{"id":753,"date":"2023-02-22T10:21:00","date_gmt":"2023-02-22T10:21:00","guid":{"rendered":"https:\/\/dab.solutions\/?p=753"},"modified":"2024-04-06T21:16:31","modified_gmt":"2024-04-06T21:16:31","slug":"dhis2-siem-automation","status":"publish","type":"post","link":"https:\/\/dab.solutions\/es\/uncategorized\/dhis2-siem-automation\/","title":{"rendered":"Automatizaci\u00f3n SIEM DHIS2"},"content":{"rendered":"<p>Uno de los aspectos de una postura de seguridad madura es lo preparada que est\u00e1 la organizaci\u00f3n para detectar y responder a las ciberamenazas: debido a una combinaci\u00f3n de factores que hacen que los ciberataques sean m\u00e1s f\u00e1ciles de llevar a cabo y, por tanto, m\u00e1s comunes, construir el sistema para detectar con prontitud dichos ataques y responder adecuadamente se convierte cada vez m\u00e1s en una necesidad urgente y temprana.<\/p>\n\n\n<div class=\"text-content-inner\">\n<p>Por eso hemos creado un sistema autom\u00e1tico <strong>de gesti\u00f3n de eventos de informaci\u00f3n de seguridad<\/strong> (SIEM) system for DHIS2 on lxd server infrastructure in <a href=\"https:\/\/github.com\/davinerd\/dhis2-tools-dab\" target=\"_blank\" rel=\"noreferrer noopener\">dhis2-tools-dab<\/a>: mediante la introducci\u00f3n de las nuevas caracter\u00edsticas fue f\u00e1cil desarrollar un nuevo contenedor de tipo <em>es_siem<\/em>... aportando el poder de <a href=\"https:\/\/www.elastic.co\/\" target=\"_blank\" rel=\"noreferrer noopener\">ElasticSearch<\/a> en la plataforma.<\/p>\n<div class=\"text-content-inner\">\n<p>ElasticSearch ha sido una referencia en el espacio de recopilaci\u00f3n de registros durante un tiempo y su facilidad de instalaci\u00f3n y gesti\u00f3n, gracias tambi\u00e9n a la interfaz de usuario web llamada Kibana, hizo para nosotros la elecci\u00f3n por defecto para este sistema, adem\u00e1s de la conocida fiabilidad, flexibilidad y la gran comunidad detr\u00e1s del proyecto.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>Aunque ElasticSearch naci\u00f3 como una soluci\u00f3n de gesti\u00f3n de registros, est\u00e1 en la posici\u00f3n adecuada para ofrecer un buen sistema de alertas de seguridad, aunque algunas de sus mejores caracter\u00edsticas en este sentido vienen como una suscripci\u00f3n de pago (m\u00e1s sobre esto en la secci\u00f3n Limitaciones).<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>Dicho esto, una soluci\u00f3n SIEM debe proporcionar una creaci\u00f3n de reglas flexible, mecanismos de notificaci\u00f3n y alertas f\u00e1ciles de consultar, todas etas cosas que ElasticSearch hace bien, de forma gratuita.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p id=\"e9a9\">As\u00ed que vamos a sumergirnos en la configuraci\u00f3n y algunas primeras impresiones.<\/p>\n<div class=\"text-content-inner\">\n<p id=\"9981\">Esta configuraci\u00f3n se realiza gracias al <em>es_siem<\/em> tipo de contenedor introducido con dhis2-tools-dab.<\/p>\n<\/div><\/div><div class=\"text-content-inner\">\n<p id=\"fe1b\">Puede consultar la <em>es_siem<\/em> y <em>es_siem_postsetup<\/em> para saber m\u00e1s sobre c\u00f3mo est\u00e1 configurado el sistema y reproducirlo manualmente.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>La posdata se configura en cada contenedor <a href=\"https:\/\/manpages.ubuntu.com\/manpages\/xenial\/man8\/systemd-journald.service.8.html\" rel=\"noreferrer noopener\" target=\"_blank\">sistema journald<\/a>que centraliza los registros en un archivo que luego es analizado por la aplicaci\u00f3n <a href=\"https:\/\/www.elastic.co\/beats\/filebeat\" rel=\"noreferrer noopener\" target=\"_blank\">filebeat agen<\/a>t, que en \u00faltima instancia env\u00eda los datos a ElasticSearch para su almacenamiento y an\u00e1lisis ya en formato JSON.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>Para empezar, vamos a a\u00f1adir la entrada de tipo de contenedor en el archivo de configuraci\u00f3n de contenedores.