Filebeat Threat Intel module
Filebeat has a Threat Intel module that is intended to import threat data from various feeds. We'll set up three of the feeds that do not require any third-party accounts, but you can set those up as well if you have accounts.
In Elastic 7.12, the Threat Intel module collects data from five sources:
- Abuse Malware
- Abuse URL
- Anomali Limo
- AlienVault OTX (free account required)
- MISP (additional infrastructure required)
We'll go through the steps to set up Abuse Malware, Abuse URL, and Anomali Limo:
- Log in to the command line of your Elastic VM and install filebeat using DNF:
sudo dnf install filebeat –y
Once you have installed Filebeat, you need to update the configuration and start collecting data.
- First, let's enable the Threat Intel Filebeat module. We can simply run the following:
sudo filebeat modules enable threatintel
- Now that we've enabled the Threat Intel module, we just need to do a few...
