How To Install Kali Purple With Elastic SIEM 

Thank you

Thank you Phil

I agree with you. I followed the instructions in this video to the letter and enthusiastically but the installations with Linux are not clean, the first point from gitlab did not work for me because it ended up saying that it could not find the elasticsearch package. Of course, it could be that when I installed Kali Linux Purple I had problems with the selection of the programs to install, it did not let me install all the options that were marked by default because it said that there was an error with a program. So I unchecked the last two options for "additional" programs or tools, etc., there it did allow Kali Linux to be installed. I looked for the error, repaired it and went back to point 1 but it didn't end up telling me about any credentials and when I try to open the browser with [IP address]:5601, I get the IP address of /etc/hosts at the front from the kali machine and it didn't work. Conclusion: it is frustrating, Linux serves to waste time messing around, tasty but without results in the end.

Thank you 🙏

Thank you

Yeah, no network connection was established

Yeah if you want to test elastic agent disable defender, even better, find a better way to evade defender and it will be a great lab !

did you find the solution?

Incorrect password or the elastic web ui is unavailable?

@@CSimms-yv1lw specify the Kibana port. Also check the status of the services make sure they are running. And finally make sure the ip address is in etc/hosts

I noticed that too. I removed system, and I have to restart the elastic agent on kali purple and everything seem to work. Seems like a bug

@@ITSecurityLabs Thankfully it's in a VM and I have plenty of snapshots to fall back to!

don't know if this will help but I tried: sudo systemctl start elasticsearch.service

That might work I have not tried it. SIEM is resource intensive and for me I have committed more than 8GB and I am not sure if a pi cuts it. Let me know if you get it to work

@@ITSecurityLabs ok thanks, I’ll do it sometime this week and I’ll definitely let you know. 👋

@@ITSecurityLabs it doesn’t work. Maybe now with the pi5 more support for applications like this will get updated. There were workarounds, but that was using older versions buster or older, and that literally negates the point of security (old kernel etc) so I didn’t bother tryin. 👍 R u gettin a pi 5?

Security onion added a separate UI and has wazuh added. ELK SIEM is straight ELK with the security plugin

Watch the video, at the 20th minute I add the agent to windows

You can use filebeat. Check out how we send suricata logs in this series on video #3

I say about 400

Can t wait your New Tutorial...

Thank you

yes what I ended up doing was not logging into the server on step 3, instead went immediately into step 4 then login to the server. If it didn't finished I was able to refresh the browser and was good for https.

Yes, used it a lot in my CCNP CCNA days

Try www.elastic.co/guide/en/elasticsearch/reference/master/reset-password.html

You need to go to the elasticsearch binary location

@@ITSecurityLabs thank's for the heads up

@@ITSecurityLabs thank you this was a lot of help

same issue for me also

@@hariprasathm9644 i am having the same problem, have you fixed it?

The password is the same that displays after the installation. But if you miss it you'll have to run a command to make a new one. I'm sorry command I didn't write down.