<\/p>\n\n<pre class=\"wp-block-code\"><code>dab@battlechine:~$ sudo cat \/usr\/local\/etc\/dhis\/containers.json\n{\n  \"fqdn\":\"192.168.130.130\",\n  \"email\": \"davide@dab.solutions\",\n  \"environment\": {\n          \"TZ\": \"Europe\/Madrid\"\n  },\n  \"network\": \"192.168.0.1\/24\",\n  \"monitoring\": \"munin\",\n  \"apm\": \"glowroot\",\n  \"proxy\": \"nginx\",\n  \"containers\": &#91;\n    {\n      \"name\": \"proxy\",\n      \"ip\": \"192.168.0.2\",\n      \"type\": \"nginx_proxy\"\n    },\n    {\n      \"name\": \"postgres\",\n      \"ip\": \"192.168.0.20\",\n      \"type\": \"postgres\"\n    },\n    {\n     \"name\": \"siem\",\n     \"ip\": \"192.168.0.200\",\n     \"type\": \"es_siem\"\n    }\n  ]\n}<\/code><\/pre>\n<\/div><div class=\"text-content-inner\">\n<p>Como puede ver, se ha a\u00f1adido la nueva secci\u00f3n denominada \"siem\": al ejecutar <code>.\/create_containers.sh<\/code>se identifica y crea el nuevo contenedor que falta:<\/p>\n\n<pre class=\"wp-block-code\"><code>dab@battlechine:~\/dhis2-tools-ng-dab\/setup$ sudo .\/create_containers.sh\nSkipping adding existing rule\nSkipping adding existing rule (v6)\nSkipping adding existing rule\nSkipping adding existing rule (v6)\nReading package lists... Done\nBuilding dependency tree\nReading state information... Done\nauditd is already the newest version (1:2.8.5-2ubuntu6).\napache2-utils is already the newest version (2.4.41-4ubuntu3.13).\nunzip is already the newest version (6.0-25ubuntu1.1).\njq is already the newest version (1.6-1ubuntu0.20.04.1).\nThe following packages were automatically installed and are no longer required:\n  libfwupdplugin1 libpython2-dev libpython2-stdlib libpython2.7 libpython2.7-dev libpython2.7-minimal libpython2.7-stdlib python2 python2-dev python2-minimal python2.7\n  python2.7-dev python2.7-minimal\nUse 'sudo apt autoremove' to remove them.\n0 upgraded, 0 newly installed, 0 to remove and 34 not upgraded.\n&#91;2023-02-20 23:19:03] &#91;WARN] &#91;create_containers.sh] Container proxy already exist, skipping\n&#91;2023-02-20 23:19:03] &#91;WARN] &#91;create_containers.sh] Container postgres already exist, skipping\n&#91;2023-02-20 23:19:03] &#91;INFO] &#91;create_containers.sh] Creating siem of type es_siem (ubuntu 20.04)\nCreating siem\nwaiting for network\n&#91;2023-02-20 23:19:11] &#91;INFO] &#91;create_containers.sh] Running setup from containers\/es_siem\n\nWARNING: apt does not have a stable CLI interface. Use with caution in scripts.\n\n&#91;...]\n\n&#91;2023-02-20 23:23:08] &#91;INFO] &#91;create_containers.sh] Configuring Elasticsearch and Kibana\n&#91;2023-02-20 23:23:08] &#91;INFO] &#91;create_containers.sh] Waiting for Kibana to be up&amp;running (sleep 10s)\n&#91;2023-02-20 23:23:19] &#91;INFO] &#91;create_containers.sh] Waiting for Kibana to be up&amp;running (sleep 10s)\n&#91;2023-02-20 23:23:51] &#91;INFO] &#91;create_containers.sh] Configuring journal for 'postgres'\n&#91;2023-02-20 23:23:52] &#91;INFO] &#91;dhis2-set-journal] Configuring postgres to log to journal\n&#91;2023-02-20 23:23:52] &#91;INFO] &#91;create_containers.sh] Configuring filebeat for 'postgres'\n&#91;2023-02-20 23:23:53] &#91;INFO] &#91;dhis2-set-elasticsearch] Retrieving filebeat 8.4.1 (arm64)\n&#91;2023-02-20 23:23:53] &#91;INFO] &#91;dhis2-set-elasticsearch] Installing filebeat\nSelecting previously unselected package filebeat.\n(Reading database ... 38331 files and directories currently installed.)\nPreparing to unpack \/tmp\/filebeat.deb ...\nUnpacking filebeat (8.4.1) ...\nSetting up filebeat (8.4.1) ...\n&#91;2023-02-20 23:23:58] &#91;INFO] &#91;dhis2-set-elasticsearch] Configuring filebeat\nSynchronizing state of filebeat.service with SysV service script with \/lib\/systemd\/systemd-sysv-install.\nExecuting: \/lib\/systemd\/systemd-sysv-install enable filebeat\nCreated symlink \/etc\/systemd\/system\/multi-user.target.wants\/filebeat.service \u2192 \/lib\/systemd\/system\/filebeat.service.\n&#91;2023-02-20 23:24:01] &#91;INFO] &#91;dhis2-set-elasticsearch] Filebeat configured. All good\n&#91;2023-02-20 23:24:01] &#91;INFO] &#91;create_containers.sh] Configuring journal for 'proxy'\n&#91;2023-02-20 23:24:02] &#91;INFO] &#91;dhis2-set-journal] Configuring nginx to log to journal error logs and HTTP access logs\n&#91;2023-02-20 23:24:03] &#91;INFO] &#91;create_containers.sh] Configuring filebeat for 'proxy'\n&#91;2023-02-20 23:24:04] &#91;INFO] &#91;dhis2-set-elasticsearch] Retrieving filebeat 8.4.1 (arm64)\n&#91;2023-02-20 23:24:04] &#91;INFO] &#91;dhis2-set-elasticsearch] Installing filebeat\nSelecting previously unselected package filebeat.\n(Reading database ... 34741 files and directories currently installed.)\nPreparing to unpack \/tmp\/filebeat.deb ...\nUnpacking filebeat (8.4.1) ...\nSetting up filebeat (8.4.1) ...\n&#91;2023-02-20 23:24:10] &#91;INFO] &#91;dhis2-set-elasticsearch] Configuring filebeat\nSynchronizing state of filebeat.service with SysV service script with \/lib\/systemd\/systemd-sysv-install.\nExecuting: \/lib\/systemd\/systemd-sysv-install enable filebeat\nCreated symlink \/etc\/systemd\/system\/multi-user.target.wants\/filebeat.service \u2192 \/lib\/systemd\/system\/filebeat.service.\n&#91;2023-02-20 23:24:13] &#91;INFO] &#91;dhis2-set-elasticsearch] Filebeat configured. All good\n&#91;2023-02-20 23:24:13] &#91;INFO] &#91;create_containers.sh] Configuring Kibana proxy access\n&#91;2023-02-20 23:24:14] &#91;INFO] &#91;create_containers.sh] Done configuring SIEM\n&#91;2023-02-20 23:24:14] &#91;WARN] &#91;create_containers.sh] Monitor container not existing or running. Skipping\ndab@battlechine:~\/dhis2-tools-ng-dab\/setup$<\/code><\/pre>\n<\/div><div class=\"text-content-inner\">\n<p>Si todo va como se espera, deber\u00eda poder acceder a la p\u00e1gina web de Kibana:<\/p>\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e7d257bfc93&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e7d257bfc93\" class=\"wp-block-image aligncenter size-large is-resized wp-lightbox-container\"><img decoding=\"async\" width=\"1024\" height=\"578\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot-1024x578.webp\" alt=\"Kibana UI login screen\" class=\"wp-image-758\" style=\"width:996px;height:auto\" srcset=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot-1024x578.webp 1024w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot-300x169.webp 300w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot-768x434.webp 768w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot-18x10.webp 18w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot-500x282.webp 500w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot-800x452.webp 800w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/elastic_screenshot.webp 1144w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandar\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption class=\"wp-element-caption\">Kibana UI login<\/figcaption><\/figure>\n<\/div><div class=\"text-content-inner\">\n<p id=\"49ce\">Puede obtener las credenciales a trav\u00e9s de <code>get_creds<\/code> :<\/p>\n\n<pre class=\"wp-block-code\"><code>dab@battlechine:~\/dhis2-tools-ng-dab\/setup$ source libs.sh\ndab@battlechine:~\/dhis2-tools-ng-dab\/setup$ get_creds elasticsearch\n{ \"service\": \"elasticsearch\", \"username\": \"elastic\", \"password\": \"c_2odlH7BoNAB=juUUkg\" }\ndab@battlechine:~\/dhis2-tools-ng-dab\/setup$<\/code><\/pre>\n<\/div><div class=\"text-content-inner\">\n<p id=\"9024\">El <em>es_siem_postscript<\/em> configura autom\u00e1ticamente las siguientes funciones:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Rutina de transformaci\u00f3n que transforma los registros procedentes de los contenedores en datos significativos;<\/li>\n\n\n\n<li>Dos reglas de seguridad para alertar cuando se han realizado 3 intentos fallidos de inicio de sesi\u00f3n contra una instancia de DHIS2;<\/li>\n\n\n\n<li>Un \u00edndice para almacenar esas alertas;<\/li>\n\n\n\n<li>Dos cuadros de mando: uno para las alertas y otro para todos los registros.<\/li>\n<\/ul>\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e7d257c0181&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e7d257c0181\" class=\"wp-block-image aligncenter size-full is-resized wp-lightbox-container\"><img decoding=\"async\" width=\"720\" height=\"378\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/rules_screenshot.webp\" alt=\"Example of predefined detection rules in ElastcSearch\" class=\"wp-image-759\" style=\"width:987px;height:auto\" srcset=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/rules_screenshot.webp 720w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/rules_screenshot-300x158.webp 300w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/rules_screenshot-18x9.webp 18w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/rules_screenshot-500x263.webp 