Kali Purple SOC

Kali Purple SOC: Part 3 – Installing and Configuring Elastic

Arion

Arion

— 3 min read
Kali Purple SOC: Part 3 – Installing and Configuring Elastic

Installing Elastic and Kibana

ℹ️
This will be done on the Kali Purple VM we set up in the previous post.

Install Elasticsearch Dependencies

sudo apt update && sudo apt upgrade -y

sudo apt-get install curl

curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/elastic-archive-keyring.gpg
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list

sudo bash -c "export HOSTNAME=192.168.253.6; apt-get install elasticsearch -y"

ℹ️
Take note of the Elastic password. 

Convert to a Single Node Setup

sudo sed -e '/cluster.initial_master_nodes/ s/^#*/#/' -i /etc/elasticsearch/elasticsearch.yml
echo "discovery.type: single-node" | sudo tee -a /etc/elasticsearch/elasticsearch.yml

Install Kibana

sudo apt install kibana -y

sudo /usr/share/kibana/bin/kibana-encryption-keys generate -q

ℹ️
Take note of these encryption keys. There should be:
xpack.encryptedSavedObjects.encryptionKey
xpack.reporting.encryptionKey
xpack.security.encryptionKey

Switch to root account and add keys to the kibana.yml file

sudo su -

nano /etc/kibana/kibana.yml

Add the keys here. Save then close. 

echo "server.host: \"192.168.253.6\"" | sudo tee -a /etc/kibana/kibana.yml

Edit /etc/hosts

nano /etc/hosts

Change this IP from 192.168.253.5 to 192.168.253.6 (if it's not already set to that)

sudo systemctl enable elasticsearch kibana --now

Generate an enrollment token

sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

ℹ️
Take note of the token. 

Open a web browser and go to http://192.168.253.6:5601

⚠️
If not accessible via IP, try changing /etc/kibana/kibana.yml server.host to 0.0.0.0

Paste the enrollment token.

Paste the enrollment token here.

Enter this into a Kali Purple VM terminal window:

sudo /usr/share/kibana/bin/kibana-verification-code

Enter the verification code into browser.

For the username and password, enter elastic as username and the Elastic password we noted earlier.

Click explore on my own

Enable HTTPS for Kibana

sudo /usr/share/elasticsearch/bin/elasticsearch-certutil ca

Enter a password.

sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --dns 192.168.253.6,elastic.kali.localdomain,kali-purple --out kibana-server.p12
sudo openssl pkcs12 -in /usr/share/elasticsearch/elastic-stack-ca.p12 -clcerts -nokeys -out /etc/kibana/kibana-server_ca.crt
sudo openssl pkcs12 -in /usr/share/elasticsearch/kibana-server.p12 -out /etc/kibana/kibana-server.crt -clcerts -nokeys
sudo openssl pkcs12 -in /usr/share/elasticsearch/kibana-server.p12 -out /etc/kibana/kibana-server.key -nocerts -nodes

sudo chown root:kibana /etc/kibana/kibana-server_ca.crt

sudo chown root:kibana /etc/kibana/kibana-server.key

sudo chown root:kibana /etc/kibana/kibana-server.crt

sudo chmod 660 /etc/kibana/kibana-server_ca.crt

sudo chmod 660 /etc/kibana/kibana-server.key

sudo chmod 660 /etc/kibana/kibana-server.crt

echo "server.ssl.enabled: true" | sudo tee -a /etc/kibana/kibana.yml

echo "server.ssl.certificate: /etc/kibana/kibana-server.crt" | sudo tee -a /etc/kibana/kibana.yml
echo "server.ssl.key: /etc/kibana/kibana-server.key" | sudo tee -a /etc/kibana/kibana.yml
echo "server.publicBaseUrl: \"https://192.168.253.6:5601\"" | sudo tee -a /etc/kibana/kibana.yml

sudo systemctl restart kibana

Login

Login at https://192.156.253.6:5601

Click the user icon in the top right hand corner.

Edit profile > change password

For the next step, we'll be looking at how to install Fleet Server!

Kali Purple SOC: Part 4

Read more