Skip to content

Commit eb9119a

Browse files
jmikell821jmikell821
committed
Adding test branch and files. CI checks will fail.
1 parent 27aabd1 commit eb9119a

File tree

2 files changed

+366
-0
lines changed

2 files changed

+366
-0
lines changed

‎docs/test-acrolinx/add-data-from-splunk-obs.md

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Add data from Splunk [splunk-get-started]
2+
3+
::::{warning}
4+
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
5+
::::
6+
7+
8+
Apache, AWS CloudTrail, Nginx, and Zeek integrations offer the ability to seamlessly ingest data from a Splunk Enterprise instance. Data will be automatically mapped to the Elastic Common Schema, making it available for rapid analysis in Elastic solutions, including Security and {{observability}}.
9+
10+
These integrations work by using the `httpjson` input in {{agent}} to run a Splunk search via the Splunk REST API and then extract the raw event from the results. The raw event is then processed via the {{agent}}. The Splunk search is customizable and the interval between searches is customizable. These integrations only get new data since the last query, not historical data.
11+
12+
:::{image} ../../../images/observability-elastic-agent-splunk.png
13+
:alt: Splunk integration components
14+
:screenshot:
15+
:::
16+
17+
To ingest Nginx data from Splunk, perform the following steps. The options are the same for Apache, AWS CloudTrail, and Zeek.
18+
19+
20+
## Prerequisites [splunk-prereqs]
21+
22+
To follow the steps in this guide, you need an {{stack}} deployment that includes:
23+
24+
* {{es}} for storing and searching data
25+
* {{kib}} for visualizing and managing data
26+
* Kibana user with `All` privileges on {{fleet}} and Integrations. Since many Integrations assets are shared across spaces, users need the Kibana privileges in all spaces.
27+
* Integrations Server (included by default in every {{ech}} deployment)
28+
29+
To get started quickly, create an {{ech}} deployment and host it on AWS, GCP, or Azure. [Try it out for free](https://cloud.elastic.co/registration?page=docs&placement=docs-body).
30+
31+
32+
## Step 1: Add integration [splunk-step-one]
33+
34+
Find **Integrations** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Search for and add the nginx integration. Refer to [Get started with system metrics](../infra-and-hosts/get-started-with-system-metrics.md) for detailed steps about adding integrations.
35+
36+
37+
## Step 2: Enable Collect logs from third-party REST API [splunk-step-two]
38+
39+
Enable "Collect logs from third-party REST API" and disable both "Collect logs from Nginx instances" and "Collect metrics from Nginx instances".
40+
41+
:::{image} ../../../images/observability-kibana-fleet-third-party-rest-api.png
42+
:alt: {{fleet}} showing enabling third-party REST API
43+
:screenshot:
44+
:::
45+
46+
47+
## Step 3: Enter connection information [splunk-step-three]
48+
49+
Enter the required information to connect to the Splunk Enterprise REST API.
50+
51+
The URL of the Splunk Enterprise Server must include the scheme (`http` or `https`), the IP address or hostname of the Splunk Enterprise Server, and the port the REST API is listening on.
52+
53+
The Splunk username and password must be of a user with a role or capability to use REST API endpoints. Administrative users have these permissions by default.
54+
55+
SSL Configuration is available under the "Advanced options". These may be necessary if Splunk Enterprise server uses self-signed certificates. See [SSL Options](beats://reference/filebeat/configuration-ssl.md) for valid configuration options.
56+
57+
:::{image} ../../../images/observability-kibana-fleet-third-party-rest-settings.png
58+
:alt: {{fleet}} showing enabling third-party REST API settings
59+
:screenshot:
60+
:::
61+
62+
63+
## Step 4: Enter information to select data from Splunk [splunk-step-four]
64+
65+
For each type of log file, enter the interval and Splunk search string.
66+
67+
The interval is expressed as a [Go duration](https://golang.org/pkg/time/#ParseDuration). The interval is the time between requests sent to the Splunk Enterprise REST API to request new information. Intervals less than one second are not recommended; Splunk only maintains second accuracy for index time. The interval should closely match the rate at which data arrives at the Splunk Enterprise Server. For example, an interval of "5s" for data that only arrives at the Splunk Enterprise Server every hour will generate unnecessary load on the Splunk Enterprise Server.
68+
69+
The search string is the Splunk search used to uniquely describe the events that match the type of log file you are trying to configure. For example, to uniquely describe Nginx access logs `search sourcetype=nginx:plus:access` might be used. Note, the search string must begin with "search" for details refer to the Splunk REST API manual and the "search/jobs/export" endpoint.
70+
71+
Be aware that each time the {{agent}} connects to the Splunk Enterprise REST API a Splunk search is performed. Because of this you want to be sure your search string is as specific as possible, since this reduces the load on the Splunk Enterprise Server.
72+
73+
Tags may be added in the "Advanced options". For example, if you’d like to tag events coming from Splunk with a *Splunk* tag, you can add it here. By default, the forward tag is present to indicate that events are being forwarded via an intermediary, i.e. Splunk.
74+
75+
:::{image} ../../../images/observability-kibana-fleet-third-party-rest-dataset-settings.png
76+
:alt: {{fleet}} showing enabling third-party REST API settings
77+
:screenshot:
78+
:::
79+
80+
81+
## Step 5: Save Integration [splunk-step-five]
82+
83+
Click Save Integration
84+
85+
Data and Dashboards will be available just as if you had collected the data on the Nginx host using log files.
86+
87+
88+
### Considerations and questions [splunk-considerations]
89+
90+
The time on the host running the agent and the Splunk Enterprise Server should be synchronized to the same time source, with correct timezone information. Failure to do this could result in delays in transferring data or gaps in the data received.
91+
92+
**Does the Splunk data need to be in a specific format or mapped to Splunk’s Common Information Model?** No, because these integrations take the raw event from Splunk and process that. There is no dependency on any Splunk processing.
93+
94+
**Are events mapped to Elastic Common Schema (ECS)?** Yes, events from these integrations go through the exact same processing as if {{agent}} had gotten the event from the original source. So the same level of mapping to ECS occurs.

‎docs/test-acrolinx/get-started-security.md

+272
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,272 @@
1+
# Elastic Security UI
2+
3+
% Note: This file is in a test folder and will _not_ pass any CI checks because none of the links are correct.
4+
5+
The {{security-app}} is a highly interactive workspace designed for security analysts that provides a clear overview of events and alerts from your environment. You can use the interactive UI to drill down into areas of interest.
6+
7+
8+
## Search [search-overview]
9+
10+
Filter for alerts, events, processes, and other important security data by entering [{{kib}} Query Language (KQL)](/explore-analyze/query-filter/languages/kql.md) queries in the search bar, which appears at the top of each page throughout the app. A date/time filter set to `Today` is enabled by default, but can be changed to any time range.
11+
12+
13+
* To refine your search results, select **Add Filter** (![Add filter icon](../../../images/security-add-filter-icon.png "title =20x20")), then enter the field, operator (such as `is not` or `is between`), and value for your filter.
14+
* To save the current KQL query and any applied filters, select **Saved query menu** (![Saved query menu icon](../../../images/security-saved-query-menu-icon.png "title =20x20")), enter a name for the saved query, and select **Save saved query**.
15+
16+
17+
## Navigation menu [navigation-menu-overview]
18+
19+
The navigation menu contains direct links and expandable groups, identified by the group icon (![Group icon](../../../images/security-group-icon.png "title =20x20")).
20+
21+
* Click a top-level link to go directly to its landing page, which contains links and information for related pages.
22+
* Click a group’s icon (![Group icon](../../../images/security-group-icon.png "title =20x20")) to open its flyout menu, which displays links to related pages within that group. Click a link in the flyout to navigate to its landing page.
23+
* Click the **Collapse side navigation** icon (![Side menu collapse icon](../../../images/security-side-button.png "title =20x20")) to collapse and expand the main navigation menu.
24+
25+
26+
## Visualization actions [visualization-actions]
27+
28+
Many {{elastic-sec}} histograms, graphs, and tables display an **Inspect** button (![Inspect icon](../../../images/security-inspect-icon.png "title =20x20")) when you hover over them. Click to examine the {{es}} queries used to retrieve data throughout the app.
29+
30+
:::{image} ../../../images/security-inspect-icon-context.png
31+
:alt: Inspect icon
32+
:width: 400px
33+
:screenshot:
34+
:::
35+
36+
Other visualizations display an options menu (![Three-dot menu icon](../../../images/security-three-dot-icon.png "title =20x20")), which allows you to inspect the visualization’s queries, add it to a new or existing case, or open it in Lens for customization.
37+
38+
39+
## Inline actions for fields and values [inline-actions]
40+
41+
Throughout the {{security-app}}, you can hover over many data fields and values to display inline actions, which allow you to customize your view or investigate further based on that field or value.
42+
43+
:::{image} ../../../images/security-inline-actions-menu.png
44+
:alt: Inline additional actions menu
45+
:width: 500px
46+
:screenshot:
47+
:::
48+
49+
In some visualizations, these actions are available in the legend by clicking a value’s options icon (![Vertical three-dot icon](../../../images/security-three-dot-icon-vertical.png "title =20x20")).
50+
51+
:::{image} ../../../images/security-inline-actions-legend.png
52+
:alt: Actions in a visualization legend
53+
:width: 650px
54+
:screenshot:
55+
:::
56+
57+
Inline actions include the following (some actions are unavailable in some contexts):
58+
59+
* **Filter In**: Add a filter that includes the selected value.
60+
* **Filter Out**: Add a filter that excludes the selected value.
61+
* **Add to timeline**: Add a filter to Timeline for the selected value.
62+
* **Toggle column in table**: Add or remove the selected field as a column in the alerts or events table. (This action is only available on an alert’s or event’s details flyout.)
63+
* **Show top *x***: Display a pop-up window that shows the selected field’s top events or detection alerts.
64+
* **Copy to Clipboard**: Copy the selected field-value pair to paste elsewhere.
65+
66+
67+
## {{security-app}} pages [_security_app_pages]
68+
69+
The {{security-app}} contains the following pages that enable analysts to view, analyze, and manage security data.
70+
71+
### Discover [security-ui-discover]
72+
73+
Use the [Discover](/explore-analyze/discover.md) UI to filter your data or learn about its structure.
74+
75+
76+
### Dashboards [_dashboards]
77+
78+
Expand this section to access the following dashboards, which provide interactive visualizations that summarize your data:
79+
80+
- Overview
81+
- Detection & Response
82+
- Kubernetes (in {{stack}})
83+
- Cloud Security Posture
84+
- Cloud Native Vulnerability Management
85+
- Entity Analytics
86+
- Data Quality.
87+
88+
You can also create and view custom dashboards. Refer to [Dashboards](/solutions/security/dashboards.md) for more information.
89+
90+
91+
### Rules [_rules]
92+
93+
Expand this section to access the following pages:
94+
95+
* [Rules](/solutions/security/detect-and-alert/manage-detection-rules.md): Create and manage rules to monitor suspicious events.
96+
97+
* [Benchmarks](/solutions/security/cloud/benchmarks.md): View, set up, or configure cloud security benchmarks.
98+
99+
* [Shared Exception Lists](/solutions/security/detect-and-alert/rule-exceptions.md#shared-exception-list-intro): View and manage rule exceptions and shared exception lists.
100+
101+
* [MITRE ATT&CK® coverage](/solutions/security/detect-and-alert/mitre-attandckr-coverage.md): Review your coverage of MITRE ATT&CK® tactics and techniques, based on installed rules.
102+
103+
104+
### Alerts [_alerts]
105+
106+
View and manage alerts to monitor activity within your network. Refer to [Detections and alerts](/solutions/security/detect-and-alert.md) for more information.
107+
108+
109+
### Findings [_findings]
110+
111+
Identify misconfigurations and vulnerabilities in your cloud infrastructure. For setup instructions, refer to [Cloud Security Posture Management](/solutions/security/cloud/cloud-security-posture-management.md), [Kubernetes Security Posture Management](/solutions/security/cloud/kubernetes-security-posture-management.md), or [Cloud Native Vulnerability Management](/solutions/security/cloud/cloud-native-vulnerability-management.md).
112+
113+
114+
### Cases [_cases]
115+
116+
Open and track security issues. Refer to [Cases](/solutions/security/investigate/cases.md) to learn more.
117+
118+
119+
### Investigations [security-ui-investigations]
120+
121+
Expand this section to access the following pages:
122+
123+
* [Timelines](../investigate/timeline.md): Investigate alerts and complex threats — such as lateral movement — in your network. Timelines are interactive and allow you to share your findings with other team members.
124+
125+
::::{tip}
126+
Click the **Timeline** button at the bottom of the {{security-app}} to start an investigation.
127+
128+
::::
129+
130+
* [Osquery](../investigate/osquery.md): Deploy Osquery with {{agent}}, then run and schedule queries.
131+
132+
133+
### Intelligence [_intelligence]
134+
135+
