Create Different "Index Management" and "Index Pattern" For Different Firewall Devices

Elastic Stack Kibana
1

Hello Team,

I want to create Dashboarding system (SIEM) For two different firewall device (Panorama Palo Alto, Fortianalyzer Fortinet). I want to use Filebeat Modules PANW and FORTINET. How i create 2 Index Management and 2 Index Pattern to separate 2 Log
PANW From port 5514(UDP)
Fortinet From port 5515(UDP).

I've create dashboarding using filebeat PANW and 1 Index management and index pattern.

Index Management1
Index Management11472×67 5.65 KB

Index Management For PANW

Index Pattern1
Index Pattern For PANW

Fortinet yml
Fortinet.yml

Anyone can help me for configure this thing?

Thankyou

2

You should not need to create separate indexes and index patterns there is no need to, in fact it will make it more difficult both data sets / FWs going into filebeat* indices will be fine and is how elastic is designed.

Each Document will have an event.dataset fields that will distinguish them.

Just configure the new module...
Then IMPORTANT run setup again....
filebeat setup -e

Then start filebeat for the new FW and it should work.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.