Hi, i'm new with elk stack, and need some help with my problem.
I have read the topic, basically on how to emulate something like an attack map cyber map, but I'm not sure if it is possible or not.
My objective is to show IP addresses from both source and destination IP if only it is from the internet on a Kibana coordinate map. I'm using the cidr function to add tags for both destination and source ip if it is from internal IP. By doing this, I'm able to filter out IPs from the internet and create a geo location.
This is my logstash conf file
//
filter {
grok {
match => [ "message", "%{SYSLOGTIMESTAMP:mytime} %{WORD:unuse1} %{WORD:unuse2}\[%{NUMBER:unuse3}\]\: \[%{NUMBER:sid}\:%{NUMBER:gid}\:%{NUMBER:rev}\] %{DATA:ids_data} \[Classification\: %{DATA:classification}\] \[Priority:\s+%{INT:priority}\] \{%{WORD:ids_proto}\}\s+%{IP:src_ip}\:%{INT:src_port}\s+\-\>\s+%{IP:dst_ip}\:%{INT:dst_port}" ]
}
#add tag to source IP which is coming from internal IP
cidr{
add_tag => ["internal_ip_source"]
address => [ "%{src_ip}" ]
network => ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
}
# create geoip for those IPs without tag
if [tags] != "internal_ip_source"
{
geoip{
source => "[src_ip]"
target => "internet_ip"
add_field => [ "[internet_ip][source_coordinates]", "%{[internet_ip][longitude]}" ]
add_field => [ "[internet_ip][source_coordinates]", "%{[internet_ip][latitude]}" ]
}
mutate {
convert => [ "[internet_ip][source_coordinates]", "float"]
}
}
#add tag to destination IP which is coming from internal IP
cidr{
add_tag => ["internal_ip_destination"]
address => [ "%{dst_ip}" ]
network => ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
}
# create geoip for those IPs without tag
if [tags] != "internal_ip_source"
{
geoip{
source => "[dst_ip]"
target => "internet_ip"
add_field => [ "[internet_ip][destination_coordinates]", "%{[internet_ip][longitude]}" ]
add_field => [ "[internet_ip][destination_coordinates]", "%{[internet_ip][latitude]}" ]
}
mutate {
convert => [ "[internet_ip][destination_coordinates]", "float"]
}
}
date {
match => [ "mytime", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "MMMM dd HH:mm:ss", "ISO8601"] #need to match the date log pattern exactly 100 percent all the spaces, special characters
target => "@timestamp"
}
}
This is part of my mapping
"internet_ip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo_point" },
"source_coordinates" : { "type" : "geo_point" },
"destination_coordinates" : { "type" : "geo_point" },
"latitude" : { "type" : "half_float" },
"longitude" : { "type" : "half_float" }
}
}
I tried to run it on kibana, but source_coordinates and destination_coordinates data type does not change to geo_point.
