This module practices analyzing logs. Start the lab below and follow the steps. Then answer the questions.
We have added ready-made log sources to ELK, but a data view still needs to be created from them. Start by going to Analytics -> Discover and Kibana will offer you the option to create a Data view. Click on Create data view.
Choose logstash-auth containing SSH logs. Create a data view with the following values.
ELK stack terms
The "index" of the ELK stack is a term used to describe the part of the database where the collected data is stored and indexed. Indexes are used for organizing, storing, and quickly retrieving data.
"Data view" (data view) is a concept that refers to the way data is presented and viewed based on a certain perspective or need. It may contain specific information from a database or other data source structured and presented in a desired way. Data view can be a kind of "view" or "report" that provides users with a specific perspective on data without actually modifying the data itself.
Continue by moving to Analytics -> Discover and you will see the added logs.
On the left side are the field values parsed from the log source, which you can click on and use to, for example, filter desired events or pieces of information from the log. In the top right corner, you can select the event time and of course by clicking on the waterfall, you can refine the timestamps. Answer the following questions below.
Tip: Be careful with time ranges
When investigating logs and narrowing down times, remember to be careful not to miss logs that have occurred outside the time frame you have defined!
How many log events are there in total?
Which user name has been used to create SSH connections?
From which IP addresses have SSH connections not been created?
What login type has been used?
Ready to become an ethical hacker?
Start today.
As a member of Hakatemia you get unlimited access to Hakatemia modules, exercises and tools, and you get access to the Hakatemia Discord channel where you can ask for help from both instructors and other Hakatemia members.