HELK icon indicating copy to clipboard operation
HELK copied to clipboard

Update the full HELK stack

Open krapgras opened this issue 9 months ago • 0 comments

What is this PR for? I have updated the HELK stack to the newest version of the stack.

What did I do?

  • [x] Make all docker container builds locally, this way people can do upgrades if HELK stays unmaintained.
  • [x] Update ELK (Elastic Search, Logstash, Kibana) stack to version 8.13.4
  • [x] Update syntax of kibana objects and logstash templates/indexes
  • [x] Upgrade to elastalert version 2
  • [x] Upgrade to pysigma/sigma-cli instead of sigmac
  • [x] Build base images but don't run them so save resources
  • [x] Upgrade zookeeper/Kafka to the new kraft setup
  • [x] Update logstash plugins
  • [x] Change which files are loaded in elastalert as sigma HQ repo has changed in the years
  • [x] Update other libs where possible (Python, postgres, Spark, Hadoop, ...)

What did I not do and should still be done?

  • [ ] Update the actual indexes / rules / intel (Mitre attack, ...) , I have fixed the syntax but not the actual context
  • [ ] Do end to end testing, only checked docker logs and kept running for 10+ hours, I fixed all errors / obvious issues
  • [ ] Clean up additional less used files like setup firewall, update, remove containers, ...
  • [ ] Update Documentation to reflect the new state

Questions:

Will I continue to maintain this?

  • Maybe partially, but probably not the content part

Do you need to accept this PR?

  • No, i just want to raise the awareness that i did this for people still wanting to use this at some point.

Does this needs documentation?

  • Probably needs a good update

Will there be bugs?

  • I'm sure there will be bugs, feel free to fix/report them if you encounter them.

Feel free to update all code as i know i'm not perfect!

krapgras avatar May 20 '24 18:05 krapgras