Eng: Maged Magdy Linkedin: **https://www.linkedin.com/in/maged-magdy-01287a2a5/**
During The Third Week of WE INNOVATE Track SOC, I learned how to install and configure Elasticsearch & Kibana and install its Agent on windows Machine to collect and forward logs to Elasticsearch.
Elasticsearch is an open-source, distributed search and analytics engine built on Apache Lucene. It is designed for real-time data processing, making it ideal for log analysis, full-text search, and business intelligence.
Kibana is an open-source visualization tool that works with Elasticsearch, providing an intuitive UI for analyzing data, creating dashboards, and monitoring logs.
Together, they form a core part of the ELK Stack and, when combined with Elastic Security, serve as a powerful SIEM (Security Information and Event Management) solution for detecting and responding to security threats in real-time.
update and upgrade the system
sudo apt update && sudo apt upgrade -y
Elasticsearch requires Java to work
java -version
If not installed, download OpenJDK
sudo apt install openjdk-17-jdk -y
Check installation again
java -version
Add Elastic Repository
wget -qO - <https://artifacts.elastic.co/GPG-KEY-elasticsearch> | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
Then add the repository
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] <https://artifacts.elastic.co/packages/8.x/apt> stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
Update the repositories and install Elasticsearch
sudo apt update && sudo apt install elasticsearch -y
After installation, enable and run the service at startup
sudo systemctl enable --now elasticsearch
Install kibana
sudo apt install kibana -y