Building My SOC Lab #10 | Installing Elastic Fleet Server on Ubuntu

https://austinsangle.com In this episode of my SOC Lab build series, I install Elastic Fleet Server on Ubuntu and verify that the central management component of the lab is healthy and ready for future endpoint enrollment. The previous milestone focused on securely enrolling Kibana with Elasticsearch and exploring the management interface. This time, I move another layer deeper into the Elastic architecture by installing an Elastic Agent configured to run Fleet Server. Before installation, the SOC-UBU01 system has Elasticsearch listening on port 9200 and Kibana on port 5601. By the end of this milestone, Fleet Server is running on port 8220 and reporting healthy through Kibana. I use the x86_64 Elastic Agent package generated by Kibana, install the agent with the Fleet Server configuration, and then verify the installation from several different perspectives. In this video I: Resolve the Elastic Agent architecture mismatch by confirming x86_64 Install Elastic Agent with Fleet Server on Ubuntu Configure Fleet Server to connect securely to Elasticsearch Register Fleet Server with its Fleet policy Verify the elastic-agent system service with systemctl Check Elastic Agent's own component health with elastic-agent status Verify that Fleet Server is actually listening on TCP port 8220 Confirm Fleet Server registration from Kibana Verify that Fleet reports the Fleet Server agent as Healthy Check Fleet Server hosts in Kibana Identify the advertised Fleet Server URL: https://10.10.10.10:8220 Compare service-level, application-level, network-level, and Kibana-level verification Continue building the SOC lab's central management plane Keep installation credentials, tokens, and generated secrets out of screenshots and documentation One of the important concepts in this milestone is layered verification. A successful systemctl check tells us that the service is running, but that isn't enough by itself. The verification chain becomes: systemctl ↓ Is Elastic Agent running? elastic-agent status ↓ Are the managed components healthy? ss :8220 ↓ Is Fleet Server actually listening? Kibana → Fleet → Agents ↓ Does Fleet see the server as Healthy? Each check answers a different question. The architecture is now beginning to expand beyond Elasticsearch and Kibana: SOC-UBU01 ├── Elasticsearch :9200 ├── Kibana :5601 └── Fleet Server :8220 Fleet Server becomes the central management component that future Elastic Agents will communicate with. The next endpoint systems in the lab will eventually use this control plane for centralized agent management and telemetry collection. The Fleet Server hosts configuration is also important because the advertised address: https://10.10.10.10:8220 will eventually provide the control-plane endpoint that systems such as the domain controller and workstation can use to communicate with Fleet Server. This milestone intentionally stops after installation and verification. No Windows agents are deployed yet. The goal is to prove that the central Fleet management component works before adding more systems to the lab. I also continue practicing secure documentation habits. Generated service tokens, enrollment credentials, and other secrets are not treated as documentation material. Installation commands containing sensitive values are not captured or committed to GitHub. This series documents my journey as I learn cybersecurity by building a SOC lab from scratch. There is no narration—just my real workflow, occasional webcam footage, and lo-fi music while I work through each milestone. If you're learning Linux, cybersecurity, Elastic Stack, SIEM, blue-team security, or building your own SOC or homelab, I hope these build logs are helpful and motivating. Follow along as I build this SOC lab from scratch—one milestone at a time. New episodes cover the process from Linux administration and Elastic Stack deployment to Fleet management, endpoint telemetry, detection engineering, and security monitoring. #CyberSecurity #SOCLab #Ubuntu #Linux #ElasticStack #ElasticAgent #FleetServer #Fleet #Elasticsearch #Kibana #SIEM #BlueTeam #Homelab #SOCAnalyst #LinuxAdmin #LearningInPublic