I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution such as SIEMonster, but nonetheless Elastic Stack. I have also made the assumption that input for Logstash is either Beat, more precisely Filebeat, or GELF.
I have no idea on which port it might be running and the possible IP range is quite big. So what I need is a way to check if a given host is running Logstash input plugin on any port, and do a comprehensive research on those hosts for further analysis.
Since there is not much information online about how to approach this problem, I have decided to install Elastic Stack on my machine and see what results it gives me when I inspect it externally. I have set-up Filebeat to run on port 5044, along with Elasticsearch on 9200 and Logstash on 9600. I have checked output in Kibana and everything works as it should.
Curl requests to port 9200 and 9600 return expected answers, but 5044 returns connection reset by peer failure. I am able to connect to 5044 via telnet but I have no idea what to send in order to receive an answer.
Does anyone have an idea on how to approach this problem? Also, am I trying to tackle it from a wrong direction?