Quick Start

Nybble platform installation overview
Nybble quick start steps and components

1. Nybble

A CentOS 7/8 server is recommended to install Nybble as installation script and recommended settings have been made for CentOS:

Nybble can still be installed manually on other distributions.

2. Kafka

Nybble use Kafka to consume security events. Get Kafka installed and configured by following these guides:

3. Elasticsearch

Processed events and alerts will be sent to Elasticsearch for indexing. Once events have been indexed, Kibana is used for visualization and investigation.

Get Elasticsearch installed and configured by following these guides:

4. Sigma Rules

Once Kafka and Elasticsearch are up and running, Nybble can be configured:

Then Sigma rules can be pushed to rules folder and field mapping can be done:

5. Events

Send JSON formatted events to Kafka: