*:elastalert_status*


*:logstash-*


Security Onion - Network Data

Security Onion - Network Data

[Home](/kibana/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645)

**Datasets**
[Connections](/kibana/app/dashboards#/view/0cc628b0-6e9f-11ea-9266-1fd14ca6af34) |  [DCE/RPC](/kibana/app/dashboards#/view/9e882df0-72c5-11ea-8dd2-9d8795a1200b) |
[DHCP](/kibana/app/dashboards#/view/80625c10-96dd-11ea-814e-bb515e873c2c)
[DNP3](/kibana/app/dashboards#/view/b1f52180-755a-11ea-9565-7315f4ee5cac)  |  [DNS](/kibana/app/dashboards#/view/55ac6bf0-6ec4-11ea-9266-1fd14ca6af34) |
[FTP](/kibana/app/dashboards#/view/739bfad0-755a-11ea-9565-7315f4ee5cac) |
[HTTP](/kibana/app/dashboards#/view/44e9c820-6eb1-11ea-9266-1fd14ca6af34) | [Intel](/kibana/app/dashboards#/view/85b529a0-0e5a-11eb-a255-e1e8e85e3571) | [IRC](/kibana/app/dashboards#/view/38523560-75ba-11ea-9565-7315f4ee5cac)  |
[Kerberos](/kibana/app/dashboards#/view/b207ab90-75bc-11ea-9565-7315f4ee5cac)
[Modbus](/kibana/app/dashboards#/view/886a7b90-75bd-11ea-9565-7315f4ee5cac) |
[MySQL](/kibana/app/dashboards#/view/c3ced6d0-75be-11ea-9565-7315f4ee5cac)  |
[NTLM](/kibana/app/dashboards#/view/558292e0-75c1-11ea-9565-7315f4ee5cac)  |
[PE](/kibana/app/dashboards#/view/94b55b90-c761-11ea-bebb-37c5ab5894ea) |
[RADIUS](/kibana/app/dashboards#/view/b9769e60-75c4-11ea-9565-7315f4ee5cac) | [RDP](/kibana/app/dashboards#/view/5b743150-75c5-11ea-9565-7315f4ee5cac) |
[RFB](/kibana/app/dashboards#/view/c8b3c360-75c6-11ea-9565-7315f4ee5cac) | [SIP](/kibana/app/dashboards#/view/dd98e260-75c6-11ea-9565-7315f4ee5cac)
[SMB](/kibana/app/dashboards#/view/f24d7b80-75c6-11ea-9565-7315f4ee5cac) | [SMTP](/kibana/app/dashboards#/view/00304500-75e7-11ea-9565-7315f4ee5cac) | [SNMP](/kibana/app/dashboards#/view/96522610-75e8-11ea-9565-7315f4ee5cac) |
[SSH](/kibana/app/dashboards#/view/9dfd77e0-75eb-11ea-9565-7315f4ee5cac) | [SSL](/kibana/app/dashboards#/view/efae8de0-75eb-11ea-9565-7315f4ee5cac) | [Syslog](/kibana/app/dashboards#/view/66499a20-75ed-11ea-9565-7315f4ee5cac) | [Tunnels](/kibana/app/dashboards#/view/c962dd60-75ed-11ea-9565-7315f4ee5cac) | [X.509](/kibana/app/dashboards#/view/2e0865f0-75ee-11ea-9565-7315f4ee5cac)


logs-*


Security Onion - All Logs

Security Onion - All Logs


Security Onion - Logs Over Time

Security Onion - Logs Over Time

Count


Security Onion - Source IPs

Security Onion - Source IPs


Security Onion - Destination IPs

Security Onion - Destination IPs


Security Onion - SMTP - Sender

Security Onion - SMTP - Sender


Security Onion - SMTP - Recipient

Security Onion - SMTP - Recipient


Security Onion - SMTP - TLS

Security Onion - SMTP - TLS


Security Onion - SMTP - Subject

Security Onion - SMTP - Subject


Security Onion - SMTP - User Agent

Security Onion - SMTP - User Agent


Security Onion - All Logs


Question: tags:smtp

Security Onion - SMTP


Question: event.category:network

Security Onion - Network Data


Security Onion - Network - Source IPs

Security Onion - Network - Source IPs


Security Onion  - Files

Security Onion  - Files

[Home](/kibana/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645)

**Modules**
[Strelka](/kibana/app/dashboards#/view/ff689c50-75f3-11ea-9565-7315f4ee5cac)
[Zeek](/kibana/app/dashboards#/view/ad4d5d60-75f4-11ea-9565-7315f4ee5cac)


