{"id":6434,"date":"2020-04-30T17:12:55","date_gmt":"2020-04-30T14:12:55","guid":{"rendered":"https:\/\/kifarunix.com\/?p=6434"},"modified":"2024-03-14T20:02:26","modified_gmt":"2024-03-14T17:02:26","slug":"process-and-visualize-modsecurity-logs-on-elk-stack","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/process-and-visualize-modsecurity-logs-on-elk-stack\/","title":{"rendered":"Process and Visualize ModSecurity Logs on ELK Stack"},"content":{"rendered":"\n

In this tutorial, you will learn how to process and visualize ModSecurity Logs on ELK Stack. ModSecurity<\/a> is an open source, cross-platform web application firewall (WAF) module developed by Trustwave\u2019s SpiderLabs. Known as the \u201cSwiss Army Knife\u201d of WAFs, it enables web application defenders to gain visibility into HTTP(S) traffic and provides a power rules language and API to implement advanced protections.<\/p>\n\n\n\n

ModSecurity utilizes the OWASP Core Rule Set which can be used to protect web applications against various attacks including the top 10 OWASP such as SQL Injection, Cross Site Scripting, Local File Inclusion, etc.<\/p>\n\n\n\n

OWASP, has recently, in their report, OWASP Top 10 2017<\/a>, included Insufficient Logging and Monitoring<\/a> as one of the top 10 web application security risks. <\/p>\n\n\n\n

“Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring<\/em>“.<\/p>\n\n\n\n

ELK\/Elastic Stack on the other hand is powerful platform that collects and processes data from multiple data sources, stores that data in a search and analytic engine that enables users to visualize using charts, tables, graphs.<\/p>\n\n\n\n

Process ModSecurity Logs for Visualizing on ELK Stack<\/h2>\n\n\n\n

Therefore, as a way of ensuring logging and monitoring of web application logs, we are going to learn how you can process and visualize ModSecurity WAF logs on ELK\/Elastic Stack.<\/p>\n\n\n\n

Prerequisites<\/h2>\n\n\n\n

Install and Setup ELK\/Elastic Stack<\/h3>\n\n\n\n

Ensure that you have an ELK stack setup before you can proceed. You can follow the links below to install and setup ELK\/Elastic stack on Linux;<\/p>\n\n\n\n

Install ELK Stack on Ubuntu 20.04<\/a><\/p>\n\n\n\n

Installing ELK Stack on CentOS 8<\/a><\/p>\n\n\n\n

Install and Setup ModSecurity on CentOS\/Ubuntu<\/h3>\n\n\n\n

Install and enable Web application protection with ModSecurity. You can check the guides below to install ModSecurity 3 (libModSecurity);<\/p>\n\n\n\n

Configure LibModsecurity with Apache on CentOS 8<\/a><\/p>\n\n\n\n

Configure LibModsecurity with Nginx on CentOS 8<\/a><\/p>\n\n\n\n

Install LibModsecurity with Apache on Ubuntu 18.04<\/a><\/p>\n\n\n\n

Configure Logstash to Process ModSecurity Logs<\/a><\/h3>\n\n\n\n

Logstash<\/a> is a server-side data processing pipeline that ingests data from a multiple sources, transforms it, and then stashes it onto search and data analytics engines such as Elasticsearch.<\/p>\n\n\n\n

Logstash pipeline is made up of three sections;<\/p>\n\n\n\n