- elk-security-setup.sh - The "Office Building"
What it does: This builds the entire ELK office building with three departments.
Simple Explanation:
Elasticsearch = The Library (stores all the data)
Logstash = The Editor's Desk (processes and formats data)
Kibana = The Newsroom Display (shows beautiful charts)
Key Parts:
Creates docker-compose-elk.yml (blueprint for the building)
Downloads and starts all three services
Makes them connect to each other
sleep 30 = "Wait for the building to be ready for visitors"
- inject-security-data.sh - The "News Reporter"
What it does: This sends your first sample security data to Elasticsearch.
Simple Explanation:
It's like a reporter sending the first news article to the library
Creates a JSON "news article" about your system security:
- collect-metrics.sh - The "Regular Beat Reporter"
What it does: This constantly collects and sends security data every 30 seconds.
Simple Explanation:
while true; do = "Keep doing this forever"
Every 30 seconds, it checks:
Network connections
Open ports
Running containers
ARP table entries
Packages this as a "news update" and sends to Logstash
How ELK Stack Works Together
Think of it like a newspaper workflow:
Reporter (collect-metrics.sh) → Gathers facts
Editor (Logstash) → Formats and cleans the facts
##################################################################################################################################################
- grafana-security-setup.sh - The "Kitchen Setup"
Simple Explanation:
It creates a docker-compose-grafana.yml file (like a furniture assembly manual)
Starts Grafana (dashboard) and Loki (data storage) as separate containers
Makes them talk to each other
Waits 30 seconds for everything to start properly
Key Parts:
docker-compose up -d = "Start these services in the background"
sleep 30 = "Wait 30 seconds for everything to warm up"
- send-security-metrics.sh - The "Data Chef"
What it does: This script collects your computer's security data and sends it to Loki every 30 seconds.
Simple Explanation:
It's like a chef who checks your kitchen every 30 seconds:
Counts network connections (netstat -an)
Checks open ports (ss -tuln)
Counts running containers (docker ps)
Checks ARP table (arp -n)
Then it packages this data as JSON and sends it to Loki
Key Parts:
for i in {1..10} = "Do this 10 times"
sleep 30 = "Wait 30 seconds between checks"
curl -X POST = "Send this data to Loki"
- import-dashboard.sh - The "Display Designer"
What it does: This creates the actual dashboard with 4 panels showing your security metrics.
Simple Explanation:
It creates a pre-designed dashboard layout with:
Panel 1: IP Connections counter
Panel 2: Open Ports counter
Panel 3: Running Containers counter
Panel 4: ARP Entries counter
Uses curl to tell Grafana: "Hey, create this dashboard for me!"
Library (Elasticsearch) → Stores all the news articles
Display (Kibana) → Shows beautiful charts and dashboards