diff --git a/doc/ElasticStackImport/03-Integrations.png b/doc/ElasticStackImport/03-Integrations.png index 265beeff..719e2ee6 100644 Binary files a/doc/ElasticStackImport/03-Integrations.png and b/doc/ElasticStackImport/03-Integrations.png differ diff --git a/doc/ElasticStackImport/04-IntegrationsImportCSV.png b/doc/ElasticStackImport/04-IntegrationsImportCSV.png index 2f8ca532..de835d7b 100644 Binary files a/doc/ElasticStackImport/04-IntegrationsImportCSV.png and b/doc/ElasticStackImport/04-IntegrationsImportCSV.png differ diff --git a/doc/ElasticStackImport/05-OverrideSettings.png b/doc/ElasticStackImport/05-OverrideSettings.png index 25c57737..dd4926e0 100644 Binary files a/doc/ElasticStackImport/05-OverrideSettings.png and b/doc/ElasticStackImport/05-OverrideSettings.png differ diff --git a/doc/ElasticStackImport/06-OverrideSettingsConfig.png b/doc/ElasticStackImport/06-OverrideSettingsConfig.png index 40f77f30..b18ddb10 100644 Binary files a/doc/ElasticStackImport/06-OverrideSettingsConfig.png and b/doc/ElasticStackImport/06-OverrideSettingsConfig.png differ diff --git a/doc/ElasticStackImport/07-CSV-Import.png b/doc/ElasticStackImport/07-CSV-Import.png index 7abd3a09..e9a49c87 100644 Binary files a/doc/ElasticStackImport/07-CSV-Import.png and b/doc/ElasticStackImport/07-CSV-Import.png differ diff --git a/doc/ElasticStackImport/08-ImportDataSettings.png b/doc/ElasticStackImport/08-ImportDataSettings.png index 05954d94..c4f9374c 100644 Binary files a/doc/ElasticStackImport/08-ImportDataSettings.png and b/doc/ElasticStackImport/08-ImportDataSettings.png differ diff --git a/doc/ElasticStackImport/09-ImportFinish.png b/doc/ElasticStackImport/09-ImportFinish.png index f9615c6d..5397c31a 100644 Binary files a/doc/ElasticStackImport/09-ImportFinish.png and b/doc/ElasticStackImport/09-ImportFinish.png differ diff --git a/doc/ElasticStackImport/12-AddingColumns.png b/doc/ElasticStackImport/12-AddingColumns.png index 69d7b25f..f52dae1e 100644 Binary files a/doc/ElasticStackImport/12-AddingColumns.png and b/doc/ElasticStackImport/12-AddingColumns.png differ diff --git a/doc/ElasticStackImport/13-RecommendedColumns.png b/doc/ElasticStackImport/13-RecommendedColumns.png index 20ec3a29..1b063368 100644 Binary files a/doc/ElasticStackImport/13-RecommendedColumns.png and b/doc/ElasticStackImport/13-RecommendedColumns.png differ diff --git a/doc/ElasticStackImport/14-DicoverWithColumns.png b/doc/ElasticStackImport/14-DicoverWithColumns.png index eba0dcfd..ff69126a 100644 Binary files a/doc/ElasticStackImport/14-DicoverWithColumns.png and b/doc/ElasticStackImport/14-DicoverWithColumns.png differ diff --git a/doc/ElasticStackImport/15-HayabusaDashboard-StackManagement.png b/doc/ElasticStackImport/15-HayabusaDashboard-StackManagement.png index 9ddc3f61..222abec6 100644 Binary files a/doc/ElasticStackImport/15-HayabusaDashboard-StackManagement.png and b/doc/ElasticStackImport/15-HayabusaDashboard-StackManagement.png differ diff --git a/doc/ElasticStackImport/16-HayabusaDashboard-Import.png b/doc/ElasticStackImport/16-HayabusaDashboard-Import.png index c43c3460..d28485c1 100644 Binary files a/doc/ElasticStackImport/16-HayabusaDashboard-Import.png and b/doc/ElasticStackImport/16-HayabusaDashboard-Import.png differ diff --git a/doc/ElasticStackImport/ElasticStackImport-English.md b/doc/ElasticStackImport/ElasticStackImport-English.md index 3a74dabc..4a8c96a3 100644 --- a/doc/ElasticStackImport/ElasticStackImport-English.md +++ b/doc/ElasticStackImport/ElasticStackImport-English.md @@ -35,7 +35,7 @@ After uploading the CSV file, click `Override settings` to specify the correct t ![Override Settings](05-OverrideSettings.png) -Perform the following changes and then click `Apply`: +As shown below, perform the following changes and then click `Apply`: 1. Change `Timestamp format` to `custom`. 2. Specify the format as `yyyy-MM-dd HH:mm:ss.SSS XXX` @@ -47,7 +47,7 @@ Now click `Import` in the bottom left-hand corner. ![CSV Import](07-CSV-Import.png) -Click on `Advanced` and perform the following settings before clicking `Import`: +As shown below, click on `Advanced` and perform the following settings before clicking `Import`: 1. Title the `Index name` as `evtxlogs-hayabusa`. 2. Under `Index settings`, add `, "number_of_replicas": 0` so that the index health status does not turn yellow. @@ -81,7 +81,7 @@ The default Discover view should look similar to this: You can get an overview of when the events happened and frequency of events by looking at the histogram at top. -On the left side sidebar, you can select with fields you want to display in columns: +In the left-side sidebar, you can add fields you want to display in the columns by clicking the plus sign after hovering over a field: ![Adding Columns](12-AddingColumns.png) @@ -121,7 +121,7 @@ You should now be able to use the dashboard shown below: ## Future Plans -We plan on creating Hayabusa logstash parsers and dashboard pre-built for SOF-ELK so that all you will need to do is copy the CSV results file to a directory in order to ingest the logs. +We plan on creating Hayabusa logstash parsers and a dashboard pre-built for SOF-ELK so that all you will need to do is copy the CSV results file to a directory in order to ingest the logs. ## Acknowledgements