Beats Connector

Integration Guide for Bloo SIEM

Overview

Beats integrates with Bloo SIEM using the Beats Connector. Beats are open source, lightweight data shippers that you install as agents on your servers. They send operational data directly to the Bloo Beats Connector for centralised log collection and analysis.

Bloo supports all available OSS Beats and recommends:

• Winlogbeat — for Windows event logs
• Auditbeat — for Linux systems

The full list of supported Beats:

• Auditbeat — Linux audit logs
• Filebeat — log file forwarding
• Metricbeat — system and service metrics
• Winlogbeat — Windows event logs

Step 1 — Configure the Beats Connector in Bloo

All connector configuration is done from the Datasource page in Bloo.

Field	Description
Connector Name	Enter a name for this connector.
Host Port	Enter the port number on which you want to configure this connector.
Beats User	Enter a username for authentication. Note: Save this username — it will be required when configuring Winlogbeat and Auditbeat on your servers.
Beats Token	This token is generated automatically by Bloo. Note: Save this token immediately — it is used as the password when configuring Winlogbeat and Auditbeat on your servers.

⚠ Save your Beats User (username) and Beats Token (password) before leaving this page. You will need both values when configuring each Beat agent on your servers.

Note: The username and password generated here are required when configuring each Beat. Each Beat is a separately installable product.

• Click Save after entering all the required details.
• Bloo will validate the configuration automatically.
• Once saved, go to Collection Status to confirm the connector is listed with a status of Active.

✓ When the connector appears in Collection Status with status Active, it is configured successfully and ready to receive data.

Auditbeat

About Auditbeat

• Auditbeat is a lightweight shipper that audits user and process activities on a server.
• It collects and centralises audit events from the Linux Audit Framework.
• It detects changes to critical files (such as binaries and configuration files) and helps identify potential security policy violations.

Installation

• Download Auditbeat OSS from the Elastic website.
• After installation, locate and open the configuration file at: /etc/auditbeat/auditbeat.yml
• In the file, find the Outputs section, then locate the Elasticsearch Output block.
• Update the Elasticsearch Output block with your Bloo connector details:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://<adapter_ip_address>:<port>"]
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
  ssl.enable: true
  ssl.verification_mode: none
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: ""
  password: ""Copy

Field	Description
ip_address	Enter the IP address of the adapter where the Beats Connector is configured in Bloo.
Port	Enter the same port number you provided when configuring the Beats Connector in Bloo.
Username	Enter the same username (Beats User) you provided when configuring the Beats Connector in Bloo.
Password	Enter the token (Beats Token) that was automatically generated when configuring the Beats Connector in Bloo.

Managing the Auditbeat Service (Linux systemd)

Auditbeat includes a systemd service unit for Linux. Use the following commands to manage it:

• Start: systemctl start auditbeat
• Stop: systemctl stop auditbeat
• Status: systemctl status auditbeat

By default, the Auditbeat service starts automatically on system boot.

• Enable auto-start: systemctl enable auditbeat
• Disable auto-start: systemctl disable auditbeat

ℹ Note for Linux hosts forwarding logs:

• Auditbeat is the log source for Linux hosts.
• The TCP output plugin is used to forward logs to Bloo.
• If Winlogbeat is also being forwarded to Logstash, the same approach applies.

Filebeat

About Filebeat

Filebeat is a lightweight shipper for forwarding and centralising log data. Installed as an agent on your servers, Filebeat monitors the log files or locations you specify, collects log events, and forwards them to the Beats Connector in Bloo.

Installation

1. Download Filebeat OSS from the Elastic website.
2. After installation, locate and open the configuration file at: /etc/filebeat/filebeat.yml
3. In the file, find the Outputs section, then locate the Elasticsearch Output block.
4. Update the Elasticsearch Output block with your Bloo connector details:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://<adapter_ip_address>:<port>"]
  #hosts: ["localhost:9200"]
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
  ssl.enable: true
  ssl.verification_mode: none
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: ""
  password: ""Copy

• In the same file, locate the Filebeat inputs section and set enabled to true:

filebeat.inputs:
  # Each - is an input. Most options can be set at the input level, so
  # you can use different inputs for various configurations.
  # Below are the input specific configurations.
  - type: log
    # Change to true to enable this input configuration.
    enabled: trueCopy

Field	Description
ip_address	Enter the IP address of the adapter where the Beats Connector is configured in Bloo.
Port	Enter the same port number you provided when configuring the Beats Connector in Bloo.
Username	Enter the same username (Beats User) you provided when configuring the Beats Connector in Bloo.
Password	Enter the same password (Beats Token) you provided when configuring the Beats Connector in Bloo.

