Summary

In this chapter, we covered how to install and configure the three key components of the ELK stack. These components work together to receive, enrich, index, and display what data analysts need to do their jobs. Along the way, we learned about a bunch of related useful information that is likely to be seen again and again as you progress through your cybersecurity career.

Then, we learned about some best practices, such as updating and upgrading after each new system boot and adding human-readable comments to code and configuration files. We also covered how to view the status of the applications after we start them, along with a bunch of commands to manipulate them, such as setting them to autostart upon boot and how to stop, disable, and remove them if needed.

These tasks provided us with a robust skill set to manipulate the ELK stack’s components so that they fit our needs. That includes our experiences testing our configurations and how to integrate the components...