Configuring map dataedit
Depending on your Kibana setup, to display and interact with data on the map you might need to:
To see source and destination connections lines on the map, you must
configure source.geo
and destination.geo
ECS fields for your indices.
Create Kibana index patternsedit
To display map data, you must define Kibana index patterns (Management → Index Patterns) with exactly the same names or glob patterns used to define the SIEM Elasticsearch indices.
The SIEM Elasticsearch indices are defined in the siem:defaultIndex
field
(Kibana → Management → Advanced Settings → siem:defaultIndex
).
For example, if you define a SIEM Elasticsearch servers-europe-*
glob pattern,
to display map data for the matching indices you must also define a Kibana index
pattern named servers-europe-*
. If you use a different Kibana index pattern,
such as servers-*
, map data for the indices is not displayed.
Add geoIP dataedit
When the ECS source.geo.location and destination.geo.location fields are mapped, network data is displayed on the map.
If you use Beats, configure a geoIP processor to add data to the relevant fields:
-
Define an ingest node pipeline that uses one or more
geoIP
processors to add location information to events. For example, use the Console in Kibana to create the following pipeline:PUT _ingest/pipeline/geoip-info { "description": "Add geoip info", "processors": [ { "geoip": { "field": "client.ip", "target_field": "client.geo", "ignore_missing": true } }, { "geoip": { "field": "source.ip", "target_field": "source.geo", "ignore_missing": true } }, { "geoip": { "field": "destination.ip", "target_field": "destination.geo", "ignore_missing": true } }, { "geoip": { "field": "server.ip", "target_field": "server.geo", "ignore_missing": true } }, { "geoip": { "field": "host.ip", "target_field": "host.geo", "ignore_missing": true } } ] }
In this example, the pipeline ID is
geoip-info
.field
specifies the field that contains the IP address to use for the geographical lookup, andtarget_field
is the field that will hold the geographical information."ignore_missing": true
configures the pipeline to continue processing when it encounters an event that doesn’t have the specified field. -
In your Beats configuration files, add the pipeline to the `output.elasticsearch`tag:
The value of this field must be the same as the ingest pipeline name in step 1 (
geoip-info
in this example).
Map your internal networkedit
If you want to add your network’s internal IP addresses to the map, define geo
location fields under the processors
tag in the Beats configuration files
on your hosts:
processors: - add_host_metadata: - add_cloud_metadata: ~ - add_fields: when.network.source.ip: <private/IP address> fields: source.geo.location: lat: <latitude coordinate> lon: <longitude coordinate> target: '' - add_fields: when.network.destination.ip: <private/IP address> fields: destination.geo.location: lat: <latitude coordinate> lon: <longitude coordinate> target: ''
You can also enrich your data with other host fields.