30-Day SOC Analyst Challenge

🚀 Day 7: Elastic Agent and Fleet Server Setup

Let’s get started!!!

Welcome to Day 7 of the 30-Day SOC Analyst Challenge! If you’ve been following along, great job — you’re halfway through! If you’re new here, I strongly recommend starting from Day 1 to get the most out of this challenge. Today, we’re focusing on setting up an Elastic Agent on a Windows server and configuring a Fleet Server for centralized management.

By the end of this blog, you’ll have your Windows server enrolled in your Fleet, giving you centralized control over your agents. Let’s dive in! 🌟

🛠️ Setting Up the Fleet Server

Step 1: Deploy a New Server

We’ll start by creating a new server that will function as our Fleet Server. Here’s how you can do it:

1. Click on Deploy at the top-right corner.
2. Select Deploy New Server.

Choose Instance Type

Choose nearest location to you

3. Choose Ubuntu 22.04 with the following specs:

• 1 CPU
• 4 GB RAM
• No auto backups
• No IPv6

Choose Ubuntu Image 22.04 LTS

Choose Above Specs

4. Ensure the network is set to Virtual Private Cloud 2.0 with the correct IP address.

Select VPC 2.0

Select your already configured VPC

5. Name your server as jashank1999-Fleet-Server and click Deploy.

Configure Server Hostname

While the server is being created, let’s move on to setting up the Fleet Server in the Elastic web GUI.

Step 2: Configuring the Fleet Server

1. Go to the Elastic web GUI using your public IP address on port 5601.
2. Navigate to the Fleet section under Management from the hamburger menu on the left.

Click on Fleet under Management

3. Click Add Fleet Server and choose the Quick Start option.

Click on Add Fleet Server

4. Enter the name of your choice.

5. Copy your Fleet Server public IP address from Vultr dashboard and paste it in the URL field, ensuring it starts with [https://](https://.)<Fleet-Server-Public-IP>.

6. Click Generate Fleet Server Policy.

Once the policy is generated, you’ll see a command that needs to be run on your Fleet Server.

Command that you need to copy once above policy is created

🔧 Setting Up the Elastic Agent on Fleet Server

Step 3: SSH into the Fleet Server

1. Copy the IP address of your Fleet Server.
2. Open a new PowerShell instance and type:

ssh root@<your-fleet-server-ip>

3. Enter the password when prompted.

Step 4: Update and Install Elastic Agent

1. Run the following commands to update your repositories:

sudo apt-get update && sudo apt-get upgrade -y

Enter above command to update Ubuntu server

2. Copy the command from the Elastic web GUI and paste it into your Fleet Server terminal.

3. Confirm that you want to install the Elastic Agent by typing Y.

🔍 Troubleshooting and Firewall Configurations

Step 5: Troubleshooting Enrollment Issues If the enrollment fails, you might need to adjust your firewall settings:

1. Allow Port 9200 on the ELK server:

sudo ufw allow 9200

2. Check and Adjust Fleet Server Firewall:

sudo ufw allow 8220
sudo ufw allow 443

3. Re-run the Elastic Agent install command and monitor for any errors.

Pro Tip: Ensure your Fleet Server can communicate with your ELK server, particularly on port 9200, which is used by Elasticsearch.

🚀 Successful Enrollment and Monitoring

Step 6: Validate the Enrollment

After troubleshooting, you should see a confirmation in the Elastic GUI that your Fleet Server is connected. Now you can proceed to install the Elastic Agent on your Windows Server.

Successfull Enrollment of the Elastic Agent

Also verify on GUI

Step 7: Installing Elastic Agent on Windows

1. Go to the Fleet section and click Add Agent.

Enter name of your choice and click on create policy

2. Select Windows as the host type and copy the command provided.

Copy the commands by clicking on copy icon

3. Paste it in a notepad file and make few changes in it to successfully enrol the agent.

Note: You need to make few changes in the URL to make it work:

url=https://<Fleet-Server-IP>:8220 <Change the port from 443 to 8220>

And add insecure at end of the line as we don't have a SSL certificate configured. Please refer below screenshot.

Make sure you make above change in the command

4. Also go back to your Elastic Web GUI and go to Fleet section under Management. Click on Settings and make below change in the host URL. We need to change the port from 443 to 8220 so that it reflects what we did in the command. Click on save and apply settings.

Change port from 443 to 8220

5. Open PowerShell on your Windows server as an administrator and paste the command now with the final changes.

Paste the command in PowerShell of your Windows Server

4. You should be able to see that Elastic Agent is successfully enrolled.

Agent Successfully installed

🎉 Wrapping Up

After completing these steps, your Windows server should be successfully enrolled in the Fleet, and you should start seeing logs in the Elastic GUI. You can now monitor your Windows Server activity, including critical events like failed logins.

Window Server logs are seen in Elastic GUI

Call to Action:

If you’re following along with this challenge, share your progress and thoughts in the comments below! Let’s build this SOC environment together!🌍

Connect with Me on LinkedIn! 🤝

If you’re enjoying this 30 DAY SOC Challenge or want to chat about cybersecurity, cloud computing, or anything tech-related, let’s connect on LinkedIn! I love meeting like-minded professionals and sharing knowledge.

🔗 **Jashanpreet Singh on LinkedIn**

Looking forward to connecting with you! 🚀

Credits and Special Thanks 🎉

A huge shoutout to the MYDFIR YouTube Channel for creating this incredible 30 DAY SOC Challenge and providing top-notch free cybersecurity content for the community! 🌐

If you’re passionate about cybersecurity or looking to dive into this field, I highly recommend checking out his channel and website. His content is a goldmine for both beginners and seasoned professionals.

🔗 MYDFIR YouTube Channel 🔗 MYDFIR Website

Thank you, MYDFIR, for your dedication to making cybersecurity knowledge accessible to everyone! 🚀