Technical tip: Mitigating log4j Vulnerability impa...

FortiMonitor

FortiMonitor is a holistic, SaaS-based digital experience and network performance monitoring solution which combines monitoring, network incident management, automation, and network configuration management into a single source of truth

Article Id 203459

Description This article describes the mitigation steps for the Apache log4j Vulnerability's effect on ElastiFlow 4 and 5.

Scope ElastiFlow versions 4 and 5

Solution

To mitigate the vulnerability, perform the following steps:

Create /etc/elasticsearch/jvm.options.d/log4j2.options file with the content:
-Dlog4j2.formatMsgNoLookups=true
Run systemctl restart elasticsearch to restart Elasticsearch.
If you are using ElastiFlow version 4, run: zip -q -d /opt/elk/logstash-latest/logstash-core/lib/jars/log4j-core-2.* org/apache/logging/log4j/core/lookup/JndiLookup.class

For more information, see this post from Elastic.

525

Contributors

gioguinto
Anonymous

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical tip: Mitigating log4j Vulnerability impact on Elastiflow 4 and 5