Linux ELK & Snort Lab -- 2

I need a small-scale cyber-security lab built on a Linux host so I can walk students through hands-on threat-hunting exercises. The environment must combine a full ELK stack—Elasticsearch, Logstash and Kibana—with Snort acting as the network-based IDS that feeds alerts into the stack.

Here is what I’m after:

• Clean installation and basic hardening of the chosen Linux distribution (any mainstream flavour is fine as long as it is well documented).
• Proper configuration of Elasticsearch, Logstash and Kibana so logs flow end-to-end and visualisations load without errors.
• Snort set up in inline or tap mode, tuned just enough to generate meaningful alerts without drowning the lab in noise.
• Integration: Snort alerts forwarded to Logstash and indexed in Elasticsearch, visible in Kibana dashboards.
• A concise report (step-by-step) covering installation commands, config files, and a quick demo scenario that proves the pipeline works—think of it as a mini-lab manual my students can repeat.

I will spin up the VM myself; you simply supply any prerequisite specs before we start. Once the lab reproduces on my end exactly as in your report, the job is complete.