Fundamentos de SIEM y análisis de logs: detectando amenazas con Elastic Stack

# compose.yml
services:
 
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    restart: unless-stopped
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
    volumes:
      - es_data:/usr/share/elasticsearch/data
    ports:
      - "127.0.0.1:9200:9200"
    healthcheck:
      test: ["CMD-SHELL", "curl -su elastic:${ELASTIC_PASSWORD} http://localhost:9200/_cluster/health | grep -q '\"status\":\"green\"\\|\"status\":\"yellow\"'"]
      interval: 30s
      retries: 5
 
  kibana:
    image: docker.elastic.co/kibana/kibana:8.13.0
    restart: unless-stopped
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
    ports:
      - "127.0.0.1:5601:5601"
    depends_on:
      elasticsearch:
        condition: service_healthy
 
  logstash:
    image: docker.elastic.co/logstash/logstash:8.13.0
    restart: unless-stopped
    volumes:
      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro
    ports:
      - "5044:5044"   # Entrada de Beats
      - "514:514/udp" # Entrada de Syslog
 
volumes:
  es_data:

# Instalación en Ubuntu/Debian
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.13.0-amd64.deb
sudo dpkg -i filebeat-8.13.0-amd64.deb

# /etc/filebeat/filebeat.yml
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/auth.log
      - /var/log/syslog
    tags: ["linux", "auth"]
 
  - type: log
    enabled: true
    paths:
      - /var/log/nginx/access.log
      - /var/log/nginx/error.log
    tags: ["nginx"]
    json.keys_under_root: true
 
# Usa módulos para el parseo estructurado de logs
filebeat.modules:
  - module: system
    auth:
      enabled: true
    syslog:
      enabled: true
  - module: nginx
    access:
      enabled: true
    error:
      enabled: true
 
output.logstash:
  hosts: ["siem-server:5044"]

sudo systemctl enable filebeat
sudo systemctl start filebeat

# logstash/pipeline/main.conf
input {
  beats {
    port => 5044
  }
  udp {
    port => 514
    codec => plain
    tags => ["syslog"]
  }
}
 
filter {
  # Parsear fallos de autenticación SSH
  if "auth" in [tags] {
    grok {
      match => { "message" => "Failed password for %{USER:ssh_user} from %{IP:src_ip} port %{INT:src_port}" }
      tag_on_failure => []
    }
 
    if [src_ip] {
      geoip { source => "src_ip" }
    }
  }
 
  # Parsear logs de acceso de nginx
  if "nginx" in [tags] and [log][file][path] =~ "access" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    mutate {
      convert => { "response" => "integer" }
    }
  }
}
 
output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    user => "elastic"
    password => "${ELASTIC_PASSWORD}"
    index => "siem-%{[tags][0]}-%{+YYYY.MM.dd}"
  }
}

{
  "name": "SSH Brute Force Attempt",
  "type": "threshold",
  "query": "message: \"Failed password\" AND tags: auth",
  "threshold": {
    "field": "src_ip",
    "value": 10
  },
  "time_window": "5m",
  "severity": "high",
  "actions": ["slack-alert"]
}

{
  "name": "Successful Login After Brute Force",
  "type": "eql",
  "query": "sequence with maxspan=5m\n  [authentication where event.outcome == \"failure\"] with runs=5\n  [authentication where event.outcome == \"success\"]",
  "severity": "critical"
}