Skip to content

Latest commit

 

History

History
58 lines (50 loc) · 3.1 KB

README.md

File metadata and controls

58 lines (50 loc) · 3.1 KB

Graylog v3

Blog post

Install/Setup Graylog 3 on Ubuntu 18.04 - Zeeks logs + threat intel pipeline

Install/Setup Graylog

  1. git clone https://github.com/CptOfEvilMinions/BlogProjects.git
  2. cd BlogProjects/Graylogv3

Docker

  1. docker-compose up -d

Ansible

  1. vim hosts.ini and set:
    1. ansible_host - Set to the IP addr for Graylog
  2. mv group_vars/all.yml.example group_vars/all.yml
  3. vim group_vars/all.yml and set:
    1. base_domain - Set the domain for graylog
    2. timezone - Set country/state for NTP(time)
    3. cert stuff for OpenSSL cert - cert_*
  4. mv group_vars/graylog.yml.example group_vars/graylog.yml
  5. vim group_vars/graylog.yml and set:
    1. graylog_hostname - Set hostname for the new graylog box
    2. graylog_admin_password - Admin password for Graylog webgui
    3. graylog_beats_logging - Enable/Disable logging via Beats
      1. graylog_beats_port - Port to ingest Beats logs
    4. graylog_syslog_tcp_logging - Enable/Disable logging via Syslog with TCP
      1. graylog_syslog_tcp_port - Port to ingest Syslog with TCP
    5. graylog_syslog_udp_logging - Enable/Disable logging via Syslog with UDP
      1. graylog_syslog_udp_port - Port to ingest Syslog with UDP
  6. ansible-playbook -i host.ini deploy_graylog.yml -u <username> -K

Install/Setup logging clients

  1. mv group_vars/logging.yml.example group_vars/logging.yml

Install/Setup Filebeat for Zeek logs

  1. vim hosts.ini and set:
    1. ansible_host - Set to the IP addr for filebeat-agents
  2. vim group_vars/logging.yml and set:
    1. zeek_log_dir - Directory where Zeek logs are stored
  3. ansible-playbook -i host.ini deploy_filebeat_zeek.yml -u <username> -K

Install/Setup Rsyslog for NGINX logs

  1. vim hosts.ini and set:
    1. ansible_host - Set to the IP addr for rsyslog-agents
  2. vim group_vars/logging.yml and set:
    1. nginx_log_dir - Directory where NGINX logs are stored
  3. ansible-playbook -i host.ini deploy_rsyslog_nginx.yml -u <username> -K

Resources/Sources