Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the full HELK stack #592

Open
wants to merge 16 commits into
base: master
Choose a base branch
from
Open

Conversation

krapgras
Copy link

@krapgras krapgras commented May 20, 2024

What is this PR for?
I have updated the HELK stack to the newest version of the stack.

What did I do?

  • Make all docker container builds locally, this way people can do upgrades if HELK stays unmaintained.
  • Update ELK (Elastic Search, Logstash, Kibana) stack to version 8.13.4
  • Update syntax of kibana objects and logstash templates/indexes
  • Upgrade to elastalert version 2
  • Upgrade to pysigma/sigma-cli instead of sigmac
  • Build base images but don't run them so save resources
  • Upgrade zookeeper/Kafka to the new kraft setup
  • Update logstash plugins
  • Change which files are loaded in elastalert as sigma HQ repo has changed in the years
  • Update other libs where possible (Python, postgres, Spark, Hadoop, ...)

What did I not do and should still be done?

  • Update the actual indexes / rules / intel (Mitre attack, ...) , I have fixed the syntax but not the actual context
  • Do end to end testing, only checked docker logs and kept running for 10+ hours, I fixed all errors / obvious issues
  • Clean up additional less used files like setup firewall, update, remove containers, ...
  • Update Documentation to reflect the new state

Questions:

Will I continue to maintain this?

  • Maybe partially, but probably not the content part

Do you need to accept this PR?

  • No, i just want to raise the awareness that i did this for people still wanting to use this at some point.

Does this needs documentation?

  • Probably needs a good update

Will there be bugs?

  • I'm sure there will be bugs, feel free to fix/report them if you encounter them.

Feel free to update all code as i know i'm not perfect!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant