0

I'm using packbeat to monitor network traffic for a SIEM-like setup with ELK. I'd like to push it to a large number of machines but the setup requires manual identification in packetbeat.yml.

Has any been able to script the process of selecting the appropriate interface to monitor for packetbeat?

Gambit1614
  • 8,547
  • 1
  • 25
  • 51
Chance212
  • 31
  • 6
  • It seems you can have any number of packetbeat.interfaces.device: as long as the device exists. My theory is to do the following: 1) powershell ./packetbeat.exe devices 2) count the values returned for each "device" write to packetbeat.yml packetbeat.interfaces.device:"device" "device"++ and then run that each time the user logs in to ensure it's continuously accurate. It's messy but seems to be the the closest thing to a workaround I can pull together. – Chance212 Oct 02 '19 at 15:11

2 Answers2

0

I've put this together - which uses 3 separate .yml

ConfigTemplate.yml which contains the rest of the packetbeat.yml minus the interfaces.

Interfaces.yml which is a temp file used to write the interfaces to.

packetbeat.yml which is the final config file packetbeat will use.

The python script should be in the packetbeat directory along with the config .yml's

The only limitation is that it needs python on the host machines - the next stage is to see if it can be done with powershell.

Hope this helps anyone else! Any improvements are welcome!

import subprocess

devices = subprocess.check_output(["powershell.exe", "(./packetbeat.exe   devices).count"])

devicesCount = int(devices.decode('utf-8'))

print(devicesCount)

deviceCount = range(devicesCount)


with open('ConfigTemplate.yml', 'r') as original: data1 = original.read()


with open('Interfaces.yml', 'w') as modified: 

  for i in deviceCount:
    modified.write("packetbeat.interfaces.device: " + str(i)+ "\n" )


with open('Interfaces.yml', 'r') as original: data2 = original.read()


with open('Packetbeat.yml', 'w') as modified2: modified2.write("# ================== Set listening interfaces ==================" +"\n"+ data2 + "\n" + data1 + "\n")
Chance212
  • 31
  • 6
0

Powershell version - 

$count = (C:\path\to\packetbeat.exe - devices).count

$line = ''


for($i=0; $i -le ($count-1); $i++){

    $line +="packetbeat.interfaces.device:"+" $i `r`n" 

    }

$line  | Out-File -FilePath "C:\path\to\packetbeat\Interfaces.yml"

$configTemplate = Get-Content -Path "C:\path\to\packetbeat\ConfigTemplate.yml"

$interfaces = Get-Content -Path "C:\path\to\packetbeat\Interfaces.yml"

$interfaces + "`r`n" + $configTemplate | Out-File -FilePath "C:\path\to\packetbeat\packet.yml"
Chance212
  • 31
  • 6