1, STIXv2 and OpenIOC format files.

Use SysmonSearch

To try SysmonSearch, you can either 1)install softwares to your own linux enviroment with following instractions or 2)use docker image:

Documentation

For details, please check the SysmonSearch wiki.

sysmonsearch's People

Contributors

Stargazers

Watchers

sysmonsearch's Issues

Kibana will not start with the plugin installed.

Hello,

Kibana fails to start with plugin installed.
Kibana 7.6.0, I'm utilizing existing build of ELK

Thx

SysmonSearch not appearing in Kibana

I installed ElasticSearch-6.4.2, Kibana-6.4.2 and SysmonSearch on Ubuntu 18.04.
According to the following wiki install steps

https://github.com/JPCERTCC/SysmonSearch/wiki/how-to-install#kibana-setup

SysmonSearch should be visible on the left menu. Unfortunately it is not.

How can this be fixed?

SysmonSearch for Nxlog

Hello,

If I want test SysmonSearch with a Nxlog and a logstash.
I must change my winlogbeat.yml of sigma with my nxlog.yml and change the "collection_alert_data.py" and "collection_statistical_data.py" ?

Congratulations on your work

StixIoc server 404

After following the steps as mentioned in the wiki

https://github.com/JPCERTCC/SysmonSearch/wiki/how-to-install#stixioc-server-setup

I run up to the following response from the StixIoc server (on both Windows 7 x64 and Ubuntu 18.04 x64)

Traceback (most recent call last):
File "/home/ubuntu1804/Documents/elk/SysmonSearch/stixioc-import-server/.env/local/lib/python2.7/site-packages/tornado/web.py", line 1569, in _execute
result = self.prepare()
File "/home/ubuntu1804/Documents/elk/SysmonSearch/stixioc-import-server/.env/local/lib/python2.7/site-packages/tornado/web.py", line 2322, in prepare
raise HTTPError(self._status_code)
HTTPError: HTTP 404: Not Found

I couldn't figure out what's going on.
I currently have ElasticSearch-6.4.2 and Kibana-6.4.2 installed.
Any support is welcomed.

Elasticsearch 5.6 support

Can you guys implement Elasticsearch 5.6 support? Would love to use this with Graylog + Kibana 5.6

Amazing project!, Is this still under active development ?

My index name is diffirent so I cannot start Dashboard

My index name is not winlogbeat-* so nothing can not display on SysmonSearch Dashboard. Which part I should change to display log on Dashboard? plz
This is the noti

SysmonSearch in Elastic 7.15

It seems the application doesn't work anymore in recent versions of Kibana. Did someone figure out already how to resolve this?

sysmon_search_plugin/conf.js

Please give me the exapmle of following:
//monitor rule file path
"savepath": "[path to the script]/rule_files"

I can't understand what "monitor rule" is.

Regards,

ubuntu18.04LTS／elasticsearch7.5.2／kibana7.5.2環境へSysmonSearchプラグインを導入しましたが、
SysmonSearchの[EventList]でしかログが表示されず[Alert][Serach][Statistics]が利用できません。
elasticsearchにログは届いていることは確認済みです。
どなたか同じ現象になっていませんでしょうか？

クライアント側はwinlogbeat7.5.2です。
ちなみにwinlogbeat6.6.2のログは[EventList]にすら表示されません。
winlogbeat6系のログは表示できないのでしょうか？

Support for latest ES and Kibana (7.x)

Hi all!

Does this plugin support ELK 7.x?

[ Work Stoppage ] Webpack Error in Kibana 7.9.2

Greetings

I am using 7.9.2 Elastic/Kibana and since Elastic 7.6 several changes have broken Sysmon Search, I have a critical need to use your awesome plugin and am wondering if you can fix the issues to work in Kibana 7.9.2 please.

The first error I experienced was about the imports of the ui modules, which since 7.6 Kibana are no longer used. I fixed that one in your plug-in by uncommenting the require import statement.

Now the one that is killing me is the webpack error described here.

https://flaviocopes.com/cannot-assign-readonly-property-export/

I changed your code in all files where I could find references to module.exports

Unfortunately I believe your deps have the same CommonJS imports that are no longer supported by webpack.

Can you please help?

My Environment

Debian 10, x64
Elasticsearch and Kibana 7.9.2 installed from Debian Package

Dockerでkibanaが起動しません

Dockerで起動するとファイルが無いとエラーとなりkibanaが起動しません。
どなたか経験ありますでしょうか？

＜実施したこと＞
sudo sysctl -w vm.max_map_count=262144
cd SysmonSearch/docker
sh ./setup.sh
docker-compose up

＜エラー内容＞
docker-sysmonsearch-kibana | ERROR in ./plugins/sysmon_search_r/public/components/main/react-graph-vis.js
docker-sysmonsearch-kibana | Module not found: Error: Can't resolve 'lodash/isEqual' in '/usr/share/kibana/plugins/sysmon_search_r/public/components/main'

環境：AzureVM(ubuntu20.04LTS)