Security Onion - Log Count Over Time

Security Onion - Log Count Over Time

Count


Question: event.module:*

Security Onion - Modules

Security Onion - Modules


Security Onion - Dataset

Security Onion - Dataset


Security Onion - File - Name

Security Onion - File - Name


Security Onion - FIle - Total Bytes

Security Onion - FIle - Total Bytes


Security Onion - File - MIME Type

Security Onion - File - MIME Type


Question: event.dataset:file*

Security Onion - File Logs


Question: event.dataset:*file*

Security Onion - Files


SSL - Logs


SSL - Version (Pie Chart)

SSL - Version (Pie Chart)


SIP - Logs


SIP - Status

SIP - Status


def source = doc['event.category'].value;
Map urls = new HashMap();
urls.put("authentication", "dashboards#/view/6c5aaff0-63f6-11ec-864c-8b5450f97635");
urls.put("file", "dashboards#/view/4923ad00-6349-11ec-864c-8b5450f97635");
urls.put("network", "dashboards#/view/49d34770-53b2-11ec-b3ef-6bcc33056a36");
urls.put("process", "dashboards#/view/790991a0-6287-11ec-864c-8b5450f97635");
urls.put("registry", "dashboards#/view/a6c6c880-63f7-11ec-864c-8b5450f97635");
urls.put("driver", "dashboards#/view/6063a9e0-61b2-11ec-864c-8b5450f97635");
if (source != null) {
	def url = urls.get(source);
	if (url != null) {
		emit(url);
        return;
	}
}
emit("None");

endgame-*


Question: event.category : "registry"

Endgame - Registry Events


Question: event_type: osquery AND osquery.name:*chrome* AND osquery.columns.permissions:('all_urls','privacy')

osquery - Chrome Extensions - Sensitive Permissions


SIP - Destination IP Address

SIP - Destination IP Address


Question: event_type: osquery AND osquery.name:*chrome*

osquery - Chrome Extensions


osquery - Chrome Extensions - Changes by Hostname


Question: network.protocol:*

Security Onion - Top Network Protocols

Security Onion - Top Network Protocols


Security Onion - Network - Transport

Security Onion - Network - Transport


Question: event.category: network

Security Onion - Network


Connections - Logs


Connections - Missed Bytes

Connections - Missed Bytes


Security Onion - SMB - Path

Security Onion - SMB - Path


Security Onion - Rule - GID/SID

Security Onion - Rule - GID/SID


Connections - Source - Originator Bytes ( Tile Map)


Question: event_type: osquery

osquery - Logs


osquery - Changes by Hostname

osquery - Changes by Hostname


FTP - Logs


FTP - Log Count Over Time

FTP - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - DNS - Query

Security Onion - DNS - Query


Security Onion - PE - Section

Security Onion - PE - Section


Intel - Logs


Intel - Indicator Type (Vertical Bar Chart)

Indicator Type

Count


MySQL - Logs


MySQL - Command/Argument

MySQL - Command/Argument


Notices - Logs


Notices - Notice Type

Notices - Notice Type


Security Onion - HTTP - Method

Security Onion - HTTP - Method


Hash - SHA256

Hash - SHA256


SSH - Logs


SSH - Log Count Over TIme

SSH - Log Count Over TIme

@timestamp per 12 hours

Count


Security Onion - Hash - MD5

Security Onion - Hash - MD5


Question: tags:syslog

Syslog (All) - Logs


Syslog - Host From

Syslog - Host From


X.509 - Logs


X.509 - Certificate Issuer

X.509 - Certificate Issuer


RDP - Logs


RDP - Destination IP Address

RDP - Destination IP Address


Security Onion - RDP - Certificate Type

Security Onion - RDP - Certificate Type


DNS - Logs


DNS - Query Type

DNS - Query Type


Endgame - Navigation

Endgame - Navigation

**Kibana**
[Admin](/kibana/app/dashboards#/view/6063a9e0-61b2-11ec-864c-8b5450f97635)

[Alerts](https://PLACEHOLDER/kibana/app/dashboards#/view/0c8e61c0-67fc-11ec-864c-8b5450f97635) |  [Authentication](/kibana/app/dashboards#/view/6c5aaff0-63f6-11ec-864c-8b5450f97635) |
[File](/kibana/app/dashboards#/view/4923ad00-6349-11ec-864c-8b5450f97635) | [Network](/kibana/app/dashboards#/view/49d34770-53b2-11ec-b3ef-6bcc33056a36) | [Process](/kibana/app/dashboards#/view/790991a0-6287-11ec-864c-8b5450f97635) | [Registry](/kibana/app/dashboards#/view/a6c6c880-63f7-11ec-864c-8b5450f97635)

