DanielBerman

{
    "networkMode": "bridge",
    "taskRoleArn": null,
    "containerDefinitions": [
        {
            "volumesFrom": [],
            "memory": null,
            "extraHosts": null,
            "dnsServers": null,
            "disableNetworking": null,

DanielBerman

ELK on Ubuntu Quick Install
---------------------------
#Elasticsearch
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get update
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get update && sudo apt-get install elasticsearch
sudo su
vim /etc/elasticsearch/elasticsearch.yml

DanielBerman

input {
	syslog {
		port => 5000
		type => "docker"
	}
}

filter {
	grok {
		match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:ver} +(?:%{TIMESTAMP_ISO8601:ts}|-) +(?:%{HOSTNAME:service}|-) +(?:%{NOTSPACE:containerName}|-) +(?:%{NOTSPACE:proc}|-) +(?:%{WORD:msgid}|-) +(?:%{SYSLOG5424SD:sd}|-|) +%{GREEDYDATA:msg}" }

DanielBerman

files:
    "/etc/filebeat/filebeat.yml":
        mode: "000755"
        owner: root
        group: root
        content: |
            filebeat:
                # List of prospectors to fetch data.
                prospectors:
                  -  

DanielBerman

############################# Heartbeat ######################################

# Configure monitors
heartbeat.monitors:
- type: http

  # List or urls to query
  urls: ["http://localhost:9200"]
  
  # Configure task schedule

DanielBerman

200.183.100.141 - - [25/Nov/2016:16:17:10 +0000] "GET /wp-content/force-download.php?file=../wp-config.php HTTP/1.0" 200 3842 "http://hack3r.com/top_online_shops" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; YTB720; GTB7.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

DanielBerman

input {
azureblob
  {
      storage_account_name => "yourStorageAccount"
      storage_access_key => "yourStorageAccessKey"
      container => "insights-logs-networksecuritygroupflowevent"
      codec => "json"	
      # Refer https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-read-nsg-flow-logs
      # Typical numbers could be 21/9 or 12/2 depends on the nsg log file types
      file_head_bytes => 12

DanielBerman

sudo apt-get update

sudo apt-get install \
    apt-transport-https \
    ca-certificates \
    curl \
    software-properties-common
    
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

DanielBerman

input {
  beats {
    host => "localhost"
    port => 5044
  }
}

filter {
  if [message] =~ /^#/ {
    drop { }

DanielBerman

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data: