說明

一直用Eventviewer及PowerShell查日誌在大量關聯事件時不是很容易，一不小心日誌被清掉覆蓋，所以會使用LogServer或是SIEM等平台，將日誌傳到平台上再寫規則自動化告警處理

作法

建立ElasticSearch平台

環境: Ubuntu22.04

安裝 Docker

# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

設定sysctl

echo 'vm.max_map_count=655360' | sudo tee -a /etc/sysctl.conf > /dev/null && sudo sysctl -p

安裝Docker-compose

sudo apt-get install docker-compose

建立Elasticsearch Container

使用這個Project快速建立Lab環境 (8.15.1)
https://github.com/peasead/elastic-container/tree/main

#elastic-container.sh用到這指令，用Script要安裝這個套件
sudo apt-get install jq
./elastic-container.sh start

或是選擇較舊的(7.17)
https://github.com/peasead/elastic-container/tree/bf84addf84c28d931dbf85291d3c31237966b70f

安裝 Elastic Agent

以前需要裝各種 Beats，現在多一種選項，安裝Elastic Agent，分群由中控(Fleet Server)決定要安裝需要的功能

https://www.elastic.co/guide/en/fleet/current/add-fleet-server-on-prem.html#add-fleet-server-on-prem-add-server

直接複製執行會出現錯誤訊息(自簽憑證的問題)
Elastic Agent enrollment fails on the host with x509: certificate signed by unknown authority message
https://www.elastic.co/guide/en/fleet/8.15/fleet-troubleshooting.html#agent-enrollment-certs
解法:最後面增加 --insecure

./elastic-agent install --url=https://<fleet-server-ip>:8220 --enrollment-token=<token> --insecure

遇到一直找不到日誌，查了好一段時間發現因為Timezone問題寫到未來時間，可以在yml設定，也可以把時間區間拉長一點一天或一週查找看看

REF

Getting started with the Elastic Stack and Docker Compose: Part 2
https://www.elastic.co/blog/getting-started-with-the-elastic-stack-and-docker-compose-part-2

lastic stack (ELK) on Docker
https://github.com/deviantony/docker-elk

Home Lab: Ingesting Data with Agent and Fleet
https://www.leveleffect.com/blog/home-lab-ingesting-data-with-agent-and-fleet