thomaspatzke/elk-detection-lab

An ELK environment containing interesting security datasets.

elk-detection-lab's Issues

More pcap from malware-traffic-analysis.net

Hi,

can you describe the workflow for ingesting more pcaps from malware-traffic-analysis.net . Is that automatized in any way?
thanks

How can i update the used repositories (Morodor and EVTX) ?

Couldn't find any Elasticsearch data

Hi
After I followed all the steps to load up ELK-detection-lab and finally I can connect to kibana from web browser but no data found and I got "Couldn't find any Elasticsearch data"

Installing on Windows with Docker (WSL2 backend)

Hey,
I'm trying to install the lab on my Windows machine but getting these errors on the loader and filebit containers:

Loader:

standard_init_linux.go:211: exec user process caused "no such file or directory"

Filebit:

2020-07-17T19:52:58.401Z INFO [monitoring] log/log.go:154 Uptime: 49.8493ms

2020-07-17T19:52:58.401Z INFO [monitoring] log/log.go:131 Stopping metrics logging.

2020-07-17T19:52:58.401Z INFO instance/beat.go:445 filebeat stopped.

2020-07-17T19:52:58.402Z ERROR instance/beat.go:933 Exiting: 1 error: invalid config: config file ("/usr/share/filebeat/modules.d/suricata.yml") can only be writable by the owner but the permissions are "-rwxrwxrwx" (to fix the permissions use: 'chmod go-w /usr/share/filebeat/modules.d/suricata.yml')

Exiting: 1 error: invalid config: config file ("/usr/share/filebeat/modules.d/suricata.yml") can only be writable by the owner but the permissions are "-rwxrwxrwx" (to fix the permissions use: 'chmod go-w /usr/share/filebeat/modules.d/suricata.yml')

Do you have any clue how to fix it?