Stamus Labs - Kibana Dashboards

What are Kibana Dashboards?

Kibana is the flexible visualization tool from Elastic. It is typically bundled with Elasticsearch and Logstash, forming the "ELK stack."

Kibana dashboards are collections of charts, graphs, tables, and other visualizations of key insights from chosen datasets.

Stamus Labs has created nearly 30 dashboards for use with data generated by Suricata and a companion ELK (now Elastic) stack.

These dashboards are also bundled with the open-source Suricata-based IDS/NSM and threat hunting system from Stamus Networks, called SELKS.

An example: the SN-Hunt-1 dashboard

The most popular Kibana Dashboard in SELKS is the SN-Hunt-1 dashboard, which is specifically developed for Incident response or threat hunting. It is most useful for IP/host investigation and malware case review through PCAP ingestion.

The SN-Hunt-1 dashboard can provide an overview of pcap file content, including application protocols, source and destination IPs, and related network protocol and flow data broken down in interesting metadata visualizations that populate depending on the data reviewed. It also includes really helpful visualizations that are designed to help analysts quickly pivot to identify potentially malicious activity and investigate it further.

Additional Resources

Analyzing Network Traffic with Kibana in SELKS: the SN-Hunt-1 Dashboard - Part 1

Analyzing Network Traffic with Kibana in SELKS: the SN-Hunt-1 Dashboard - Part 2

Analyzing Network Traffic with Kibana Dashboards in SELKS: the SN-Hunt-1 Dashboard - Part 3

Use SELKS to solve the Unit 42 Wireshark Quiz

ABOUT STAMUS NETWORKS

Stamus Networks believes in a world where defenders are heroes, and a future where those they protect remain safe. As organizations face threats from well-funded adversaries, we relentlessly pursue solutions that make the defender’s job easier and more impactful. The global leader in Suricata-based network security solutions, Stamus Networks helps enterprise security teams know more, respond sooner and mitigate their risk with insights gathered from cloud and on-premise network activity. Our Stamus Security Platform combines the best of intrusion detection (IDS), network security monitoring (NSM), and network detection and response (NDR) systems into a single solution that exposes serious and imminent threats to critical assets and empowers rapid response.

Kibana Dashboards for Suricata