**Endgame Console**
 [Dashboard](https:///dashboard) | [Alerts](https:///alerts/dashboard)


Question: alert

Endgame - Alert Search


Endgame - Navigation

[Admin](/kibana/app/dashboards#/view/6063a9e0-61b2-11ec-864c-8b5450f97635)

**Event Category**
[Alert](https://PLACEHOLDER/kibana/app/dashboards#/view/0c8e61c0-67fc-11ec-864c-8b5450f97635) |
[File](/kibana/app/dashboards#/view/4923ad00-6349-11ec-864c-8b5450f97635) | [Network](/kibana/app/dashboards#/view/49d34770-53b2-11ec-b3ef-6bcc33056a36) | [Process](/kibana/app/dashboards#/view/790991a0-6287-11ec-864c-8b5450f97635) | [Authentication](/kibana/app/dashboards#/view/6c5aaff0-63f6-11ec-864c-8b5450f97635) | [Registry](/kibana/app/dashboards#/view/a6c6c880-63f7-11ec-864c-8b5450f97635)

**Endgame**
[Endgame Alerts](https:///alerts/dashboard)

Question: event.kind : "alert"

Question: event.kind : "alert"

Endgame - Alerts Log Count Over Time

Question: event.kind : "alert"

Endgame - Alerts Users

Question: event.kind : "alert"

Endgame - Alerts Processes

Question: event.kind : "alert"

Endgame - Alerts Event

Endgame - Alerts


Security Onion - RADIUS - Reply

Security Onion - RADIUS - Reply


Question: event.module:sysmon

Security Onion - Sysmon


Security Onion - Sysmon Datasets

Security Onion - Sysmon Datasets


Question: tags:conn

Security Onion - Connections


Security Onion - Connections Over Time

Security Onion - Connections Over Time

Count


Security Onion - Connections - Destination Port


Security Onion - Connections - State

Security Onion - Connections - State


Security Onion - Connections - State (Desc)


Security Onion - Connections - Client Bytes


Security Onion - Connections - Responder Bytes


Security Onion - Connections - History

Security Onion - Connections - History


Question: tags:conn

Security Onion - Connections


Question: event.category.keyword : "process"

Endgame - All Event.Cat:Process Logs

Endgame - All Event.Cat:Process Logs


Modbus - Logs


Modbus - Log Count Over Time

Modbus - Log Count Over Time

@timestamp per 12 hours

Count


Weird - Logs


Weird - Log Count Over TIme

@timestamp per 12 hours

Count

Weird - Log Count Over TIme


SNMP - Logs


SNMP - Destination IP Address

SNMP - Destination IP Address


*:so-*


Security Onion - Alert Data

Security Onion - Alert Data


Question: event.dataset:*alert

Security Onion - Alerts


Security Onion - Alerts - Count

Security Onion - Alerts - Count


Security Onion - Alerts Over Time

Security Onion - Alerts Over Time

Count


Security Onion - Rule - Name

Security Onion - Rule - Name


Security Onion - Rule - Severity

Security Onion - Rule - Severity


Security Onion - Rule - Category

Security Onion - Rule - Category


Security Onion - Destination Ports

Security Onion - Destination Ports


Question: tags:alert

Security Onion - Alerts


Sysmon - Logs


Sysmon - Summary

Sysmon - Summary


Security Onion - Kerberos Client

Security Onion - Kerberos Client


All Logs


Sensors/Devices - Total Number of Logs

Sensors/Devices - Total Number of Logs


Security Onion - SSH - Direction

Security Onion - SSH - Direction


DHCP - Logs


DHCP - Destination IP Address

DHCP - Destination IP Address


DCE/RPC - Logs


DCE/RPC - Destination IP Address

DCE/RPC - Destination IP Address


RADIUS - Logs


RADIUS - MAC

RADIUS - MAC


Connections - Source - Sum of Total Bytes ( Tile Map)


Connections - Destination - Sum of Total Bytes ( Tile Map)


Security Onion - DNS - Response Code Name


Sysmon - Username

Sysmon - Username


Connections - Connection State

Connections - Connection State


RFB - Logs


RFB - Exclusive Session (Donut Chart)

RFB - Exclusive Session (Donut Chart)


Security Onion - Agents

Security Onion - Agents


X.509 - Certificate Key Length (Vertical Bar Chart)

Key Length

Count


Security Onion - Rule - Description

Security Onion - Rule - Description


Question: (event_type:bro_smb_mapping OR event_type:bro_smb_files)

