OpenSearch Security Analytics Dashboard Installation#

Step 1: Access Your OpenSearch Dashboards Server#

SSH into your server where OpenSearch Dashboards is installed:

1
ssh user@your-server-ip

Verify OpenSearch Dashboards is running:

1
sudo systemctl status opensearch-dashboards

Step 2: Switch to Root User#

For plugin installation, you’ll need elevated privileges:

1
sudo su

Alternatively, you can prefix each command with sudo.

Step 3: Navigate to OpenSearch Dashboards Directory#

The default installation directory varies by installation method:

1
# For package installations (RPM/DEB)
2
cd /usr/share/opensearch-dashboards/
3

4
# For tar.gz installations
5
cd /opt/opensearch-dashboards/
6

7
# Verify you're in the correct directory
8
ls -la
9
# You should see directories like bin/, config/, plugins/, etc.

Step 4: Install the Security Analytics Dashboard Plugin#

Navigate to the bin directory:

1
cd bin/

Install the plugin using the OpenSearch Dashboards plugin installer:

1
./opensearch-dashboards-plugin --allow-root install securityAnalyticsDashboards

The system will:

• Download the plugin from the OpenSearch repository
• Verify plugin compatibility
• Extract and install plugin files
• Update plugin registry

Expected output:

1
Attempting to transfer from https://artifacts.opensearch.org/.../securityAnalyticsDashboards-*.zip
2
Transferring [====================] 100%
3
Transfer complete
4
Retrieving metadata from plugin archive
5
Extracting plugin archive
6
Extraction complete
7
Plugin installation complete

Step 5: Verify Plugin Installation#

List installed plugins to confirm successful installation:

1
./opensearch-dashboards-plugin list

You should see securityAnalyticsDashboards in the output.

Step 6: Configure Plugin Settings (Optional)#

If needed, configure plugin-specific settings:

1
# Navigate to config directory
2
cd ../config/
3

4
# Edit opensearch_dashboards.yml if necessary
5
vi opensearch_dashboards.yml

Add any required configuration:

1
# Security Analytics Dashboard settings
2
securityAnalytics.enabled: true
3
securityAnalytics.rules.enabled: true
4
securityAnalytics.detectors.enabled: true

Step 7: Restart OpenSearch Dashboards#

After successful installation, restart the service to load the plugin:

1
# For systemd-based systems
2
sudo systemctl restart opensearch-dashboards
3

4
# Monitor the restart process
5
sudo journalctl -u opensearch-dashboards -f

Wait for the service to fully start. Look for messages like:

1
Server running at https://0.0.0.0:5601

Step 8: Verify Installation in Web Interface#

1. Open your browser and navigate to OpenSearch Dashboards:

   1
   https://your-server-ip:5601
   

2. Log in with your credentials

3. Look for “Security Analytics” in the main navigation menu

4. Click on Security Analytics to access:

   • Overview dashboard
   • Detectors
   • Rules
   • Findings
   • Alerts

1. Initialize Security Analytics#

Upon first access, you may need to:

1
# Initialize indices and mappings
2
curl -X POST "https://localhost:9200/_plugins/_security_analytics/indices/_initialize" \
3
  -H 'Content-Type: application/json' \
4
  -u admin:admin

2. Configure Detection Rules#

Access the Rules section to:

• Import pre-built detection rules
• Create custom rules
• Configure rule actions

3. Set Up Detectors#

Create detectors for your log sources:

• Windows Security Events
• Network Traffic Logs
• Application Logs
• Custom Log Sources

4. Configure Notifications#

Set up alert destinations:

• Email notifications
• Slack/Teams webhooks
• Custom webhooks
• SIEM integrations

Permission Issues#

If you encounter permission errors:

1
# Ensure proper ownership
2
chown -R opensearch-dashboards:opensearch-dashboards /usr/share/opensearch-dashboards/
3

4
# Fix plugin directory permissions
5
chmod -R 755 /usr/share/opensearch-dashboards/plugins/

Plugin Compatibility Issues#

Check version compatibility:

1
# Check OpenSearch Dashboards version
2
./bin/opensearch-dashboards --version
3

4
# Verify plugin compatibility matrix
5
curl -s https://opensearch.org/docs/latest/dashboards/compatibility/

Installation Failures#

If installation fails:

1. Check logs:

   1
   tail -f /var/log/opensearch-dashboards/opensearch-dashboards.log
   

2. Clear plugin cache:

   1
   rm -rf /usr/share/opensearch-dashboards/optimize/bundles/
   

3. Try manual installation:

   1
   # Download plugin ZIP manually
   2
   wget https://artifacts.opensearch.org/.../securityAnalyticsDashboards-VERSION.zip
   3
   
   4
   # Install from local file
   5
   ./opensearch-dashboards-plugin install file:///path/to/securityAnalyticsDashboards-VERSION.zip
   

Browser Cache Issues#

If the plugin doesn’t appear after installation:

