ElastiFlow is a great open source NetFlow analyzer that works with Elastic Stack (formerly ELK Stack). Of all the netflow tools I’ve tested it has, by far, the best visualizations. However, if like me you aren’t familiar with Elastic Stack the setup can be rather intimidating. In this tutorial, I hope to make it easier for you and everyone who wants to use this awesome tool.

This tutorial is broken up into 4 parts. One for installing the Ubuntu server. One for installing and configuring Elastic Stack. One on how to implement ElastiFlow on top of it all. And finally one on how to properly maintain the solution.

Part 1: Installing Ubuntu
Part 2: Installing Elastic Stack
Part 3: Install ElastiFlow
Part 4: Solution Maintenance (coming soon)

Install and Setup of Ubuntu Server 18.04

I performed my installation of Ubuntu Sever using the latest version of 18.04 on a Hyper-V virtual machine (VM), but the instructions will be the same regardless of what hypervisor you are using. The VM had 40GB hard drive and 4GB of RAM.

Install Ubuntu 18.04

1. Download Ubuntu server https://www.ubuntu.com/download/server
   Note: I found downloading the BitTorrent was actually much faster than downloading directly from the Ubuntu servers. https://www.ubuntu.com/download/alternative-downloads
2. Create a new VM with a 40GB hard disk and at least 4GB of RAM.
3. Insert the install media and start the VM.
4. Select your preferred language
   
5. Select your keyboard layout
   
6. Choose Install Ubuntu
   
7. At this set you have the choose to stick with DHCP or use a static address. If you choose to use a static address it is best to set it up now, as it provides a nice easy interface to set it here.
   
8. Configure a proxy address if required
   
9. On the Filesystem setup screen select Use An Entire Disk
   
10. Press Enter to accept the default disk
    
11. Select Done
    
12. Select Continue
    
13. Create a name for your server and setup the username and password for the root user
    
14. Wait for the installation to complete
    
15. When prompted select Reboot Now
    
16. If prompted eject the installation media from the VM and press Enter to continue booting
    

Setup Ubuntu for ElastiFlow

If you set your IP address during the installation process the only remaining setup action is to install and configure SSH. This will allow you to use a tool like Putty to connect to the server and more easily configure the items in part 2 and 3. (copy and paste FTW!)

1. Log into the VM using the username and password you created during the setup process
2. Install SSH using the command below:
   

   sudo add-apt-repository -y ssh

3. Start the SSH service so you can connect to the server
   

   service ssh status

4. On another computer open your preferred SSH client. I recommend PuTTY if you don’t have one. (https://www.putty.org/)
5. Enter the IP address of your server, set the port to 22, select SSH connection type, and click OK
   
6. If you receive a Security Warning click Yes
   

You are now all set to start the installation process.

Part 2: Installing Elastic Stack