500w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandar\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption class=\"wp-element-caption\">Normas predefinidas<\/figcaption><\/figure>\n<\/div><div class=\"text-content-inner\">\n<p>Intentemos activar la regla de \"intentos fallidos de inicio de sesi\u00f3n\": He realizado 4 intentos fallidos de inicio de sesi\u00f3n para el usuario <em>admin<\/em> at a DHIS2 instance. After few seconds, we will see the alert triggered in the <code>alerta<\/code> vista de datos:<\/p>\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e7d257c0632&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e7d257c0632\" class=\"wp-block-image aligncenter size-full is-resized wp-lightbox-container\"><img decoding=\"async\" width=\"720\" height=\"372\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/failed_screenshot.webp\" alt=\"Example of an alert in ElasticSearch\" class=\"wp-image-760\" style=\"width:983px;height:auto\" srcset=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/failed_screenshot.webp 720w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/failed_screenshot-300x155.webp 300w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/failed_screenshot-18x9.webp 18w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/failed_screenshot-500x258.webp 500w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandar\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption class=\"wp-element-caption\">Alerta de intentos fallidos de inicio de sesi\u00f3n<\/figcaption><\/figure>\n\n<p>Todos los registros se pueden ver en el <code>principal<\/code> data view and tweaks can be to further filter data:<\/p>\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e7d257c07cb&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e7d257c07cb\" class=\"wp-block-image aligncenter size-full is-resized wp-lightbox-container\"><img decoding=\"async\" width=\"720\" height=\"427\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/es_main_dash_screenshot.webp\" alt=\"Elasticsearch main dashboard\" class=\"wp-image-762\" style=\"width:983px;height:auto\" srcset=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/es_main_dash_screenshot.webp 720w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/es_main_dash_screenshot-300x178.webp 300w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/es_main_dash_screenshot-18x12.webp 18w, https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/es_main_dash_screenshot-500x297.webp 500w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Agrandar\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption class=\"wp-element-caption\">elasticsearch main dashboard<\/figcaption><\/figure>\n<\/div><div class=\"text-content-inner\">\n<p id=\"b99b\">There are some limitations that come with this predefined setup.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>First, its ease of setup and management comes at a cost: some of the  most interesting features around security comes at a price of a license,  which means another added cost.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>The built in rules are great as a starting point, but the information available is sometimes limited. Each <a class=\"af px\" href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/action-types.html\" target=\"_blank\" rel=\"noopener ugc nofollow\">connector<\/a> exposes different values that can be used to craft enrich an alert: just to give an example, the <code class=\"fi zt zu zv zw b\">email<\/code> y <code class=\"fi zt zu zv zw b\">es query <\/code>connectors expose the actual logs that trigger the alert, while for the <code class=\"fi zt zu zv zw b\">log threshold<\/code> connector, only the triggered values are reported.<\/p>\n\n<p>You may want to explore free alternatives like the ElasticSearch forked version <a href=\"https:\/\/opensearch.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">OpenSearch<\/a>.