SMB - Logs


SMB - Source IP Address

SMB - Source IP Address


Security Onion - DHCP - Server Address

Security Onion - DHCP - Server Address


Modbus - Destination Port

Modbus - Destination Port


RDP - Destination Port

RDP - Destination Port


Notices - Destination Country

Notices - Destination Country


NIDS - Alerts


NIDS - Drilldown - Alert Title

NIDS - Drilldown - Alert Title


Weird - Source IP Address

Weird - Source IP Address


Total Log Count Over TIme

Total Log Count Over TIme

@timestamp per 30 seconds

Count


Security Onion - SMB - Service

Security Onion - SMB - Service


Autoruns - Logs


Autoruns - Profile

Autoruns - Profile


Question: alert

OSSEC - Alerts


OSSEC Alerts - User to Escalated User (Data Table)


DNS - Log Count Over Time

DNS - Log Count Over Time

@timestamp per 30 minutes

Count


SIP - Method (Horizontal Bar Chart)

SIP - Method (Horizontal Bar Chart)

Count


Security Onion - MySQL - Command/Argument


1Password all events [1Password]


Question: data_stream.dataset:1password.audit_events

1Password audit events [1Password]


Question: data_stream.dataset:1password.audit_events

Audit events Source Locations [1Password]

Count

Audit Events over time [1Password]

Audit Events hot users [1Password]

Audit Events hot actions [1Password]

Audit Events hot object types [1Password]

Audit Events [1Password]


Question: data_stream.dataset:1password.item_usages

1Password item usages [1Password]


Question: data_stream.dataset:1password.item_usages

Audit item usages Source Locations [1Password]

Count

Item Usages over time [1Password]

Item Usages hot users [1Password]

Item Usages hot items [1Password]

Item Usages hot vaults [1Password]

Item Usages [1Password]


Question: data_stream.dataset:1password.signin_attempts

1Password sign-in attempts [1Password]


Question: data_stream.dataset:1password.signin_attempts

Audit sign-in attempts Source Locations [1Password]

Question: NOT event.action: ("success" "firewall_reported_success")

Sign-in Attempts unsuccessful gauge [1Password]

Count

Sign-in Attempts over time [1Password]

Count

Sign-in Attempts categories over time [1Password]

Sign-in Attempts hot users [1Password]

Sign-in Attempts [1Password]


Endgame


Modbus - Source IP Address

Modbus - Source IP Address


Security Onion - DNP3 - FC Reply

Security Onion - DNP3 - FC Reply


SSL - Destination Address

SSL - Destination Address


DNS - Response Code (Name)

DNS - Response Code (Name)


SSL - Validation Status

SSL - Validation Status


Connections - Bytes and Duration

Connections - Bytes and Duration

[Top Total Bytes](/kibana/app/dashboards#/view/a2ab0c40-3b0a-11e7-a6f9-5d3fe735ec2b)
[Source - Originator Bytes](/kibana/app/dashboards#/view/68f738e0-46ca-11e7-946f-1bfb1be7c36b) | [Destination - Responder Bytes](/kibana/app/dashboards#/view/b65775e0-46cb-11e7-946f-1bfb1be7c36b)
[Source - Sum of Total Bytes](/kibana/app/dashboards#/view/f042ad60-46c6-11e7-946f-1bfb1be7c36b) | [Destination - Sum of Total Bytes](/kibana/app/dashboards#/view/ccfcc540-4638-11e7-a82e-d97152153689)
[Source - Top Connection Duration](/kibana/app/dashboards#/view/4e108070-46c7-11e7-946f-1bfb1be7c36b) | [Destination - Top Connection Duration](/kibana/app/dashboards#/view/ea211360-46c4-11e7-a82e-d97152153689)


Tunnels - Logs


Tunnels - Destination Address

Tunnels - Destination Address


RFB - Log Count Over TIme

RFB - Log Count Over TIme

@timestamp per 12 hours

Count


Syslog (Bro) - Logs


Question: event.category.keyword : "process"

Endgame - Event.Cat:Process Log Count Over Time

Count


Security Onion - SIP - Method

Security Onion - SIP - Method


Bro - Connections - Service By Destination Country


Security Onion - RADIUS - Result

Security Onion - RADIUS - Result


OSSEC - Logs


OSSEC - Log Count Over Time

OSSEC - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - PE - Machine

Security Onion - PE - Machine


Security Onion - X.509 - Key Type (Donut)


