Kibana
Kibana is a flexible and intuitive web interface for mining and visualizing the events and archives stored in Elasticsearch.
Note
Root user privileges are required to run all the commands described below.
Adding the Wazuh repository
This step is required only if Kibana will be installed on a separate host where Elasticsearch was installed.
Install the necessary packages for the installation:
# yum install curl libcap
Import the GPG key:
# rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
Add the repository:
# cat > /etc/yum.repos.d/wazuh.repo << EOF [wazuh] gpgcheck=1 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH enabled=1 name=EL-\$releasever - Wazuh baseurl=https://packages.wazuh.com/4.x/yum/ protect=1 EOF
Install the necessary packages for the installation:
# apt install curl apt-transport-https libcap2-bin
Install the GPG key:
# curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
Add the repository:
# echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
Update the package information:
# apt-get update
Install the necessary packages for the installation:
# zypper install curl # zypper install libcap-progs || zypper install libcap2
Import the GPG key:
# rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
Add the repository:
# cat > /etc/zypp/repos.d/wazuh.repo <<\EOF [wazuh] gpgcheck=1 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH enabled=1 name=EL-$releasever - Wazuh baseurl=https://packages.wazuh.com/4.x/yum/ protect=1 EOF
Kibana installation and configuration
Install the Kibana package:
# yum install opendistroforelasticsearch-kibana
# apt-get install opendistroforelasticsearch-kibana
# zypper install opendistroforelasticsearch-kibana
Download the Kibana configuration file:
# curl -so /etc/kibana/kibana.yml https://packages.wazuh.com/resources/4.2/open-distro/kibana/7.x/kibana.yml
Edit the
/etc/kibana/kibana.yml
file:server.host: <kibana_ip> elasticsearch.hosts: "https://<elasticsearch_ip>:9200"
Values to be replaced:
<kibana_ip>
: by default, Kibana only listens on the loopback interface (localhost), which means that it can be only accessed from the same host. To access Kibana from the outside it may be configured to listen on its network IP address by replacingkibana_ip
with Kibana's host IP. The value0.0.0.0
will accept all the available IPs of the host.<elasticsearch_ip>
: the host's IP address. In case of having more than one Elasticsearch node, Kibana can be configured to connect to multiple Elasticsearch nodes in the same cluster. The IPs of the nodes can be separated with commas. Eg.["https://10.0.0.2:9200", "https://10.0.0.3:9200","https://10.0.0.4:9200"]
Create the
/usr/share/kibana/data
directory:# mkdir /usr/share/kibana/data # chown -R kibana:kibana /usr/share/kibana/data
Install the Wazuh Kibana plugin:
The installation of the plugin must be done from the Kibana home directory:
# cd /usr/share/kibana # sudo -u kibana bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.7_7.10.2-1.zip
Replace
kibana-node-name
with your Kibana node name, the same used ininstances.yml
to create the certificates, and move the certificates to their corresponding location. This guide assumes that a copy ofcerts.tar
, created during the Elasticsearch installation, has been placed in the root home folder (~/
).# node_name=kibana-node-name
# mkdir /etc/kibana/certs # mv ~/certs.tar /etc/kibana/certs/ # cd /etc/kibana/certs/ # tar -xf certs.tar $node_name.pem $node_name-key.pem root-ca.pem # mv /etc/kibana/certs/$node_name.pem /etc/kibana/certs/kibana.pem # mv /etc/kibana/certs/$node_name-key.pem /etc/kibana/certs/kibana-key.pem # chown kibana:kibana /etc/kibana/certs/* # rm -f certs.tar
Link Kibana's socket to privileged port 443:
# setcap 'cap_net_bind_service=+ep' /usr/share/kibana/node/bin/node
Enable and start the Kibana service:
# systemctl daemon-reload # systemctl enable kibana # systemctl start kibana
Choose one option according to the operating system used:
RPM-based operating system:
# chkconfig --add kibana # service kibana start
Debian-based operating system:
# update-rc.d kibana defaults 95 10 # service kibana start
Access the web interface:
URL: https://<kibana_ip> user: admin password: admin
Upon the first access to Kibana, the browser shows a warning message stating that the certificate was not issued by a trusted authority. An exception can be added in the advanced options of the web browser or, for increased security, the root-ca.pem
file previously generated can be imported to the certificate manager of the browser. Alternatively, a certificate from a trusted authority can be configured.
It is highly recommended to change Elasticsearch’s default passwords for the users found at the /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
file. More information about this process can be found here.
With the first access attempt, the Wazuh Kibana plugin may prompt a message that indicates that it cannot communicate with the Wazuh API. To solve this issue edit the file /usr/share/kibana/data/wazuh/config/wazuh.yml
and replace the url
by the Wazuh server's address:
hosts:
- default:
url: https://localhost
port: 55000
username: wazuh-wui
password: wazuh-wui
run_as: false
To uninstall Kibana, visit the uninstalling section.
Next steps
Once the Wazuh environment is ready, a Wazuh agent can be installed on every endpoint to be monitored. The Wazuh agent installation guide is available for most operating systems and can be found here.