Cyber Security: Installation

Contents

• Installation Sequence
  • Step 1. Preparing the Scheduler Index
  • Step 2. Importing the Content Module
  • Step 3. Deploying Objects with the Installation Utility
  • Step 4. Post-Installation Verification
• Updating the Module

---

Important

All correlation rules are supplied disabled, including after a reinstall or module update. See Rule Enablement Order.

---

Installation Sequence

Step 1. Preparing the Scheduler Index

The module rules have many fields. Before importing the content module, increase the field limit of the Job Scheduler index; otherwise, some rules will not install.

Run the following command from the cyber_security_ko_maker installation utility directory.

python3 bin/apply_incident_manager_settings.py \
  --host <SMART_MONITOR_HOST>:<PORT> \
  --user <SMART_MONITOR_USER> \
  --password '<SMART_MONITOR_PASSWORD>' \
  --prepare-index

The default limit is 2,000 fields. Set a different value with --jsc-field-limit.

Step 2. Importing the Content Module

Import Cyber_Security.zip under Main Menu - Settings - Module Settings - Content Management. See Content Management for the import procedure.

Step 3. Deploying Objects with the Installation Utility

The content module creates the initial <источник>-000001 indexes. The cyber_security_ko_maker installation utility creates the remaining objects required for data collection and incidents.

Object	Purpose
Index templates	Mappings and settings for indexes created during rollover
Write aliases	Smart Monitor Data Collector writes to the <источник> alias; after rollover, writes switch to the next index
Index patterns	Group all source indexes for search and dashboards
Security Incident incident type	Incident card fields and investigation playbook. The utility assigns this type to all module rules

Important

Deploy these objects before enabling data collection. If events arrive before the write alias exists, an index named after the alias (for example, auditd) is created, preventing the alias from being created.

Requirements

• Python 3.8 or later
• a Smart Monitor administrator account

Running the Utility

python3 bin/make_cyber_security.py \
  --host <SMART_MONITOR_HOST>:<PORT> \
  --user <SMART_MONITOR_USER> \
  --password '<SMART_MONITOR_PASSWORD>'

Example

python3 bin/make_cyber_security.py --host sm-host.my_company.ru:5601 --user admin --password 'securepassword'

Parameter	Description
--host	Smart Monitor Web host and port
--user, --password	Administrator account
--force-templates	Overwrite templates that differ from the supplied versions

Step 4. Post-Installation Verification

4.1. Verifying Rules

1. Go to Main Menu - Job Scheduler - Jobs List
2. Filter jobs by the Cyber Security module tag
3. Verify that the module rules are listed

4.2. Verifying Lookups

1. Go to Main Menu - Lookup Manager - Lookup List
2. Filter lookups by the Cyber Security module tag
3. Verify that the module lookups are listed

4.3. Verifying Indexes and ISM Policies

1. Go to Main Menu - Settings - Index Management - Indexes
2. Enter the initial module index names separated by spaces, for example windows_security-000001 auditd-000001 nginx_log_access-000001
3. Verify that nine initial indexes of the form <источник>-000001 exist and that Managed by Policy is set to Yes for each one

You can run the same check in the Dev Tools console. The second command shows the index's ISM policy, which must be named <источник>_policy.

GET _cat/indices/windows_*,auditd-*,nginx_log_access-*,kubernetes_audit-*,microsoft-iis-*,dns-events-*?v
GET _plugins/_ism/explain/windows_security-000001

4.4. Verifying Index Templates

1. Go to Main Menu - Settings - Index Management - Templates
2. Search for templates by source name, for example windows_ or auditd
3. Verify that each of the nine sources has a <источник>_template template with the <источник>-* index pattern

You can check all module templates with one command in the Dev Tools console. The response must contain nine templates.

GET _index_template/windows_security_template,windows_sysmon_operational_template,windows_powershell_operational_template,windows_events_template,dns-events_template,microsoft-iis_template,auditd_template,nginx_log_access_template,kubernetes_audit_template

4.5. Verifying Write Aliases

1. Go to Main Menu - Settings - Index Management - Aliases
2. Search for aliases by source name, for example windows_
3. Verify that the nine aliases listed below exist and that each has a <источник>-00000N index in the Write Index column

Alias	Initial Index
windows_security	windows_security-000001
windows_sysmon_operational	windows_sysmon_operational-000001
windows_powershell_operational	windows_powershell_operational-000001
windows_events	windows_events-000001
dns-events	dns-events-000001
microsoft-iis	microsoft-iis-000001
auditd	auditd-000001
nginx_log_access	nginx_log_access-000001
kubernetes_audit	kubernetes_audit-000001

Use the following command in the Dev Tools console to verify the aliases. Each alias must show true in the is_write_index column.

GET _cat/aliases/windows_security,windows_sysmon_operational,windows_powershell_operational,windows_events,dns-events,microsoft-iis,auditd,nginx_log_access,kubernetes_audit?v

4.6. Verifying Index Patterns

1. Go to Main Menu - Settings - Module Settings - OpenSearch - Index Patterns
2. Enter (windows_ or dns-events or microsoft-iis or auditd or nginx_log_access or kubernetes_audit) in the search box
3. Verify that the list contains nine <источник>-* patterns

4.7. Verifying the Incident Type

1. Go to Main Menu - Settings - Module Settings - Incident Manager - Incident Types
2. Verify that the Security Incident type is listed

4.8. Verifying the Incident Type Assigned to Rules

1. Open any module rule under Main Menu - Job Scheduler - Jobs List
2. Verify that Security Incident is selected in the Incident Type field

4.9. Verifying Dashboards

1. Go to Main Menu - Home - Dashboards
2. Search for dashboards using the Cyber Security tag
3. Verify that the dashboards are installed and open without errors

The dashboards are described in Dashboards.

---

Updating the Module

Update the module in the same way as installing it: import a new archive under Content Management.

• when importing an update, select only rules and lookups that are not yet in the system. Reimporting installed objects resets tuned rules to their original state and removes data entered into lookups
• if a rule has been tuned for your infrastructure and is marked modified during update import, apply the update's changes to the rule manually
• after the update, the rules are disabled again. Enable them as described in Rule Enablement Order