Question: tags:http

Security Onion - HTTP


Security Onion - HTTP - Virtual Host

Security Onion - HTTP - Virtual Host


Connections - Top Source IPs

Connections - Top Source IPs


Kerberos - Logs


Kerberos - Source IP Address

Kerberos - Source IP Address


Security Onion - SSH - Client

Security Onion - SSH - Client


Files - Logs


FIles - Destination IP Address

FIles - Destination IP Address


Sysmon - Target Filename

Sysmon - Target Filename


Connections - Source Country

Connections - Source Country


NTLM - Logs


NTLM - Server Tree Name

NTLM - Server Tree Name


Firewall - Logs


Firewall - Action/Reason (Vertical Bar Chart)

Action

Count


SNMP - Version

SNMP - Version


HTTP - Logs


HTTP - Referrer

HTTP - Referrer


Bro - Notices - Notice Types

Bro - Notices - Notice Types


Security Onion - DHCP - Lease Time

Security Onion - DHCP - Lease Time


SSH - Client/Server

SSH - Client/Server


Question: event.category : "registry"

Endgame - Registry Events

Endgame - Registry Events


Security Onion - Kerberos - Request Type


Connections - Log Count Over Time

Connections - Log Count Over Time

@timestamp per 12 hours

Count


SIP - Content Type (Pie Chart)

SIP - Content Type (Pie Chart)


Security Onion - X.509 - Subject

Security Onion - X.509 - Subject


Security Onion - X.509 - SAN DNS

Security Onion - X.509 - SAN DNS


Security Onion - X.509 - Issuer

Security Onion - X.509 - Issuer


Security Onion - X509 - Key Type

Security Onion - X509 - Key Type


Security Onion - X509


Security Onion - RDP - Cookie

Security Onion - RDP - Cookie


Autoruns - Entry

Autoruns - Entry


osquery - Change Stats

osquery - Change Stats


Endgame - All Log Count Over Time

Endgame - All Log Count Over Time

Count


Question: event.dataset:files

Security Onion - File - Analyzer

Security Onion - File - Analyzer


Intel - Seen (Donut Chart)

Intel - Seen (Donut Chart)


Notices - Log Count Over Time

Notices - Log Count Over Time

@timestamp per 12 hours

Count


RADIUS - Authentication Result

RADIUS - Authentication Result


SMB - File/Path Summary

SMB - File/Path Summary


Sysmon - Source IP Address

Sysmon - Source IP Address


Security Onion - Navigation

Security Onion - Navigation

[Home](/kibana/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645)

**Event Category**
[Alert](/kibana/app/dashboards#/view/0e4af1d0-72ae-11ea-8dd2-9d8795a1200b) |
[File](/kibana/app/dashboards#/view/0245be10-6ec1-11ea-9266-1fd14ca6af34) |
[Host](/kibana/app/dashboards#/view/92e63cc0-6ec0-11ea-9266-1fd14ca6af34)  | [Network](/kibana/app/dashboards#/view/04ff3ef0-6ea4-11ea-9266-1fd14ca6af34)


Security Onion - Indicator


Security Onion - HTTP - Destination IPs

Security Onion - HTTP - Destination IPs


Weird - Destination IP Address

Weird - Destination IP Address


Security Onion - RFB - Server Version

Security Onion - RFB - Server Version


DHCP - Source IP Address

DHCP - Source IP Address


SMB - Destination IP Address

SMB - Destination IP Address


Security Onion - Host Data

[Home](/kibana/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645)

**Modules**
[Osquery](/kibana/app/dashboards#/view/bf7cf8d0-7732-11ea-bee5-af7f7c7b8e05)
[Sysmon](/kibana/app/dashboards#/view/32f01e80-c780-11ea-bebb-37c5ab5894ea)

Security Onion - Host Data


Security Onion - Username

Security Onion - Username


Security Onion - Host - Process CLI

Security Onion - Host - Process CLI


Question: event.category:host

Security Onion - Host Logs


Question: event.module:sysmon

Security Onion - Sysmon


Security Onion - DNS - Query Type Name (Donut)


Tunnels - Action (Horizontal Bar Chart)

Tunnels - Action (Horizontal Bar Chart)

Count


IRC - Logs


Bro - Syslog - Severity (Horizontal Bar Chart)

Severity

Count


Security Onion - SMB - Share Type

Security Onion - SMB - Share Type


Intel - Log Count Over Time

Intel - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - DHCP - Message Type

