https://github.com/StamusNetworks/KTS6

Kibana 6 Templates for Suricata IDPS Threat Hunting
https://github.com/StamusNetworks/KTS6

Last synced: 3 months ago
JSON representation

Kibana 6 Templates for Suricata IDPS Threat Hunting

• Host: GitHub
• URL: https://github.com/StamusNetworks/KTS6
• Owner: StamusNetworks
• License: gpl-3.0
• Created: 2018-09-27T12:30:00.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2019-03-05T10:22:42.000Z (almost 6 years ago)
• Last Synced: 2024-04-15T02:10:11.641Z (9 months ago)
• Language: Python
• Size: 129 KB
• Stars: 25
• Watchers: 10
• Forks: 6
• Open Issues: 5
• Metadata Files:
  • Readme: README.rst
  • License: LICENSE

Awesome Lists containing this project

• awesome-suricata - KTS6 - Kibana 6 Templates for Suricata IDPS Threat Hunting. (Dashboards and Templates)

README

        
===============================

Kibana 6 Templates for Suricata

===============================

Templates/Dashboards for Kibana 6 to use with Suricata IDPS threat hunting and the ELK 6 stack

This repository provides 21 templates for the Kibana 6.x and Elasticsearch 6.x

for use with Suricata IDS/IPS/ - Intrusion Detection, Intrusion Prevention and Network Security Monitoring system

These dashboards are for use with Suricata 4.1+ and enabled Rust build, Elasticsearch, Logstash, 

Kibana 6 and comprise of more than 200 visualizations and 15 predefined searches.

The dashboards are:

 - SN-ALERTS

 - SN-ALL

 - SN-DHCP

 - SN-DNS

 - SN-DNP3

 - SN-FILE-Transactions

 - SN-FLOW

 - SN-HTTP

 - SN-IDS

 - SN-IKEv2

 - SN-KRB5

 - SN-NFS

 - SN-OVERVIEW

 - SN-SMB

 - SN-SMTP

 - SN-SSH

 - SN-STATS

 - SN-TLS

 - SN-VLAN

 - SN-TFTP

 - SN-TrafficID

 

How to use

==========

::

     apt-get install git-core

     git clone https://github.com/StamusNetworks/KTS6.git

     cd KTS6

     

Load the dashboards: ::

 ./load.sh

 

You would need to select ``logstash-*`` as a default index once you open any dashboard for the first time after initial load/import.  

A similar to this logstash template could be used - https://github.com/StamusNetworks/SELKS/blob/SELKS5/staging/etc/logstash/conf.d/logstash.conf

For optimal results an example of elasticsearch template has been included under ``es-template\elasticsearch6-template.json`` that is used in SELKS 5.

**NOTE:**  

This will delete any custom dashboards you already have in place. 

**NOTE:**  

In order to use the full HTTP logging dashboard template you need to set up Suricata as

explained here - http://www.pevma.blogspot.se/2014/06/http-header-fields-extended-logging.html  

**NOTE:**  

If the traffic you are inspecting contains vlans - in order to use the VLAN template, make sure you have enabled vlan tracking in ``suricata.yaml`` -

     vlan:

       use-for-tracking: true

**NOTE:**  

For best user experience use with 1680 x 1050 screen resolution!!  

Do not hesitate to test,feedback and contribute !