CentOS 8 rpm安装suricata 5.03，Elasticsearch，kibana，KTS7，evebox实现IDS WEB GUI

安装 suricata 5.03
关闭SELinux，不关闭sytemd服务不能启动
vi /etc/selinux/config
将SELINUX=enforcing改为SELINUX=disabled 
设置后需要重启才能生效

配置epel源
yum install epel-release -y
 
suricata为CentOS 7提供了rpm软件包，只需使用以下命令即可安装： 

yum install suricata -y

vi /etc/sysconfig/suricata
 eth0修改为ens33
systemctl start suricata
systemctl status suricata
systemctl enable suricata

安装Elasticsearch
Vi /etc/yum.repos.d/elasticsearch.repo
[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

yum install --enablerepo=elasticsearch elasticsearch

安装kibana
Vi /etc/yum.repos.d/kibana.repo
[kibana-7.x]
name=Kibana repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

yum install kibana

！！不要安装LogStash，安装LogStash会关机很慢。

安装KTS7
从
https://github.com/StamusNetworks/KTS7
下载安装包，解压
cd API-KIBANA7
curl -X POST "localhost:5601/api/saved_objects/_import" -H 'kbn-xsrf: true' --form file=@index-pattern.ndjson
curl -X POST "localhost:5601/api/saved_objects/_import" -H 'kbn-xsrf: true' --form file=@search.ndjson
curl -X POST "localhost:5601/api/saved_objects/_import" -H 'kbn-xsrf: true' --form file=@visualization.ndjson
curl -X POST "localhost:5601/api/saved_objects/_import" -H 'kbn-xsrf: true' --form file=@dashboard.ndjson
service kibana restart

安装Evebox 
Evebox是一个Web前端，显示Suricata警报。
首先，我们将添加Evebox存储库：

rpm -Uvh https://evebox.org/files/rpm/stable/evebox-release.noarch.rpm

安装
yum install evebox

编辑配置文件，按如下修改：

vi /etc/sysconfig/evebox
# The URL to Elastic Search. Setting it here will override the URL in
# the config file if used.
ELASTICSEARCH_URL="-e http://localhost:9200"

# Config file.
CONFIG="-c /etc/evebox/evebox.yaml"

# Other command line options like "-v" for verbose output.
EVEBOX_OPTS="--input /var/log/suricata/eve.json --host 0.0.0.0"

建立书签文件
touch /var/log/suricata/eve.json.bookmark

修改文件权限evebox用户为拥有者，可读写：
chown evebox:evebox /var/log/suricata/eve.json.bookmark

并在启动时启动evebox：
systemctl enable evebox

我们现在可以启动evebox：
service evebox start

现在我们可以访问http://localhost:5636 ，使用evebox
也可以访问http://localhost:5601，使用kibana
如果不要kibana，也可以不安装