Simple vagrant with Elastic Stack SIEM

Vagrantfile

# -*- mode: ruby -*-
# vi: set ft=ruby :

Vagrant.configure("2") do |config|

  config.vm.define "elk" do |elk|
    
      elk.vm.box = "ubuntu/focal64"
      elk.vm.hostname = "elk.lan"

      # elk.vm.box_check_update = false
      # elk.vm.network "forwarded_port", guest: 80, host: 8080

      # via 127.0.0.1 to disable public access
      elk.vm.network "forwarded_port", guest: 9200, host: 9200, host_ip: "127.0.0.1"
      elk.vm.network "forwarded_port", guest: 5601, host: 5601, host_ip: "127.0.0.1"

      elk.vm.network "private_network", ip: "192.168.33.10"

      # elk.vm.network "public_network"

      # elk.vm.synced_folder "../data", "/vagrant_data"

      elk.vm.provider "virtualbox" do |vb|
        # Display the VirtualBox GUI when booting the machine
        # vb.gui = true
      
        # Customize the amount of memory on the VM:
        vb.memory = "4096"
        vb.name = "elk"
        vb.linked_clone = true
        vb.cpus = 2
      end

      elk.vm.provision "shell", inline: <<-SHELL
        apt-get update
        apt install kafkacat

        #install docker
        sudo apt-get install \
          ca-certificates \
          curl \
          gnupg \
          lsb-release
          sudo mkdir -p /etc/apt/keyrings
          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
          echo \
          "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
          $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
          sudo apt-get update
          sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
          sudo apt-get install -y open-vm-tools

        #add elastic repo
        wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
        sudo apt-get install apt-transport-https
        echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
        sudo apt-get update

        #provisioning elk
        cd /opt/
        git clone https://github.com/zorteran/elastic-stack-docker-boilerplate.git
        cd elastic-stack-docker-boilerplate/
        docker compose up -d elasticsearch
        sleep 60
        docker exec elasticsearch /bin/bash -c "bin/elasticsearch-setup-passwords auto --batch --url https://localhost:9200" >> creds.txt
        NEW_PASS=$(cat creds.txt | grep "PASSWORD kibana_system" | awk '{print substr($0,length($0)-19,length($0))}')
        sed -i "s/CHANGE_ME_PLS/$NEW_PASS/" docker-compose.yml
        docker compose up -d kibana

        #add etc hosts entry (KISS)
        echo "192.168.33.11 kafka.lan" >> /etc/hosts
      SHELL
    end

   

  end