Suricata-IDS and ELK

Elastic Stack Beats
1

Hello,
I have a Suricata-IDS server and I want to see the logs by ELK. I don't like to install the ELK package on my Suricata-IDS server. I want to know is "Beats" enough for my Suricata-IDS server? How can I harden "Betas"?

Thank you.

2

Hi,

What do you mean by enough? I'm using it for my own Suricata-IDS and it works pretty good.

You could use SSL and Keystore so you don't have to save sensitive information in plain text.

3

As I said, I don't like to install any extra packages on Suricata-IDS server. Is "Beats" enough for sending logs to ELK on another server?

4

Sending logs to ELK on another server is what beats are made to do and they're doing it great! so yes they would be enough and you don't need to install any extra packages.