Bases du SIEM et de l'analyse de logs : détecter les menaces avec Elastic Stack

# compose.yml
services:
 
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    restart: unless-stopped
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
    volumes:
      - es_data:/usr/share/elasticsearch/data
    ports:
      - "127.0.0.1:9200:9200"
 
  kibana:
    image: docker.elastic.co/kibana/kibana:8.13.0
    restart: unless-stopped
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
    ports:
      - "127.0.0.1:5601:5601"
 
  logstash:
    image: docker.elastic.co/logstash/logstash:8.13.0
    restart: unless-stopped
    volumes:
      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro
    ports:
      - "5044:5044"   # Entrée Beats
      - "514:514/udp" # Entrée Syslog
 
volumes:
  es_data:

# Installation sur Ubuntu/Debian
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.13.0-amd64.deb
sudo dpkg -i filebeat-8.13.0-amd64.deb

# /etc/filebeat/filebeat.yml
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/auth.log
      - /var/log/syslog
    tags: ["linux", "auth"]
 
  - type: log
    enabled: true
    paths:
      - /var/log/nginx/access.log
      - /var/log/nginx/error.log
    tags: ["nginx"]
    json.keys_under_root: true
 
# Utiliser les modules pour le parsing structuré
filebeat.modules:
  - module: system
    auth:
      enabled: true
    syslog:
      enabled: true
  - module: nginx
    access:
      enabled: true
    error:
      enabled: true
 
output.logstash:
  hosts: ["serveur-siem:5044"]

sudo systemctl enable filebeat
sudo systemctl start filebeat

# logstash/pipeline/main.conf
input {
  beats {
    port => 5044
  }
  udp {
    port => 514
    codec => plain
    tags => ["syslog"]
  }
}
 
filter {
  # Parser les échecs d'auth SSH
  if "auth" in [tags] {
    grok {
      match => { "message" => "Failed password for %{USER:ssh_user} from %{IP:src_ip} port %{INT:src_port}" }
      tag_on_failure => []
    }
 
    if [src_ip] {
      geoip { source => "src_ip" }
    }
  }
 
  # Parser les logs d'accès nginx
  if "nginx" in [tags] and [log][file][path] =~ "access" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    mutate {
      convert => { "response" => "integer" }
    }
  }
}
 
output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    user => "elastic"
    password => "${ELASTIC_PASSWORD}"
    index => "siem-%{[tags][0]}-%{+YYYY.MM.dd}"
  }
}

{
  "name": "Tentative de brute force SSH",
  "type": "threshold",
  "query": "message: \"Failed password\" AND tags: auth",
  "threshold": {
    "field": "src_ip",
    "value": 10
  },
  "time_window": "5m",
  "severity": "high"
}