Help about Kibana

Elastic Stack Logstash
1

Hi Professionals,

I just took a course about ELK, right now I was asked to analyze log data (source_ip, destination_ip and messages information in the log document)
the question is that Which outside IP is coming into our local IP.

Any ideas?

Thanks

Mary

2

Could you share the log data which you are trying to analyze?

3

How can I export my search result?

when I export saved object in Kibana, I got this file and no data:
[
{
"_id": "7e9080f0-1204-11ea-b236-cd2ec6489a2c",
"_type": "search",
"_source": {
"title": "marysearch",
"description": "",
"hits": 0,
"columns": [
"message",
"destination_ips",
"source_ips"
],
"sort": [
"@timestamp",
"desc"
],
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"index":":logstash-","highlightAll":true,"version":true,"query":{"language":"kuery","query":""},"filter":}"
}
}
}
]

5

I want to get all results: only outside IPs talk to internal IPs (No internal IPs visit internal IPs)
{
"query": {
"bool": {
"must_not": [
{
"multi_match": {
"query": "10.",
"field": [
"source_ip",
"destination_ip"
]
}
}
]
}
}
}

But not working (10.xx.xx means internal IPS)

8

How do you ingested the logs?
can you share the raw logs?

9

Logs data are from Security Onion

10

I can send 10 samples raw data, but I can not send word file

11

Simply a snapshot of the logs would do, remove any sensitive information on the same

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.