Security Automation with Ansible 2

Logstash configuration

To receive logs from different systems, we use the Beats service from Elastic. The following configuration is to receive logs from different servers to the Logstash server. Logstash runs on port 5044 and we can use SSL certificates to ensure logs are transferred via an encrypted channel:

# 02-beats-input.conf.j2input {    beats {        port => 5044        ssl => true        ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"        ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"    }}

The following configuration is to parse the system SSH service logs (auth.log) using grok filters. It also applies filters like geoip, while providing additional information like country, location, longitude, latitude, and so on:

#10-sshlog-filter.conf.j2 ...