Sweet Security Cloud for FREE

This page will guide how to migrate to minimal working sweet security system with minimal cost and maximum performance.

Implementation principles:

1. Using hosted ELK solutions to show and alert on the BroIDS logs
2. Minimal managemnt console to control the devices

Requirements:

1. A local RPI
2. A GCP micro instance (always free instance even after the trial expires)
3. An ELK hosted account (can be a free account)

Changes required for that:

1. Install normally (RPI + SMALL instance in GCP) - See the sweet security WIKI for that
2. Change logstash to send data to a free ELK service (for example logz.io)
3. Open a free hosted Elastic instance (For example in bonsai.io)
4. Migrate Elastic indexes [sweet_security, sweet_security_alerts, tardis] to the new hosted cluster. Use elasticdump for the migration
5. Change the ES connection under the files in /var/www/ to point to the new ES cluster
6. Stop and disable the following services: elasticsearch, kibana, sweet_security_server
7. Stop the GCP instance
8. Change GCP instance to micro and start it

Issues: the Baseliner (which feeds the tardis index in the ES) will not work, as a result the following will not work

• Alerts
• Baseline information in devices