The Intelligence section contains the Indicators page, which collects data from enabled threat intelligence feeds and provides a centralized view of indicators of compromise (IoCs). Refer to [Indicators of compromise](/troubleshoot/security/indicators-of-compromise.md) to learn more.
136+
137+
138+
### Explore [_explore]
139+
140+
Expand this section to access the following pages:
141+
142+
* [Hosts](/solutions/security/explore/hosts-page.md): Examine key metrics for host-related security events using graphs, charts, and interactive data tables.
143+
144+
* [Network](/solutions/security/explore/network-page.md): Explore the interactive map to discover key network activity metrics and investigate network events further in Timeline.
145+
146+
* [Users](/solutions/security/explore/users-page.md): Access a comprehensive overview of user data to help you understand authentication and user behavior within your environment.
147+
148+
149+
### Assets [security-ui-assets]
150+
151+
The Assets section allows you to manage the following features:
152+
153+
* [{{fleet}}](/reference/ingestion-tools/fleet/manage-elastic-agents-in-fleet.md)
154+
* [Endpoint protection](/solutions/security/manage-elastic-defend.md)
155+
156+
* [Endpoints](/solutions/security/manage-elastic-defend/endpoints.md): View and manage hosts running {{elastic-defend}}.
157+
* [Policies](/solutions/security/manage-elastic-defend/policies.md): View and manage {{elastic-defend}} integration policies.
158+
* [Trusted applications](/solutions/security/manage-elastic-defend/trusted-applications.md): View and manage trusted Windows, macOS, and Linux applications.
159+
* [Event filters](/solutions/security/manage-elastic-defend/event-filters.md): View and manage event filters, which allow you to filter endpoint events you don’t need to want stored in {{es}}.
160+
* [Host isolation exceptions](/solutions/security/manage-elastic-defend/host-isolation-exceptions.md): View and manage host isolation exceptions, which specify IP addresses that can communicate with your hosts even when those hosts are blocked from your network.
161+
* [Blocklist](/solutions/security/manage-elastic-defend/blocklist.md): View and manage the blocklist, which allows you to prevent specified applications from running on hosts, extending the list of processes that {{elastic-defend}} considers malicious.
162+
* [Response actions history](/solutions/security/endpoint-response-actions/response-actions-history.md): Find the history of response actions performed on hosts.
163+
164+
* [Cloud security](/solutions/security/cloud.md)
165+
166+
### {{ml-cap}} [security-ui-ml-cap]
167+
168+
Manage {{ml}} jobs and settings. Refer to [{{ml-cap}} docs](/explore-analyze/machine-learning/anomaly-detection.md) for more information.
169+
170+
### Get started [_get_started]
171+
172+
Quickly add security integrations that can ingest data and monitor your hosts.
173+
174+
### Developer tools [security-ui-dev-tools]
175+
176+
Use additional API and analysis tools to interact with your data.
177+
178+
179+
### Management [_manage]
180+
```yaml {applies_to}
181+
stack: all
182+
```
183+
184+
Expand this section to access and manage:
185+
- Additional security features
186+
- [Stack monitoring](/deploy-manage/monitor/stack-monitoring.md)
187+
- [{{integrations}}](/reference/ingestion-tools/fleet/manage-integrations.md)
188+
189+
### Project Settings
190+
```yaml {applies_to}
191+
serverless: all
192+
```
193+
194+
Expand this section to access and manage:
195+
- Additional security features
196+
- [{{integrations}}](/reference/ingestion-tools/fleet/manage-integrations.md)
197+
