HIDS-Wazuh与Elkide的部署与搭建

ElkeidElkeidElkeid 是字节开源的主机入侵检测系统通过在主机部署 Agent 采集内核与系统行为数据并实时分析实现安全检测、告警与集中管控。Elkeid 后端会涉及数据存储、检索和可视化组件功能上类似安全数据采集、分析、展示的一体化平台搭建服务端安装docker 一键搭建:环境准备bash (curl -sSL https://xuanyuan.cloud/docker.sh)如果一键脚本安装Docker Compose阶段长时间无响应可以中断后手动安装Docker Compose插件。验证dockerdocker -v自己安装docker compose创建目录mkdir -p /usr/libexec/docker/cli-plugins下载docker composecurl -L https://gh.xmly.dev/https://github.com/docker/compose/releases/download/v2.27.0/docker-compose-linux-x86_64 -o /usr/libexec/docker/cli-plugins/docker-compose执行权限chmod x /usr/libexec/docker/cli-plugins/docker-compose验证安装docker compose version换docker镜像源yum install git -y git clone https://github.com/hzhsec/docker_proxy.git cd docker_proxy.sh chmod x ./*.sh ./docker_yuan.sh安装Elkeid开始安装elkeid创建工作目录mkdir -p /opt/elkeid cd /opt/elkeid下载压缩包wget https://gh.xmly.dev/https://github.com/bytedance/Elkeid/releases/download/v1.9.1.4/elkeidup_image_v1.9.1.tar.gz.00 wget https://gh.xmly.dev/https://github.com/bytedance/Elkeid/releases/download/v1.9.1.4/elkeidup_image_v1.9.1.tar.gz.01 wget https://gh.xmly.dev/https://github.com/bytedance/Elkeid/releases/download/v1.9.1.4/elkeidup_image_v1.9.1.tar.gz.02 wget https://gh.xmly.dev/https://github.com/bytedance/Elkeid/releases/download/v1.9.1.4/elkeidup_image_v1.9.1.tar.gz.03合成并加载cat elkeidup_image_v1.9.1.tar.gz.* elkeidup_image_v1.9.1.tar.gz docker load -i elkeidup_image_v1.9.1.tar.gz启动容器docker run -d --name elkeid_community \ --restartunless-stopped \ -v /sys/fs/cgroup:/sys/fs/cgroup:ro \ -p 8071:8071 -p 8072:8072 -p 8080:8080 \ -p 8081:8081 -p 8082:8082 -p 8089:8080 -p 8090:8090 \ --privileged \ elkeid/all-in-one:v1.9.1进入容器docker exec -it elkeid_community bash执行初始化操作cd /root/.elkeidup/ ./elkeidup public ip(自己的公网ip) ./elkeidup agent init ./elkeidup agent build ./elkeidup agent policy create查看密码cat ~/.elkeidup/elkeid_passwdelkeid_consoleconsole 地址和账号密码elkeid_hub_frontendhub 前端地址和账号密码grafanagrafana 地址和账号密码elkeid_service_discovery服务发现地址。访问后台地址http://ip:8082账号密码:root7rkm95s09kl23o85diZP服务端安装成功客户端安装服务端点击系统管理-安装配置-复制安装命令客户端执行复制命令bash -c if (command -v curl); then (curl -sS http://139.9.34.127:8080/agent/install.sh | bash);else (wget -q -O - http://139.9.34.127:8080/agent/install.sh | bash); fi查看服务状态systemctl status elkeid-agent等待上线,可能要久一点如果没有上线检查刚刚填的是不是自己主机的公网ip检查是否开了防火墙检查service端的安全组的是否阻断了服务使用ELK端口说明组件端口作用Elasticsearch9200HTTP API查询数据Elasticsearch9300集群通信一般不用管Kibana5601Web界面Logstash5044Beats输入Filebeat常用Logstash9600监控接口资产中心