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p id=\"b39b\">From a purely technical point of view, a SIEM, by its nature, stores logs coming from every container, and the more activity there is, the more logs are generated and sent to ElasticSearch. The outcome is an increase amount of disk storage to keep up with the database entries. There are several ways you can avoid that, beside the ones <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/tune-for-disk-usage.html\" rel=\"noreferrer noopener\" target=\"_blank\">officially recommended<\/a>:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Increase the size of the disk storage;<\/li>\n\n\n\n<li>Use ElasticSearch <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/size-your-shards.html\" rel=\"noreferrer noopener\" target=\"_blank\">sharding<\/a>;<\/li>\n\n\n\n<li>Apply backup policy and <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/index-lifecycle-management.html\" rel=\"noreferrer noopener\" target=\"_blank\">store away unnecessary old entries<\/a>.<\/li>\n<\/ul>\n<\/div><div class=\"text-content-inner\">\n<p>Another issue regards how DHIS2 manages logs and log entries: it\u2019s not always clear how the <a href=\"https:\/\/github.com\/dhis2\/dhis2-docs\/blob\/master\/src\/sysadmin\/audit.md\" rel=\"noreferrer noopener\" target=\"_blank\">logging and audit systems<\/a> behave, therefore some experimentation is needed. Appropriately assign log entries to their severity level is another issue DHIS2 should address to make logs useful and concise.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>Having a SIEM system is just the first step to a thorough detection and response platform.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>We strongly recommend developing your own detection rules that tie into your environment and workflow.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>If you want to share them with us, please do so <a href=\"https:\/\/github.com\/davinerd\/dhis2-tools-dab\/issues\" target=\"_blank\" rel=\"noreferrer noopener\">by opening a ticket<\/a> in our Github repository.<\/p>\n<\/div><div class=\"text-content-inner\">\n<p>From here, you can think about adding Kibana connectors, to build complex workflows like with a webhook notification used to integrate into a messaging application like Slack, Telegram or WhatsApp to receive real-time alerts notification, or to kick of immediate actions through a <a href=\"https:\/\/www.elastic.co\/what-is\/soar\" target=\"_blank\" rel=\"noreferrer noopener\">SOAR<\/a>.<\/p>\n<div class=\"text-content-inner\">\n<p>If you need more information or need assistance with setting up DHIS2 SIEM automation, don&#8217;t hesitate to <a href=\"https:\/\/dab.solutions\/es\/contact-us\/\">contact us<\/a>!<\/p>\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Uno de los aspectos de una postura de seguridad madura es lo preparada que est\u00e1 la organizaci\u00f3n para detectar y responder a las ciberamenazas: debido a una combinaci\u00f3n de factores que hacen que los ciberataques sean m\u00e1s f\u00e1ciles de llevar a cabo y, por tanto, m\u00e1s comunes, construir el sistema para detectar con prontitud dichos ataques y responder adecuadamente se convierte cada vez m\u00e1s en una necesidad urgente y temprana.<\/p>","protected":false},"author":1,"featured_media":1431,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","footnotes":""},"categories":[1],"tags":[11,13,12],"class_list":["post-753","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dhis2","tag-healthcare","tag-tools"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DHIS2 SIEM automation<\/title>\n<meta name=\"description\" content=\"Lean how to implement a Security Information Event Management for DHIS2 and how to perform dhis2 siem automation with dhis2-tools-dab.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/dab.solutions\/es\/uncategorized\/dhis2-siem-automation\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DHIS2 SIEM automation\" \/>\n<meta property=\"og:description\" content=\"Lean how to implement a Security Information Event Management for DHIS2 and how to perform dhis2 siem automation with dhis2-tools-dab.