ELK Stack Integration

ELK Stack Integration with TigerTrust

TigerTrust integrates with the Elastic Stack for comprehensive certificate log management and analysis.

Logstash Configuration

Configure Logstash to receive TigerTrust events:

ruby
1input {
2  http {
3    port => 8080
4    codec => json
5    tags => ["tigertrust"]
6  }
7}
8
9filter {
10  if "tigertrust" in [tags] {
11    date {
12      match => ["timestamp", "ISO8601"]
13    }
14
15    mutate {
16      add_field => {
17        "[@metadata][index]" => "tigertrust-certificates"
18      }
19    }
20  }
21}
22
23output {
24  if "tigertrust" in [tags] {
25    elasticsearch {
26      hosts => ["elasticsearch:9200"]
27      index => "%{[@metadata][index]}-%{+YYYY.MM}"
28    }
29  }
30}

Index Template

Create an optimized index template:

json
1{
2  "index_patterns": ["tigertrust-*"],
3  "template": {
4    "settings": {
5      "number_of_shards": 2,
6      "number_of_replicas": 1
7    },
8    "mappings": {
9      "properties": {
10        "timestamp": {"type": "date"},
11        "event_type": {"type": "keyword"},
12        "certificate": {
13          "properties": {
14            "common_name": {"type": "keyword"},
15            "issuer": {"type": "keyword"},
16            "serial_number": {"type": "keyword"},
17            "expiry_date": {"type": "date"},
18            "days_until_expiry": {"type": "integer"}
19          }
20        },
21        "environment": {"type": "keyword"},
22        "user": {"type": "keyword"},
23        "action": {"type": "keyword"},
24        "result": {"type": "keyword"}
25      }
26    }
27  }
28}

Kibana Dashboards

Import pre-built Kibana dashboards:

• Certificate Overview: Inventory, status distribution, expiration timeline
• Audit Trail: All certificate operations with filters
• Compliance Report: Policy violations, non-compliant certificates
• Trend Analysis: Certificate counts, renewal rates over time

Kibana Queries

Search certificate data with KQL:

text
1# Find expiring production certificates
2certificate.environment: "production" AND certificate.days_until_expiry < 30
3
4# Search for specific issuer
5certificate.issuer: "DigiCert*"
6
7# Find failed renewals
8event_type: "renewal" AND result: "failure"
9
10# Audit trail for specific certificate
11certificate.common_name: "api.example.com"

Index Lifecycle Management

Configure ILM for certificate logs:

json
1{
2  "policy": {
3    "phases": {
4      "hot": {
5        "actions": {
6          "rollover": {
7            "max_size": "50GB",
8            "max_age": "30d"
9          }
10        }
11      },
12      "warm": {
13        "min_age": "30d",
14        "actions": {
15          "shrink": {"number_of_shards": 1},
16          "forcemerge": {"max_num_segments": 1}
17        }
18      },
19      "cold": {
20        "min_age": "90d",
21        "actions": {
22          "freeze": {}
23        }
24      },
25      "delete": {
26        "min_age": "365d",
27        "actions": {
28          "delete": {}
29        }
30      }
31    }
32  }
33}

Watcher Alerts

Set up alerting for certificate events:

json
1{
2  "trigger": {
3    "schedule": {"interval": "1h"}
4  },
5  "input": {
6    "search": {
7      "request": {
8        "indices": ["tigertrust-*"],
9        "body": {
10          "query": {
11            "bool": {
12              "filter": [
13                {"term": {"event_type": "expiration_warning"}},
14                {"range": {"timestamp": {"gte": "now-1h"}}}
15              ]
16            }
17          }
18        }
19      }
20    }
21  },
22  "condition": {
23    "compare": {"ctx.payload.hits.total.value": {"gt": 0}}
24  },
25  "actions": {
26    "email_admin": {
27      "email": {
28        "to": "[email protected]",
29        "subject": "Certificate Expiration Warning",
30        "body": "{{ctx.payload.hits.total.value}} certificates expiring soon"
31      }
32    }
33  }
34}

Achieve comprehensive certificate analytics with ELK Stack and TigerTrust.