Templates/Dashboards for Kibana 4 to use with Suricata IDPS and the ELK stack
This repository provides 11 templates for the Kibana 4.4 and Elasticsearch 2.x for use with Suricata IDS/IPS - Intrusion Detection and Prevention System.
These dashboards are for use with Suricata and ELK - Elasticsearch, Logstash, Kibana and comprise of more than 140 visualizations and 11 searches.
The dashboards are:
- ALL
- ALERTS
- DNS
- FILE Transactions
- FLOW
- HTTP
- SMTP
- SSH
- TLS
- VLAN
- STATS
apt-get install git-core git clone https://github.com/StamusNetworks/KTS.git cd KTS
Kibana 4.4.x needs to be patched in order to load the templates.
If you have installed Kibana in /opt/kibana for example:
patch -p1 -d /opt/kibana/ < full/path/to/KTS/patches/kibana-integer.patch patch -p1 -d /opt/kibana/ < full/path/to//KTS/patches/timelion-integer.patch
NOTE: The loading of the dashboards will *delete and replace* any previously exiting templates/visualizations. !!!
Load the dashboards:
./load.sh
Open the dashboards in Kibana
- Open your Kibana web interface (ip.ip.ip.ip:5601), select default index
- Right upper corner, Load -> Choose the desired dashboard
- Load the desired template(s)
NOTE: In order to use the full HTTP logging dashboard template you need to set up Suricata as explained here - http://www.pevma.blogspot.se/2014/06/http-header-fields-extended-logging.html
NOTE:
If the traffic you are inspecting contains vlans - in order to use the VLAN template, make sure you have enabled vlan tracking in suricata.yaml -
- vlan:
- use-for-tracking: true
NOTE: For best user experience use with 1680 x 1050 screen resolution!!
Do not hesitate to test,feedback and contribute !