Enumerating hosts running Elastic Stack

Question

I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution such as SIEMonster, but nonetheless Elastic Stack. I have also made the assumption that input for Logstash is either Beat, more precisely Filebeat, or GELF.

I have no idea on which port it might be running and the possible IP range is quite big. So what I need is a way to check if a given host is running Logstash input plugin on any port, and do a comprehensive research on those hosts for further analysis.

Since there is not much information online about how to approach this problem, I have decided to install Elastic Stack on my machine and see what results it gives me when I inspect it externally. I have set-up Filebeat to run on port 5044, along with Elasticsearch on 9200 and Logstash on 9600. I have checked output in Kibana and everything works as it should.

Curl requests to port 9200 and 9600 return expected answers, but 5044 returns connection reset by peer failure. I am able to connect to 5044 via telnet but I have no idea what to send in order to receive an answer.

Does anyone have an idea on how to approach this problem? Also, am I trying to tackle it from a wrong direction?

Answer 1

You want to run a port scanner. The king of port scanners is nmap.

You can configure it to scan a range of IPs on a selection of ports. Test it on your machine first, from another machine, to see how the results behave. If you get useful results, then scan the IPs you want to inspect.

There are lots of considerations, though. Like firewalls, routing, subnets, etc. But those are networking concerns.