HELK
HELK copied to clipboard
Update the full HELK stack
What is this PR for? I have updated the HELK stack to the newest version of the stack.
What did I do?
- [x] Make all docker container builds locally, this way people can do upgrades if HELK stays unmaintained.
- [x] Update ELK (Elastic Search, Logstash, Kibana) stack to version 8.13.4
- [x] Update syntax of kibana objects and logstash templates/indexes
- [x] Upgrade to elastalert version 2
- [x] Upgrade to pysigma/sigma-cli instead of sigmac
- [x] Build base images but don't run them so save resources
- [x] Upgrade zookeeper/Kafka to the new kraft setup
- [x] Update logstash plugins
- [x] Change which files are loaded in elastalert as sigma HQ repo has changed in the years
- [x] Update other libs where possible (Python, postgres, Spark, Hadoop, ...)
What did I not do and should still be done?
- [ ] Update the actual indexes / rules / intel (Mitre attack, ...) , I have fixed the syntax but not the actual context
- [ ] Do end to end testing, only checked docker logs and kept running for 10+ hours, I fixed all errors / obvious issues
- [ ] Clean up additional less used files like setup firewall, update, remove containers, ...
- [ ] Update Documentation to reflect the new state
Questions:
Will I continue to maintain this?
- Maybe partially, but probably not the content part
Do you need to accept this PR?
- No, i just want to raise the awareness that i did this for people still wanting to use this at some point.
Does this needs documentation?
- Probably needs a good update
Will there be bugs?
- I'm sure there will be bugs, feel free to fix/report them if you encounter them.
Feel free to update all code as i know i'm not perfect!