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dab.solutions\/es\/uncategorized\/dhis2-siem-automation\/\" \/>\n<meta property=\"og:site_name\" content=\"Dab Tech Solutions Consulting\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-22T10:21:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-06T21:16:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/dhis2elastic.png\" \/>\n\t<meta property=\"og:image:width\" content=\"789\" \/>\n\t<meta property=\"og:image:height\" content=\"406\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"dabsolutions\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"dabsolutions\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/\"},\"author\":{\"name\":\"dabsolutions\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/#\\\/schema\\\/person\\\/7b19c04dc229ac447b9a2f070949d984\"},\"headline\":\"DHIS2 SIEM automation\",\"datePublished\":\"2023-02-22T10:21:00+00:00\",\"dateModified\":\"2024-04-06T21:16:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/\"},\"wordCount\":867,\"publisher\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/dab.solutions\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/dhis2elastic.png\",\"keywords\":[\"dhis2\",\"healthcare\",\"tools\"],\"articleSection\":[\"Uncategorized\"],\"inLanguage\":\"es\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/\",\"url\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/\",\"name\":\"DHIS2 SIEM automation\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/dab.solutions\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/dhis2elastic.png\",\"datePublished\":\"2023-02-22T10:21:00+00:00\",\"dateModified\":\"2024-04-06T21:16:31+00:00\",\"description\":\"Lean how to implement a Security Information Event Management for DHIS2 and how to perform dhis2 siem automation with dhis2-tools-dab.\",\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/uncategorized\\\/dhis2-siem-automation\\\/#primaryimage\",\"url\":\"https:\\\/\\\/dab.solutions\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/dhis2elastic.png\",\"contentUrl\":\"https:\\\/\\\/dab.solutions\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/dhis2elastic.png\",\"width\":789,\"height\":406},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/#website\",\"url\":\"https:\\\/\\\/dab.solutions\\\/\",\"name\":\"Dab Tech Solutions Consulting\",\"description\":\"Dab Tech Solutions Consulting\",\"publisher\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/dab.solutions\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/#organization\",\"name\":\"Dab Tech Solutions S.L.\",\"url\":\"https:\\\/\\\/dab.solutions\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/dab.solutions\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/logosolo.png\",\"contentUrl\":\"https:\\\/\\\/dab.solutions\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/logosolo.png\",\"width\":698,\"height\":654,\"caption\":\"Dab Tech Solutions S.L.\"},\"image\":{\"@id\":\"https:\\\/\\\/dab.solutions\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/dab.solutions\\\/#\\\/schema\\\/person\\\/7b19c04dc229ac447b9a2f070949d984\",\"name\":\"dabsolutions\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b06fa07023ea3b6ec9ab577bceaffada074106d36ec80b0c61b8b42b3fabde05?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b06fa07023ea3b6ec9ab577bceaffada074106d36ec80b0c61b8b42b3fabde05?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b06fa07023ea3b6ec9ab577bceaffada074106d36ec80b0c61b8b42b3fabde05?s=96&d=mm&r=g\",\"caption\":\"dabsolutions\"},\"sameAs\":[\"https:\\\/\\\/dab.solutions\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/dab-tech-solutions\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Automatizaci\u00f3n SIEM DHIS2","description":"Lean how to implement a Security Information Event Management for DHIS2 and how to perform dhis2 siem automation with dhis2-tools-dab.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/dab.solutions\/es\/uncategorized\/dhis2-siem-automation\/","og_locale":"es_ES","og_type":"article","og_title":"DHIS2 SIEM automation","og_description":"Lean how to implement a Security Information Event Management for DHIS2 and how to perform dhis2 siem automation with dhis2-tools-dab.","og_url":"https:\/\/dab.solutions\/es\/uncategorized\/dhis2-siem-automation\/","og_site_name":"Dab Tech Solutions Consulting","article_published_time":"2023-02-22T10:21:00+00:00","article_modified_time":"2024-04-06T21:16:31+00:00","og_image":[{"width":789,"height":406,"url":"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/dhis2elastic.png","type":"image\/png"}],"author":"dabsolutions","twitter_card":"summary_large_image","twitter_misc":{"Escrito