1. Clear browser cache (Ctrl+Shift+Delete)
2. Try incognito/private browsing mode
3. Use a different browser
4. Check browser console for JavaScript errors (F12)

1. Network Security#

Ensure proper network controls:

1
# Restrict access to OpenSearch Dashboards port
2
sudo firewall-cmd --permanent --add-rich-rule='
3
  rule family="ipv4"
4
  source address="10.0.0.0/8"
5
  port protocol="tcp" port="5601" accept'
6

7
sudo firewall-cmd --reload

2. Authentication and Authorization#

Configure role-based access:

1
{
2
  "security_analytics_read": {
3
    "cluster_permissions": [
4
      "cluster:admin/opensearch/securityanalytics/detector/search",
5
      "cluster:admin/opensearch/securityanalytics/rule/search"
6
    ],
7
    "index_permissions": [
8
      {
9
        "index_patterns": ["security-analytics-*"],
10
        "allowed_actions": ["read"]
11
      }
12
    ]
13
  }
14
}

3. Audit Logging#

Enable audit logging for security analytics activities:

1
# In opensearch.yml
2
plugins.security.audit.type: internal_opensearch
3
plugins.security.audit.config.log_request_body: true
4
plugins.security.audit.config.disabled_rest_categories: []
5
plugins.security.audit.config.disabled_transport_categories: []

4. Resource Limits#

Configure appropriate resource limits:

1
# In jvm.options
2
-Xms2g
3
-Xmx2g
4

5
# In opensearch_dashboards.yml
6
opensearch.requestTimeout: 60000
7
opensearch.shardTimeout: 60000

1. Index Management#

Configure index lifecycle policies:

1
{
2
  "policy": {
3
    "phases": {
4
      "hot": {
5
        "actions": {
6
          "rollover": {
7
            "max_age": "1d",
8
            "max_size": "50GB"
9
          }
10
        }
11
      },
12
      "warm": {
13
        "min_age": "7d",
14
        "actions": {
15
          "shrink": {
16
            "number_of_shards": 1
17
          },
18
          "forcemerge": {
19
            "max_num_segments": 1
20
          }
21
        }
22
      },
23
      "delete": {
24
        "min_age": "30d",
25
        "actions": {
26
          "delete": {}
27
        }
28
      }
29
    }
30
  }
31
}

2. Query Optimization#

Optimize detector queries:

1
{
2
  "size": 0,
3
  "query": {
4
    "bool": {
5
      "filter": [
6
        {
7
          "range": {
8
            "@timestamp": {
9
              "gte": "now-15m"
10
            }
11
          }
12
        }
13
      ]
14
    }
15
  },
16
  "aggs": {
17
    "security_events": {
18
      "terms": {
19
        "field": "event.category",
20
        "size": 10
21
      }
22
    }
23
  }
24
}

1. Logstash Integration#

Configure Logstash to send security events:

1
output {
2
  opensearch {
3
    hosts => ["https://localhost:9200"]
4
    index => "security-analytics-events-%{+YYYY.MM.dd}"
5
    user => "logstash_user"
6
    password => "${LOGSTASH_PASSWORD}"
7
    ssl => true
8
    ssl_certificate_verification => true
9
  }
10
}

2. Beats Integration#

Configure Filebeat for log shipping:

1
output.opensearch:
2
  hosts: ["https://localhost:9200"]
3
  protocol: "https"
4
  username: "beats_user"
5
  password: "${BEATS_PASSWORD}"
6
  index: "security-analytics-beats-%{[agent.version]}-%{+yyyy.MM.dd}"
7

8
processors:
9
  - add_tags:
10
category: Security
11
      tags:
12
  - security-analytics
13
      target: "event.tags"

3. SIEM Integration#

Export findings to external SIEM:

1
# Export findings via API
2
curl -X GET "https://localhost:9200/_plugins/_security_analytics/findings/_search" \
3
  -H 'Content-Type: application/json' \
4
  -d '{
5
    "query": {
6
      "range": {
7
        "timestamp": {
8
          "gte": "now-1h"
9
        }
10
      }
11
    }
12
  }'

1. Regular Updates#

Keep the plugin updated:

1
# Check for updates
2
./opensearch-dashboards-plugin list --updates
3

4
# Update plugin
5
./opensearch-dashboards-plugin remove securityAnalyticsDashboards
6
./opensearch-dashboards-plugin install securityAnalyticsDashboards

2. Backup Configuration#

Regularly backup your configurations:

1
# Backup rules and detectors
2
curl -X GET "https://localhost:9200/_plugins/_security_analytics/rules/_export" \
3
  -o security-rules-backup.json
4

5
curl -X GET "https://localhost:9200/_plugins/_security_analytics/detectors/_export" \
6
  -o security-detectors-backup.json

3. Monitor Performance#

Track plugin performance:

1
# Monitor resource usage
2
curl -X GET "https://localhost:9200/_nodes/stats/breaker?pretty"
3

4
# Check detector performance
5
curl -X GET "https://localhost:9200/_plugins/_security_analytics/stats"