2026-06-03 SIEM Elasticsearch Kibana Ubuntu

Building a Home SIEM: Elasticsearch & Kibana Setup

This is my writeup of deploying a full ELK-based SIEM stack on an Ubuntu VM in my home lab. It covers the install, the authentication problems I ran into with Elasticsearch 8.x, and how I fixed them. Nothing was smooth — and that's the point.

Environment

Here's what my lab looks like:

Hypervisor: VMware (VMs migrated to Samsung 970 EVO Plus SSD)
SIEM VM: Ubuntu Server — hostname siem-server / soc-lab
IP: 192.168.131.134/24 — Gateway: 192.168.131.2
Windows Server VM: target machine running Sysmon64 for telemetry

Installing Elasticsearch

First step was importing the Elastic GPG key and adding the repo:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

sudo apt update && sudo apt install elasticsearch -y

When Elasticsearch 8.x installs, it prints a built-in elastic user password to the terminal. Save it immediately — I didn't and paid for it later.

Installing Kibana

sudo apt install kibana -y

Enable and start both services:

sudo systemctl enable elasticsearch kibana
sudo systemctl start elasticsearch kibana

The Problem — Authentication Errors

⚠ Error

Kibana was refusing to connect to Elasticsearch. The logs showed authentication failures — Kibana couldn't authenticate against the Elasticsearch security layer that's enabled by default in version 8.x.

Elasticsearch 8.x ships with security enabled by default (TLS + authentication). This breaks the old way of just pointing Kibana at localhost:9200 with no credentials.

The Fix — Reset Credentials

Step 1: Reset the elastic user password

sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

Save the new password it gives you.

Step 2: Generate a Kibana enrollment token

sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

Step 3: Run the Kibana setup

sudo /usr/share/kibana/bin/kibana-setup

Paste the enrollment token when prompted. This configures Kibana to authenticate properly with Elasticsearch.

Step 4: Restart both services

sudo systemctl restart elasticsearch kibana

✓ Result

After restarting, Kibana came up successfully at http://192.168.131.134:5601. Logged in with the elastic user and the reset password. SIEM stack is live.

elasticsearch.yml — Key Config

One thing that caused extra pain: duplicate keys and typos in /etc/elasticsearch/elasticsearch.yml. Elasticsearch will silently fail or behave unexpectedly with bad YAML. My working minimal config:

cluster.name: soc-lab
node.name: siem-server
network.host: 0.0.0.0
http.port: 9200
discovery.type: single-node

💡 Lesson learned

Never have duplicate keys in your YAML config. Always validate with sudo -u elasticsearch /usr/share/elasticsearch/bin/elasticsearch --version after changes to catch config errors early.

What's Next

Configure Winlogbeat on the Windows Server VM to ship Sysmon logs to Elasticsearch
Build detection rules in Kibana for suspicious process creation and network connections
Set up index lifecycle management to handle log retention

This is part of my ongoing home lab documentation. Everything here is self-built and self-troubleshot. If you hit the same issues, I hope this saves you some time.