OP5-Log-Analytics-6.x User Guide

• About
• Introduction
  • Elasticsearch
  • Kibana
  • Logstash
  • ELK

• Data source and application management
  • Data source
  • System services
  • First configuration steps
    • Run the instalation
    • Installation steps
    • Optional installation steps:
  • First login
  • Index selection
  • Changing default users for services
    • Change Kibana User
    • Change Elasticsearch User
    • Change Logstash User
  • Custom installation the OP5 Log Analytics
  • Plugins management in the Elasticsearch
    • Installing Plugins
    • Listing plugins
    • Removing plugins
    • Updating plugins

• Discovery
  • Time settings and refresh
  • Fields
  • Filtering and syntax building
    • Syntax
    • Filters
    • Operators
  • Saving and deleting queries
    • Save query
    • Open query
    • Delete query

• Visualizations
  • Creating visualization
    • Create
    • Load
  • Vizualization types
  • Edit visualization and saving
    • Edititing
    • Saving
    • Load
  • Dashboards
    • Create
    • Saving
    • Load
  • Sharing dashboards
  • Dashboard drilldown

• Reports
  • CSV Report
  • PDF Report
  • Scheduler Report (Schedule Export Dashboard)

• User roles and object management
  • Users, roles and settings
  • Creating a User (Create User)
    • Creating user
    • User’s modification and deletion, (User List)
  • Create, modify and delete a role (Create Role), (Role List)
  • Default user and passwords
  • Changing password for the system account

• Settings
  • General Settings
  • License (License Info)
  • Special accounts

• Alert Module
  • Enabling the Alert Module
  • Creating Alerts
  • Alerts status
  • Example of rules
    • Unix - Authentication Fail
    • Windows - Firewall disable or modify
  • Playbooks
    • Create Playbook
    • Playbooks list
    • Linking Playbooks with alert rule
    • Playbook verification
  • Risks
    • Create category
    • Category list
    • Create risk
    • List risk
    • Linking risk with alert rule
    • Risk calculation algorithms
    • Adding a new risk calculation algorithm
    • Using the new algorithm
    • Additional modification of the algorithm (weight)

• Intelligence Module
  • The fixed part of the screen
  • Screen content for regressive algorithms
  • Screen content for the Trend algorithm
  • Screen content for the neural network (MLP) algorithm
  • AI Rules List
  • AI Learn
  • AI Learn Tasks
  • Scenarios of using algorithms implemented in the Intelligence module
    • Teaching MLP networks and choosing the algorithm to use:
    • Starting the MLP network algorithm:
    • Starting regression algorithm:
    • Management of available rules:
  • Scheduler Module
  • Permission
  • Register new algorithm

• Verification steps and logs
  • Verification of Elasticsearch service
  • Verification of Logstash service
    • Debuging

• Building a cluster
  • Node roles
  • Naming convention
  • Config files
  • Example setup
  • Adding a new node to existing cluster

• Integration with AD
  • AD configuration
  • Configure SSL suport for AD authentication
  • Role mapping
  • Password encryption
• Integration with Radius
  • Configuration

• Configuring Single Sign On (SSO)
  • Configuration steps
    • Create an User Account for Elasticsearch auth plugin
    • Define Service Principal Name (SPN) and Create a Keytab file for it
    • Create a file named krb5Login.conf:
    • Append the following JVM arguments (on Elasticsearch node in /etc/sysconfig/elasticsearch):
    • Add the following additional (sso.domain, service_principal_name, service_principal_name_password) settings for ldap in elasticsearch.yml or properties.yml file wherever the ldap settings are configured:
    • To apply the changes restart Elasticsearch service
    • Enable SSO feature in kibana.yml file:
  • Client (Browser) Configuration##
    • Internet Explorer configuration
    • Chrome configuration
    • Firefox configuration

• Configure email delivery
  • Configure email delivery for sending PDF reports in Scheduler.
  • Basic postfix configuration
  • Example of postfix configuration with SSL encryption enabled

• API
  • Elasticsearch API
  • Elasticsearch Index API
    • Adding Index
    • Delete Index
    • API useful commands
  • Elasticsearch Document API
    • Create Document
    • Delete Document
    • Useful commands
  • Elasticsearch Cluster API
    • Useful commands
  • Elasticsearch Search API
    • Useful commands
  • Elasticsearch - Mapping, Fielddata and Templates
    • Useful commands
    • Create - Mapping / Fielddata
    • Create Template
    • Delete Mapping
    • Delete Template
  • AI Module API
    • Services
    • List rules
    • Show rules
    • Create rules
    • Update rules
    • Delete rules
  • Alert module API
    • Create Alert Rule
    • Save Alert Rules

• Logstash
  • Logstash - Input “beats”
  • Logstash - Input “network”
  • Logstash - Filter “beats syslog”
  • Logstash Filter “network”
  • Logstash - Filter “geoip”
  • Logstash - Output to Elasticsearch
  • Logstash pluging for “naemon beat”
  • Logstash pluging for “perflog”
  • Enabling encryption
    • The Kafka installation
    • Enabling encryption in Kafka
    • Configuring Kafka Brokers
    • Configuring Kafka Clients

• Integrations
  • Setting up Naemon logs
    • Logstash
    • Elasticsearch
  • OP5 Monitor
  • Elasticsearch
  • Sending OP5 performance data to Elasticsearch node
    • Elasticsearch
    • Logstash
    • OP5 Monitor
    • Kibana
  • The Grafana instalation
  • The Beats configuration
    • Kibana API
  • Wazuh integration
    • Deploying Wazuh Server
    • Deploing Wazuh Agent
    • Filebeat configuration
  • BRO integration

• Troubleshooting
  • Recovery default base indexes

• Upgrades
  • Manual update of OP5 from version 6.1.1 to 6.1.2
    • Data node update
    • Client Node update
  • Upgrade the OP5 Log Analytics with RPM packets
    • Data node (every Elasticsearch installation) update
    • Client Node update (GUI)

• The Agents module.
  • Component modules
  • Table of configuration parameter for Agent software
  • Installing the agent software
  • The agent management
    • Creating a new configuration file
    • Editing configuration file

• Monitoring
  • Skimmer
  • Skimmer Installation
  • Skimmer service configuration
    • Skimmer GUI configuration
• CHANGELOG
  • Version 6.1.6
    • Added
    • CHANGED
  • Version 6.1.5
    • CHANGED
  • Version 6.1.3
    • Added
    • CHANGED
  • Version 6.1.2
    • Added
    • CHANGED
  • Version 6.1.1
    • Added
    • CHANGED
  • Version 6.1.0
    • CHANGED
  • Version 6.0.2
    • Added
    • CHANGED
  • Version 6.0.1
    • Added