{"id":22021913,"url":"https://github.com/knightchaser/mini-opensearch-siem","last_synced_at":"2026-04-20T13:31:38.333Z","repository":{"id":263118041,"uuid":"889080318","full_name":"KnightChaser/mini-opensearch-siem","owner":"KnightChaser","description":"A simple nginx log data pipeline demonstration with Filebeat, Logstash, Python, and AWS/local OpenSearch.","archived":false,"fork":false,"pushed_at":"2024-11-23T07:08:55.000Z","size":50,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-23T10:26:47.099Z","etag":null,"topics":["data-pipeline","opensearch","siem"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KnightChaser.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-15T15:16:12.000Z","updated_at":"2024-11-25T12:37:22.000Z","dependencies_parsed_at":"2025-03-23T10:35:43.302Z","dependency_job_id":null,"html_url":"https://github.com/KnightChaser/mini-opensearch-siem","commit_stats":null,"previous_names":["knightchaser/mini-elk-siem","knightchaser/mini-opensearch-siem"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/KnightChaser/mini-opensearch-siem","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fmini-opensearch-siem","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fmini-opensearch-siem/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fmini-opensearch-siem/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fmini-opensearch-siem/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KnightChaser","download_url":"https://codeload.github.com/KnightChaser/mini-opensearch-siem/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fmini-opensearch-siem/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278910279,"owners_count":26067024,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-08T02:00:06.501Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["data-pipeline","opensearch","siem"],"created_at":"2024-11-30T06:16:17.456Z","updated_at":"2025-10-08T08:18:07.939Z","avatar_url":"https://github.com/KnightChaser.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mini-opensearch-siem\n\nA simple demonstration of SIEM for small NGINX web server, building a simple data pipeline with Filebeat, Logstash, OpenSearch(local installation or AWS instance), and Python.\n\n### Preview\n\n![image](https://github.com/user-attachments/assets/2c46659f-2e04-483c-9085-f8dad97c412d)\n\n![image](https://github.com/user-attachments/assets/b68d73ad-829e-40b7-a383-00e15fdab569)\n\n### Installation\n\nInstall `filebeat`, `logstash`, and `nginx` on your Linux system. Refer to the `/configuration` directory and configure those daemons with the given configuration files. You may adjust it if you want. Also, make an OpenSearch instance which is accessible.\n\nCreate `.env` at the project directory and configure like below:\n\n```env\n# Logstash configuration\nLOGSTASH_SOURCE_HOST=127.0.0.1\nLOGSTASH_SOURCE_PORT=9999\n\n# OpenSearch configuration\nOPENSEARCH_URL=https://127.0.0.1:9200\nOPENSEARCH_INDEX=nginx-logs\nOPENSEARCH_USERNAME=admin\nOPENSEARCH_PASSWORD=OpenSearch2024##\nOPENSEARCH_VERIFY_CERTS=False\n```\n\n- If you're using AWS OpenSearch, set `OPENSEARCH_VERIFY_CERTS` to `true` since AWS provides necessary web security configurations such as web certificates.\n- If you're using local installation of OpenSearch, adjust that option dynamically depending on whether you manually configured certificates or not.\n\nDetails can be found on the codes and configuration files, wouldn't be so complicated. Note that, this code is still an example, only for showing that this works and may give you an idea of operating SIEM with OpenSearch. You can freely develop, improve, and fix this for your own freely!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Fmini-opensearch-siem","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fknightchaser%2Fmini-opensearch-siem","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Fmini-opensearch-siem/lists"}