https://github.com/StamusNetworks/KTS

Kibana 4 Templates for Suricata IDPS
https://github.com/StamusNetworks/KTS

Last synced: about 1 month ago
JSON representation

Kibana 4 Templates for Suricata IDPS

• Host: GitHub
• URL: https://github.com/StamusNetworks/KTS
• Owner: StamusNetworks
• License: gpl-3.0
• Created: 2016-03-12T00:26:50.000Z (almost 9 years ago)
• Default Branch: master
• Last Pushed: 2016-07-28T10:43:58.000Z (over 8 years ago)
• Last Synced: 2024-08-02T07:11:35.447Z (4 months ago)
• Language: Shell
• Homepage:
• Size: 178 KB
• Stars: 33
• Watchers: 12
• Forks: 14
• Open Issues: 3
• Metadata Files:
  • Readme: README.rst
  • License: LICENSE

Awesome Lists containing this project

• awesome-suricata - KTS - Kibana 4 Templates for Suricata IDPS Threat Hunting. (Dashboards and Templates)

README

        
===============================

Kibana 4 Templates for Suricata

===============================

Templates/Dashboards for Kibana 4 to use with Suricata IDPS and the ELK stack

This repository provides 11 templates for the Kibana 4.4 and Elasticsearch 2.x

for use with Suricata IDS/IPS - Intrusion Detection and Prevention System.

These dashboards are for use with Suricata and ELK - Elasticsearch, Logstash, 

Kibana and comprise of more than 140 visualizations and 11 searches.

The dashboards are:

 - ALL  

 - ALERTS 

 - DNS  

 - FILE Transactions  

 - FLOW  

 - HTTP  

 - SMTP

 - SSH  

 - TLS

 - VLAN

 - STATS

How to use

==========

::

     apt-get install git-core

     git clone https://github.com/StamusNetworks/KTS.git

     cd KTS

     

Kibana 4.4.x needs to be patched in order to load the templates.

If you have installed Kibana in ``/opt/kibana`` for example: ::

 patch -p1 -d /opt/kibana/  < full/path/to/KTS/patches/kibana-integer.patch

 patch -p1 -d /opt/kibana/  < full/path/to//KTS/patches/timelion-integer.patch

**NOTE:**  The loading of the dashboards will ***delete and replace*** any previously exiting templates/visualizations. !!!

Load the dashboards: ::

 ./load.sh

Open the dashboards in Kibana

 - Open your Kibana web interface (ip.ip.ip.ip:5601), select default index

 - Right upper corner, Load -> Choose the desired dashboard

 - Load the desired template(s)

**NOTE:**  

In order to use the full HTTP logging dashboard template you need to set up Suricata as

explained here - http://www.pevma.blogspot.se/2014/06/http-header-fields-extended-logging.html  

**NOTE:**  

If the traffic you are inspecting contains vlans - in order to use the VLAN template, make sure you have enabled vlan tracking in ``suricata.yaml`` -

     vlan:

       use-for-tracking: true

**NOTE:**  

For best user experience use with 1680 x 1050 screen resolution!!  

Do not hesitate to test,feedback and contribute !