Visualize Audits

Prerequisites

1. An existing Grey Matter deployment running on Kubernetes (tutorial)

2. kubectl or oc setup with access to the cluster

3. greymatter cli setup with access to the deployment

4. An ELK stack with a configured Kibana proxy that is reachable from the Grey Matter application.

5. Observables enabled on a sidecar and some data in the Kafka cluster.

Steps

1. Create a Kibana Index Pattern

Note: You must have at least some data in the system in order to create an index pattern. If you have not enabled observables on and made a request to at least one service, do so before completing this step.

Navigate to your Kibana proxy via the Grey Matter application. If you haven't clicked in yet choose Explore on my own and click into the Management panel on the far bottom of the options on the left.

You should see ElasticSearch and Kibana listed as follows, click Index Patterns under Kibana.

Kibana Management

On the far right, choose Create index pattern. There should already be some existing data there if you properly enabled observables and made a few requests to your service.

In the index pattern, type greymatter-*. Click through and create the index.

2. Create certs for Dashboarder

To create the certificates needed for the Dashboarder service, run the following from the root directory of your cloned helm-charts repository:

The password is password for all of the following.

mkdir observables/certs
openssl pkcs12 -in certs/quickstart.p12 -cacerts -nokeys -out observables/certs/ca.crt

openssl pkcs12 -in certs/quickstart.p12 -clcerts -nokeys -out observables/certs/user.crt

openssl pkcs12 -in certs/quickstart.p12 -nocerts -nodes -out observables/certs/user.key

3. Use Dashboarder to configure a Kibana Dashboard

The Dashboarder service will automatically populate a Kibana Dashboard to visualize Grey Matter audits - run the following to run it:

Note: The cli needs to be properly configured in your terminal and you should be in the root directory of the helm-charts.

docker run --rm -v $(pwd)/observables/certs:/usr/local/dashboarder -e GREYMATTER_URL=https://$GREYMATTER_API_HOST/services/kibana-observables-proxy/7.1.0/api/saved_objects/ docker.greymatter.io/internal/dashboarder generate greymatter

If you see the response:

Found the greymatter index
Templating the Visualization
Applying the service visualization
Applying the response_code visualization
Applying the request_per_hour visualization
Applying the total_requests visualization
Applying the user_dn visualization
Applying the x_real_ip visualization
Applying the service_user_dn visualization
Applying the popular_paths visualization
Applying the successful_requests visualization
Applying the path visualization
Applying the user_agent visualization
Templating the Dashboard
Applying the Dashboard
Completed

The Kibana Dashboard for Grey Matter was configured! Navigate to the Dashboard pane and you will see Greymatter Dashboard. This will be a basic visualization of the information available in a Grey Matter observables.

Questions

Create an account at Grey Matter Support to reach our team.