Managing the Filebeat Service (Linux systemd)

Filebeat includes a systemd service unit for Linux. Use the following commands to manage it:

• Start: systemctl start Filebeat
• Stop: systemctl stop Filebeat
• Status: systemctl status Filebeat

By default, the Filebeat service starts automatically on system boot.

• Enable auto-start: systemctl enable Filebeat
• Disable auto-start: systemctl disable Filebeat

Metricbeat

About Metricbeat

Metricbeat is a lightweight shipper that you can install on your servers to periodically collect metrics from the operating system and from services running on the server. It ships the metrics and statistics it collects to the Beats Connector in Bloo.

Installation

1. Download Metricbeat OSS from the Elastic website.
2. After installation, locate and open the configuration file at: /etc/metricbeat/metricbeat.yml
3. In the file, find the Outputs section, then locate the Elasticsearch Output block.
4. Update the Elasticsearch Output block with your Bloo connector details:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://<adapter_ip_address>:<port>"]
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
  ssl.enable: true
  ssl.verification_mode: none
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: ""
  password: ""Copy

Field	Description
ip_address	Enter the IP address of the adapter where the Beats Connector is configured in Bloo.
Port	Enter the same port number you provided when configuring the Beats Connector in Bloo.
Username	Enter the same username (Beats User) you provided when configuring the Beats Connector in Bloo.
Password	Enter the same password (Beats Token) you provided when configuring the Beats Connector in Bloo.

Managing the Metricbeat Service (Linux systemd)

Metricbeat includes a systemd service unit for Linux. Use the following commands to manage it:

• Start: systemctl start metricbeat
• Stop: systemctl stop metricbeat
• Status: systemctl status metricbeat

By default, the Metricbeat service starts automatically on system boot.

• Enable auto-start: systemctl enable metricbeat
• Disable auto-start: systemctl disable metricbeat

Winlogbeat

About Winlogbeat

• Winlogbeat ships Windows event logs to the Beats Connector in Bloo. It runs as a Windows service.
• It reads from one or more Windows event logs using Windows APIs and filters events based on user-configured criteria before forwarding them to Bloo.
• Winlogbeat watches event logs continuously so that new event data is sent in a timely manner.
• The read position for each event log is saved to disk, allowing Winlogbeat to resume correctly after a restart.
• Winlogbeat can capture event data from any event logs on your system — including application, hardware, security, and system events.

Installation

1. Download the Winlogbeat zip file from: Winlogbeat OSS
2. Extract the contents into C:\Program Files.
3. Rename the extracted folder to Winlogbeat.
4. Open a PowerShell prompt as Administrator (right-click the PowerShell icon and select Run As Administrator).
5. From the PowerShell prompt, run the following commands to install the Windows service:

cd 'C:\Program Files\Winlogbeat'
.\install-service-winlogbeat.ps1Copy

• Open the Winlogbeat configuration file (winlogbeat.yml) and update the Elasticsearch Output block:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://<adapter_ip_address>:<port>"]
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
  ssl.enable: true
  ssl.verification_mode: none
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: ""
  password: ""Copy

Field	Description
ip_address	Enter the IP address of the adapter where the Beats Connector is configured in Bloo.
Port	Enter the same port number you provided when configuring the Beats Connector in Bloo.
Username	Enter the same username (Beats User) you provided when configuring the Beats Connector in Bloo.
Password	Enter the same password (Beats Token) you provided when configuring the Beats Connector in Bloo.

Verify, Set Up, and Start Winlogbeat

• Test your configuration file:

.\winlogbeat.exe test config -c .\winlogbeat.yml -eCopy

• Load predefined assets (parsing, indexing, and visualisation) from the installation directory:

.\winlogbeat.exe setup -eCopy

• Start the Winlogbeat service:

C:\Program Files\Winlogbeat\> Start-Service winlogbeatCopy

• To view the service status, launch the Windows Services management console:

C:\Program Files\Winlogbeat\> services.mscCopy

• To stop the Winlogbeat service:

C:\Program Files\Winlogbeat\> Stop-Service winlogbeatCopy

Related Links

Bloo — Collection Status | Bloo — Connector Validation | Beats Troubleshooting

Auditbeat OSS Download | Filebeat OSS Download | Metricbeat OSS Download | Winlogbeat OSS Download