Stormshield Elastic Stack

This project hosts files and links to components used by Stormshield Visibility Center.

Installation instructions

• Make sure you have a fully functional Elastic stack running. If not, please refer to Installing the Elastic Stack instructions,
• Install Syslog-ng
• Install Kibana index-pattern,
• Install Elasticsearch templates,
• Install Logstash plugins,
• Update Logstash pipeline configuration,
• Configure your Stormshield products to send logs to your Syslog-ng instance
  • UDP 514 or
  • TCP 601

Docker

A ready to use Elastic Stack is also provided as a Docker container for testing , here.

Logstash

Plugins

• logstash-filter-SNS
• logstash-filter-SDS
• logstash-filter-SES
• logstash-filter-search-engine

Pipeline configuration

List of pipeline configurations.

Elasticsearch templates

List of templates.

Kibana index-pattern

List of index-patterns.

Supported version

• Elasticsearch: 6.8.2
• Kibana: 6.8.2
• Logstash: 6.8.2

Legal Disclaimer

Open source projects are made available and contributed to under licenses that include terms that, for the protection of contributors, make clear that the projects are offered “as-is”, without warranty, and disclaiming liability for damages resulting from using the projects. This guide is no different. The open content license it is offered under includes such terms.

Running an open source project, like any human endeavor, involves uncertainty and trade-offs. We hope this guide helps, but it may include mistakes, and can’t address every situation. If you have any questions about your project, we encourage you to do your own research, seek out experts, and discuss with your community. If you have any legal questions, you should consult with your own legal counsel before moving forward. If you’re at a company, talk to its legal team.

Credit

SVC team:

• Alban MARGUET
• Laurent LEMKE
• Nabil BENDAFI
• Thomas ESCURE

Contact

Labo SVC <[email protected]>