Search code examples
elasticsearchkibanafilebeat

Filebeat - Monitoring a Jump server

I am using Elastic/Filebeat/Kibana and want to monitor users who ssh into a Jump Box specifically

  1. What IPs are they ssh'ng to
  2. Which users are connecting to those IP's
  3. What are the most connected to machines
  4. Which user is creating the most outbound connections

I have the system module enabled and all I can see is "related.user" to tell me who connects to the server via ssh but that's it.

enter image description here

Solution

  • You need to adjust your configuration in order to see all the information that you want.

    What IPs are they ssh'ng to? You are missing the destination.ip, you can easily just pick it up from it. Changes are you want to write some code and you can also extract it from the ssh command itself, you can see in the command the user, other arguments, and the destination ip in there as well, but you will need to parse that list. (process.parent.args), additionally, you can get the list count, and get the last element which is usually the IP, but I think it is easier to use the destination.ip itself.

    Which users are connecting to those IP's? For this, once you have the source and destination details, you need to create the Kibana report, you can run several aggregations and add different panels. A simple aggregation by IP will show you this, it is a matter of preference how you want it displayed.

    What are the most connected to machines? The same, you first run a count on the sources, or destinations (or both), then run a max on them.

    Which user is creating the most outbound connections? Here you can do all the users at once by running a count and grouping by user, then you list in descending order.

    You can see a full list of properties here (ecs fields)

    Summary: You need some extra fields, destiantion.ip, source.ip, eventually parse your arguments, then for reporting you need to count them and aggregate them, but once you have that data you can easily pull them and run the aggregations on them. I think the related user is a good one since it is the only one shown in the event itself, but how about if this user A actually uses an account B to connect to SSH, in that case you need to part the arguments from the process.parent.args .

    Cheers.