Elasticsearch facilitates queries within the user's database. User can use these observable type: hash, domain, file, filename, fqdn, gimphash, IP, mail, mail_subject, regexp, registry, telfhash, tlsh, uri_path, URL, and user-agent values.

Description

Configure and submit the field you want to search for in your database. Ex: domain, hash, IP, or URL

Requirement

An API key or User Credentials is necessary for utilizing Elasticsearch.

Configuration Requirements

In SOC, navigate to Administration, toggle Show all configurable settings, including advanced settings., and navigate to sensoroni -> analyzers -> elasticsearch.

The following configuration options are available for:

api_key - API key used for communication with the Elasticsearch API (Optional if auth_user and auth_pwd are used)

auth_user - Username used for communication with Elasticsearch

auth_pwd - Password used for communication with Elasticsearch

base_url - URL that connect to Elasticsearch VM on port 9200. Example format :"https://:9200

index - The index of the data in Elasticsearch database. Default value is _all.

num_results - The max number of results will be displayed. Default value is 10.

time_delta_minutes - Range of time the users want the data in minutes. The value is in minutes and will be converted to days. Defaults value is is 1440.

timestamp_field_name - The name of your timestamp field name. Default value is @timestamp.

map - This is the dictionary of the field name in the user's Elasticsearch database. Example value {"hash":"userhashfieldname"}. This value will map the Security Onion hash field name to user hash field name.

cert_path - This is the path to the certificate in the host for authentication purpose (Required)

This value should be set in the sensoroni pillar, like so:

sensoroni:
  analyzers:
    elasticsearch:
      base_url:$yourbase_url
      api_key: $yourapi_key
      numResults:$yournum_results
      auth_user:$yourauth_user
      auth_pwd:$yourauth_pwd
      index:$yourindex
      timeDeltaMinutes:$yourtime_delta_minutes
      timestampFieldName:$yourtimestamp_field_name
      cert_path:$yourcert_path
      map:$yourmap