- [Billing](/deploy-manage/cloud-organization/billing/serverless-project-billing-dimensions.md) and [subscription](/deploy-manage/cloud-organization/billing/manage-subscription.md) options for your {{serverless-short}} project
198+
199+
200+
## Accessibility features [timeline-accessibility-features]
201+
202+
Accessibility features, such as keyboard focus and screen reader support, are built into the Elastic Security UI. These features offer additional ways to navigate the UI and interact with the application.
203+
204+
205+
### Interact with draggable elements [draggable-timeline-elements]
206+
207+
Use your keyboard to interact with draggable elements in the Elastic Security UI:
208+
209+
* Press the `Tab` key to apply keyboard focus to an element within a table. Or, use your mouse to click on an element and apply keyboard focus to it.
210+
211+
:::{image} ../../../images/security-timeline-accessiblity-keyboard-focus.gif
212+
:alt: timeline accessiblity keyboard focus
213+
:width: 650px
214+
:screenshot:
215+
:::
216+
217+
* Press `Enter` on an element with keyboard focus to display its menu and press `Tab` to apply focus sequentially to menu options. The `f`, `o`, `a`, `t`, `c` hotkeys are automatically enabled during this process and offer an alternative way to interact with menu options.
218+
219+
:::{image} ../../../images/security-timeline-accessiblity-keyboard-focus-hotkeys.gif
220+
:alt: timeline accessiblity keyboard focus hotkeys
221+
:width: 500px
222+
:screenshot:
223+
:::
224+
225+
* Press the spacebar once to begin dragging an element to a different location and press it a second time to drop it. Use the directional arrows to move the element around the UI.
226+
227+
:::{image} ../../../images/security-timeline-ui-accessiblity-drag-n-drop.gif
228+
:alt: timeline ui accessiblity drag n drop
229+
:screenshot:
230+
:::
231+
232+
* If an event has an event renderer, press the `Shift` key and the down directional arrow to apply keyboard focus to the event renderer and `Tab` or `Shift` + `Tab` to navigate between fields. To return to the cells in the current row, press the up directional arrow. To move to the next row, press the down directional arrow.
233+
234+
:::{image} ../../../images/security-timeline-accessiblity-event-renderers.gif
235+
:alt: timeline accessiblity event renderers
236+
:screenshot:
237+
:::
238+
239+
240+
### Navigate the Elastic Security UI [timeline-tab]
241+
242+
Use your keyboard to navigate through rows, columns, and menu options in the Elastic Security UI:
243+
244+
* Use the directional arrows to move keyboard focus right, left, up, and down in a table.
245+
246+
:::{image} ../../../images/security-timeline-accessiblity-directional-arrows.gif
247+
:alt: timeline accessiblity directional arrows
248+
:width: 500px
249+
:screenshot:
250+
:::
251+
252+
* Press the `Tab` key to navigate through a table cell with multiple elements, such as buttons, field names, and menus. Pressing the `Tab` key will sequentially apply keyboard focus to each element in the table cell.
253+
254+
:::{image} ../../../images/security-timeline-accessiblity-tab-keys.gif
255+
:alt: timeline accessiblity tab keys
256+
:width: 400px
257+
:screenshot:
258+
:::
259+
260+
* Use `CTRL + Home` to shift keyboard focus to the first cell in a row. Likewise, use `CTRL + End` to move keyboard focus to the last cell in the row.
261+
262+
:::{image} ../../../images/security-timeline-accessiblity-shifting-keyboard-focus.gif
263+
:alt: timeline accessiblity shifting keyboard focus
264+
:screenshot:
265+
:::
266+
267+
* Use the `Page Up` and `Page Down` keys to scroll through the page.
268+
269+
:::{image} ../../../images/security-timeline-accessiblity-page-up-n-down.gif
270+
:alt: timeline accessiblity page up n down
271+
:screenshot:
272+
:::

0 commit comments

Comments
 (0)