What are Kibana Dashboards?

Kibana is the flexible visualization tool from Elastic. It is typically bundled with Elasticsearch and Logstash, forming the "ELK stack."

Kibana dashboards are collections of charts, graphs, tables, and other visualizations of key insights from chosen datasets.

Stamus Labs has created nearly 30 dashboards for use with data generated by Suricata and a companion ELK (now Elastic) stack.

These dashboards are also bundled with Clear NDR™ - Community (formerly known as SELKS).

Clear NDR - Community, Suricata, and Kibana

Clear NDR™ - Community (formerly SELKS) is an open-source turn-key Suricata network intrusion detection/protection system (IDS/IPS), network security monitoring (NSM) and threat hunting implementation created and maintained by Stamus Networks. Clear NDR - Community includes Kibana for creating dashboards and event exploration based on the data gathered by Suricata.

An example: the SN-Hunt-1 dashboard

The most popular Kibana Dashboard in Clear NDR - Community is the SN-Hunt-1 dashboard, which is specifically developed for Incident response or threat hunting. It is most useful for IP/host investigation and malware case review through PCAP ingestion.

The SN-Hunt-1 dashboard can provide an overview of pcap file content, including application protocols, source and destination IPs, and related network protocol and flow data broken down in interesting metadata visualizations that populate depending on the data reviewed. It also includes really helpful visualizations that are designed to help analysts quickly pivot to identify potentially malicious activity and investigate it further.

Additional Resources

Analyzing Network Traffic with Kibana in SELKS: the SN-Hunt-1 Dashboard - Part 1

Analyzing Network Traffic with Kibana in SELKS: the SN-Hunt-1 Dashboard - Part 2

Analyzing Network Traffic with Kibana Dashboards in SELKS: the SN-Hunt-1 Dashboard - Part 3

Use SELKS to solve the Unit 42 Wireshark Quiz

ABOUT STAMUS NETWORKS ™

Stamus Networks believes that cyber defense is bigger than any single person, platform, company, or technology. That’s why we leverage the power of community to deliver the next generation of open and transparent network defense. Trusted by security teams at the world’s most targeted organizations, our flagship offering – Clear NDR™ – empowers cyber defenders to uncover and stop serious threats and unauthorized network activity before they harm their organizations. Clear NDR helps defenders see more clearly and act more confidently through detection they can trust with results they can explain.

Kibana Dashboards for Suricata