BOTES Prerequisites
This page describe which packages are needed to launch scripts and commands used to sanitize the different JSON files from Splunk and generate all Elastic related files.
Scripts have been tested on the latest CentOS 7 minimal image version (currently 7.7-1908).
Install Python 3.7.X
Install jq
jq allow easy and fast JSON processing. (More information here : https://stedolan.github.io/jq/)
Install Go
Install Python packages
Install Git
Logstash configuration
Download Logstash configuration files from the following links and copy them in /etc/logstash/conf.d/
folder.
Change file paths in configuration according to your environement.
An output configuration file is also available. The specified Index name match with name or pattern specified in the Elasticsearch Index Mapping template file available here : https://botes.s3-us-west-1.amazonaws.com/botes-index-mapping/template.json.
If you want to change Index name in Output file, don't forget to change Index name or pattern in Elasticsearch Index Mapping template file.
Logstash configuration file
Download Link
fgt_event
fgt_traffic
fgt_utm
iis
nessus-scan
stream-dhcp
stream-dns
stream-http
stream-icmp
stream-ip
stream-ldap
stream-mapi
stream-sip
stream-smb
stream-snmp
stream-tcp
suricata
winevent-application
winevent-security
winevent-system
winregistry
xmlwineventlog-sysmon
elasticsearch output
Elasticsearch Index Template
Elasticsearch Index Mapping for BOTES Dataset, already modified and ready to be used can be downloaded here : https://botes.s3-us-west-1.amazonaws.com/botes-index-mapping/template.json
Upload Elasticsearch Index Mapping template with the following command and your environment :
Date format
Because some dates are in specific format, Elasticsearch Index Template need to be modified. Following formats have been added in Date fields :
Last updated
Was this helpful?