Adding roles and users in kibana

[whitepoll]

Good morning,
I wanted to ask if it was possible to have a user management capability so that different users could be assigned specific roles for accessing kibana and creating or viewing the dashboard and logs.
Thank you

[CCU7LSP]

No, there's no way to do that. I had the same issue. The kibana that comes with the installation doesn't have User Capabilities. If you modify the Hive to send all of your logs to a second ELK stack however, you can do that.

[CCU7LSP]

https://github.com/telekom-security/tpotce/wiki/Reconfigure-logstash.conf, I followed this, but instead of adjusting the logstash.conf, I pulled out the http_input.conf. Then I just point it at my own personal setup of an ELK stack, and I haven't had problems.

[whitepoll]

But even with the sensors? did you just change the http_input.conf of the hive? and was the elk stack on a different compose?

[CCU7LSP]

I changed it only on my hive. I had to make a whole other client, a brand new machine on the network, hosting my own ELK stack. I modified the http_input to send the logs so the hive sent to itself and also send the logs to that brand new computer.

[whitepoll]

Okay all clear, I am not too knowledgeable about ELK. But in the brand new machine is it enough to install kibana and elastic or do you also need a new logstash?

[CCU7LSP]

No, the hive's logstash cleans it up. So, you just have to point it at your new Elasticsearch IP over port 9200. Then it imports all the data. So, you should just need Elastic and Kibana running. At least, that's all I had to set up.