por":"dabsolutions","Tiempo de lectura":"5 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/#article","isPartOf":{"@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/"},"author":{"name":"dabsolutions","@id":"https:\/\/dab.solutions\/#\/schema\/person\/7b19c04dc229ac447b9a2f070949d984"},"headline":"DHIS2 SIEM automation","datePublished":"2023-02-22T10:21:00+00:00","dateModified":"2024-04-06T21:16:31+00:00","mainEntityOfPage":{"@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/"},"wordCount":867,"publisher":{"@id":"https:\/\/dab.solutions\/#organization"},"image":{"@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/#primaryimage"},"thumbnailUrl":"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/dhis2elastic.png","keywords":["dhis2","healthcare","tools"],"articleSection":["Uncategorized"],"inLanguage":"es"},{"@type":"WebPage","@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/","url":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/","name":"Automatizaci\u00f3n SIEM DHIS2","isPartOf":{"@id":"https:\/\/dab.solutions\/#website"},"primaryImageOfPage":{"@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/#primaryimage"},"image":{"@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/#primaryimage"},"thumbnailUrl":"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/dhis2elastic.png","datePublished":"2023-02-22T10:21:00+00:00","dateModified":"2024-04-06T21:16:31+00:00","description":"Lean how to implement a Security Information Event Management for DHIS2 and how to perform dhis2 siem automation with dhis2-tools-dab.","inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/dab.solutions\/uncategorized\/dhis2-siem-automation\/#primaryimage","url":"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/dhis2elastic.png","contentUrl":"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/02\/dhis2elastic.png","width":789,"height":406},{"@type":"WebSite","@id":"https:\/\/dab.solutions\/#website","url":"https:\/\/dab.solutions\/","name":"Dab Tech Solutions Consulting","description":"Dab Tech Solutions Consulting","publisher":{"@id":"https:\/\/dab.solutions\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dab.solutions\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/dab.solutions\/#organization","name":"Dab Tech Solutions S.L.","url":"https:\/\/dab.solutions\/","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/dab.solutions\/#\/schema\/logo\/image\/","url":"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/12\/logosolo.png","contentUrl":"https:\/\/dab.solutions\/wp-content\/uploads\/2023\/12\/logosolo.png","width":698,"height":654,"caption":"Dab Tech Solutions S.L."},"image":{"@id":"https:\/\/dab.solutions\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/dab.solutions\/#\/schema\/person\/7b19c04dc229ac447b9a2f070949d984","name":"dabsolutions","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/b06fa07023ea3b6ec9ab577bceaffada074106d36ec80b0c61b8b42b3fabde05?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/b06fa07023ea3b6ec9ab577bceaffada074106d36ec80b0c61b8b42b3fabde05?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b06fa07023ea3b6ec9ab577bceaffada074106d36ec80b0c61b8b42b3fabde05?s=96&d=mm&r=g","caption":"dabsolutions"},"sameAs":["https:\/\/dab.solutions","https:\/\/www.linkedin.com\/company\/dab-tech-solutions\/"]}]}},"_links":{"self":[{"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/posts\/753","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/comments?post=753"}],"version-history":[{"count":4,"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/posts\/753\/revisions"}],"predecessor-version":[{"id":1422,"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/posts\/753\/revisions\/1422"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/media\/1431"}],"wp:attachment":[{"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/media?parent=753"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/categories?post=753"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dab.solutions\/es\/wp-json\/wp\/v2\/tags?post=753"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}