Technical tip: Mitigating log4j Vulnerability impa... - Fortinet Community

FortiMonitor

FortiMonitor is a holistic, SaaS-based digital experience and network performance monitoring solution which combines monitoring, network incident management, automation, and network configuration management into a single source of truth

Description This article describes the mitigation steps for the Apache log4j Vulnerability's effect on ElastiFlow 4 and 5.

Scope ElastiFlow versions 4 and 5

Solution

To mitigate the vulnerability, perform the following steps:

Create /etc/elasticsearch/jvm.options.d/log4j2.options file with the content:
-Dlog4j2.formatMsgNoLookups=true
Run systemctl restart elasticsearch to restart Elasticsearch.
If you are using ElastiFlow version 4, run: zip -q -d /opt/elk/logstash-latest/logstash-core/lib/jars/log4j-core-2.* org/apache/logging/log4j/core/lookup/JndiLookup.class

For more information, see this post from Elastic.

95

Contributors