Security Onion - DHCP - Message Type


osquery - Changes by Type

osquery - Changes by Type


NTLM - Log Count Over Time

NTLM - Log Count Over Time

@timestamp per minute

Count


SSL - Certificate Subject

SSL - Certificate Subject


HTTP - Log Count Over Time

HTTP - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - IRC - Command Info

Security Onion - IRC - Command Info


Security Onion - User Command Overview

Security Onion - User Command Overview


Question: tags:irc

Security Onion - IRC


NIDS - Alert Summary - Drilldown

NIDS - Alert Summary - Drilldown


Question: tags:_grokparsefailure OR tags:_csvparsefailure OR tags:_rubyexception

Errors


Logstash - Error Type (Donut Chart)

Logstash - Error Type (Donut Chart)


Endgame - All Log Count Over Time Stacked Bar Graph

Count


Security Onion - MySQL - Response

Security Onion - MySQL - Response


Endgame - Hosts

Endgame - Hosts


Sysmon - Image

Sysmon - Image


Syslog - Priority (Vertical bar Chart)

Syslog - Priority (Vertical bar Chart)

Priority

Count


IRC - Destination Port

IRC - Destination Port


Modbus - Destination IP Address

Modbus - Destination IP Address


Tunnels - Source IP Address

Tunnels - Source IP Address


Security Onion - File - Source

Security Onion - File - Source


NIDS - Destination Port

NIDS - Destination Port


Kerberos - Destination IP Address

Kerberos - Destination IP Address


HTTP - Destination Port (Vertical Bar Chart)

Port

Count


Security Onion - Agent - Name

Security Onion - Agent - Name


Connections - Top 10 - Total Bytes By Source IP

Source IP Address

Total Bytes


X.509 - Log Count Over Time

X.509 - Log Count Over Time

@timestamp per 12 hours

Count


Question: event_type:bro_dns AND _exists_:creation_date AND creation_date:[now-3M TO now]

DNS - Domains with creation date < 3 months


DNS - Baby Domain Requests

DNS - Baby Domain Requests


Security Onion - SNMP - Community String


Question: process

Endgame - Process Search


DCE/RPC - Summary

DCE/RPC - Summary


Tunnels - Type (Pie Chart)

Tunnels - Type (Pie Chart)


X.509 - Certificate Key Algorithm (Horizontal Bar Chart)

Count


OSSEC Alerts - Process and Username (Data Table)


Security Onion - Least Common HTTP Methods


Security Onion - HTTP - Source IPs

Security Onion - HTTP - Source IPs


Security Onion - HTTP - Destination Port


Security Onion - HTTP - UserAgent

Security Onion - HTTP - UserAgent


Security Onion - HTTP - URI

Security Onion - HTTP - URI


Question: tags:http

Security Onion - HTTP


Modbus - Function

Modbus - Function


NIDS Alerts - Category

NIDS Alerts - Category

Category

Count


DNS - Query Class (Pie Chart)

DNS - Query Class (Pie Chart)


PE - Logs


PE - OS (Pie Chart)

PE - OS (Pie Chart)


Security Onion - SSH - Server

Security Onion - SSH - Server


Autoruns - Category

Autoruns - Category

Category

Count


Security Onion - Kerberos - Service

Security Onion - Kerberos - Service


DNP3 - Logs


DNP3 - Destination Port

DNP3 - Destination Port


Question: file

Endgame - File Search


Endgame - Navigation

Question: event.category.keyword : "file"

Question: file

Endgame - File All Logs

Question: file

Endgame - File Log Count Over Time

Question: file

Endgame - File Event Action

Question: file

Endgame - File Username

Question: file

Endgame - File Name

Question: file

Endgame - File Hostname

Question: file

Endgame - File Event Type (Donut)

Endgame - File


Security Onion - SIP - Request From

Security Onion - SIP - Request From


Question: network.transport:*

Security Onion - Network - Transport

Security Onion - Network - Transport


Strelka - File - Source

Strelka - File - Source


Question: network

Endgame - Network Search


Endgame - Network Heatmap

Endgame - Network Heatmap


Endgame - Navigation

Endgame - Network Transport

Endgame - Network Events

Endgame - Network Source IP

Endgame - Network Destination IP

Top values of dns.question.registered_domain

Endgame - Network DNS Query

Endgame - Network DNS Requests Chart

Endgame - Network


DNS - Protocol (Donut Chart)

DNS - Protocol (Donut Chart)


Kerberos - Request Type (Horizontal Bar Chart)

Count


Security Onion - Network - Destination IPs


NTLM - Username

NTLM - Username


Question: event_type:bro_dns AND highest_registered_domain:google.com~ -highest_registered_domain:google.com AND highest_registered_domain:youtube.com~ -highest_registered_domain:youtube.com AND highest_registered_domain:facebook.com~ -highest_registered_domain:facebook.com AND highest_registered_domain:wikipedia.org~ -highest_registered_domain:wikipedia.org AND highest_registered_domain:google.co.in~ -highest_registered_domain:google.co.in AND highest_registered_domain:reddit.com~ -highest_registered_domain:reddit.com AND highest_registered_domain:amazon.com~ -highest_registered_domain:amazon.com AND highest_registered_domain:taobao.com~ -highest_registered_domain:taobao.com AND highest_registered_domain:twitter.com~ -highest_registered_domain:twitter.com AND highest_registered_domain:google.co.jp~ -highest_registered_domain:google.co.jp AND highest_registered_domain:instagram.com~ -highest_registered_domain:instagram.com AND highest_registered_domain:sina.com.cn~ -highest_registered_domain:sina.com.cn AND highest_registered_domain:google.co.uk~ -highest_registered_domain:google.co.uk AND highest_registered_domain:linkedin.com~ -highest_registered_domain:linkedin.com AND highest_registered_domain:list.tmall.com~ -highest_registered_domain:list.tmall.com AND highest_registered_domain:google.com.br~ -highest_registered_domain:google.com.br AND highest_registered_domain:google.com.hk~ -highest_registered_domain:google.com.hk AND highest_registered_domain:netflix.com~ -highest_registered_domain:netflix.com AND highest_registered_domain:yahoo.co.jp~ -highest_registered_domain:yahoo.co.jp AND highest_registered_domain:pornhub.com~ -highest_registered_domain:pornhub.com AND highest_registered_domain:xvideos.com~ -highest_registered_domain:xvideos.com AND highest_registered_domain:microsoft.com~ -highest_registered_domain:microsoft.com AND highest_registered_domain:livejasmin.com~ -highest_registered_domain:livejasmin.com AND highest_registered_domain:aliexpress.com~ -highest_registered_domain:aliexpress.com AND highest_registered_domain:stackoverflow.com~ -highest_registered_domain:stackoverflow.com AND highest_registered_domain:wordpress.com~ -highest_registered_domain:wordpress.com AND highest_registered_domain:hao123.com~ -highest_registered_domain:hao123.com AND highest_registered_domain:github.com~ -highest_registered_domain:github.com AND highest_registered_domain:amazon.co.jp~ -highest_registered_domain:amazon.co.jp AND highest_registered_domain:blogspot.com~ -highest_registered_domain:blogspot.com AND highest_registered_domain:pinterest.com~ -highest_registered_domain:pinterest.com AND highest_registered_domain:bongacams.com~ -highest_registered_domain:bongacams.com AND highest_registered_domain:google.com.tr~ -highest_registered_domain:google.com.tr AND highest_registered_domain:popads.net~ -highest_registered_domain:popads.net AND highest_registered_domain:paypal.com~ -highest_registered_domain:paypal.com AND highest_registered_domain:office.com~ -highest_registered_domain:office.com AND highest_registered_domain:google.com.tw~ -highest_registered_domain:google.com.tw AND highest_registered_domain:google.com.au~ -highest_registered_domain:google.com.au AND highest_registered_domain:whatsapp.com~ -highest_registered_domain:whatsapp.com AND highest_registered_domain:microsoftonline.com~ -highest_registered_domain:microsoftonline.com

DNS - Phishing Attempts Against Alexa Top Sites

Phishing attempts against your domain(s)


Navigation

Navigation


Connections - Source - Top Connection Duration  (Tile Map)


Connections - Source - Top Connection Duration


PE - Section Name

PE - Section Name


DHCP - IP to MAC Assignment

DHCP - IP to MAC Assignment


Security Onion - SSL - Issuer

Security Onion - SSL - Issuer


OSSEC Alerts - Log Count Over TIme

OSSEC Alerts - Log Count Over TIme

@timestamp per 12 hours

Count


RFB - Server Version

RFB - Server Version


Security Onion - File Size

Security Onion - File Size


RDP - Client

RDP - Client


Security Onion - DNS - Answers

Security Onion - DNS - Answers


Tunnels - Destination Port

Tunnels - Destination Port


SIP - Log Count Over Time

SIP - Log Count Over Time

@timestamp per 12 hours

Count


SSL - Server

SSL - Server


SMTP - Logs


SMTP - Webmail - True/False (Vertical Bar Chart)

Webmail

Count


Notices - File MIME Type

Notices - File MIME Type


SSH - Destination Port

SSH - Destination Port


DCE/RPC - Endpoint

DCE/RPC - Endpoint


Security Onion - NTLM - Success

Security Onion - NTLM - Success


Security Onion - NTLM - Tree

Security Onion - NTLM - Tree


Security Onion - NTLM - Server

Security Onion - NTLM - Server


Question: tags:ntlm

Security Onion - NTLM


Question: tags:dns

Security Onion - DNS


DNS - Client

DNS - Client


DHCP - Lease Time

DHCP - Lease Time


DNP3 - Log Count Over TIme

DNP3 - Log Count Over TIme

@timestamp per 30 minutes

Count


Devices - Log Count By Device

Devices - Log Count By Device


Security Onion - RDP - Client Build

Security Onion - RDP - Client Build


Security Onion - RDP - Security Protocol


Question: tags:rdp

Security Onion - RDP


Security Onion - Nodes

Security Onion - Nodes


Endgame - All Logs

Endgame - All Logs


Endgame - Categories with Full Event Type


Endgame - Alert Count

Question: detection

Endgame - Host


MySQL - Log Count Over Time

MySQL - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - RFB - Client Version

Security Onion - RFB - Client Version


RADIUS - Connection Information

RADIUS - Connection Information


Security Onion - Host - Process Name

Security Onion - Host - Process Name


ElastAlert - Rule

ElastAlert - Rule


SIP - URI

SIP - URI


Security Onion - FTP - Argument

Security Onion - FTP - Argument


SMB - FIle Path

SMB - FIle Path


Endgame - Navigation

Endgame - Process Logs

Endgame - Process Log Count Over Time

Endgame - Processes

Endgame - Process Users

Endgame - Process Actions

Endgame - Process Information

Endgame - Process


Endgame - Navigation

Question: detection

Endgame - Network DNS Requests Chart

Endgame - Processes

Endgame - Auth Event Outcome

Question: file

Endgame - File Name

Endgame - Registry Events

Endgame - Admin


Data Types

Data Types


SSL - Log Count Over TIme

SSL - Log Count Over TIme

@timestamp per 12 hours

Count


Intel - Source

Intel - Source


Question: event.category.keyword : "registry"

Endgame - Event.Cat:Registry Log Count Over Time

Count


NIDS Alerts - Source Port

NIDS Alerts - Source Port


Security Onion - Modbus - Function

Security Onion - Modbus - Function


Security Onion - MySQL - Success

Security Onion - MySQL - Success


Security Onion - Connections - Top Destination IPs


Intel - Indicator

Intel - Indicator


RFB - Desktop Name

RFB - Desktop Name


NIDS - Drilldown - Rule Signature

NIDS - Drilldown - Rule Signature


Files - Log Count Over Time

Files - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - Syslog - Facility

Security Onion - Syslog - Facility


Security Onion - Syslog - Severity

Security Onion - Syslog - Severity


Question: tags:syslog

Security Onion - Syslog


Notices - Source IP Addresses

Notices - Source IP Addresses


HTTP  - Status and Method

HTTP  - Status and Method


FIles - Source IP Address

FIles - Source IP Address


Security Onion - Network Data - Count

Security Onion - Network Data - Count


Connections - Source - Originator Bytes


Security Onion - SNMP - Version

Security Onion - SNMP - Version


Weird - Name

Weird - Name


OSSEC Alerts - Alert Level (Pie Chart)

OSSEC Alerts - Alert Level (Pie Chart)


Question: tags:intel

Security Onion - Intel - Indicator Type (Pie)


Sysmon - Destination Port

Sysmon - Destination Port

Port

Count


DCE/RPC - Named Pipe

DCE/RPC - Named Pipe


Question: authentication

Endgame - Authentication Search


Endgame - Navigation

Endgame - Auth Count

Endgame - Auth Username

Endgame - Auth Logs Over Time

Endgame - Auth Hostname

Endgame - Auth Event Action (Donut)

Endgame - Auth Event Action

Endgame - Auth Event Outcome

Endgame - Authentication


Bro - Syslog - Source IP Address

Bro - Syslog - Source IP Address


Autoruns - Signer

Autoruns - Signer


logs-osquery_manager.result*


DNS - Server

DNS - Server


SMB - Action (Pie Chart)

SMB - Action (Pie Chart)


Security Onion - SSL - Subject

Security Onion - SSL - Subject


apm-*-transaction* traces-apm* auditbeat-* endgame-* filebeat-* logs-* packetbeat-* winlogbeat-* *:so-*


Strelka - File - MIME Flavors

Strelka - File - MIME Flavors


Kerberos - Client

Kerberos - Client


osquery -  Chrome Extensions - Change Stats

osquery -  ChromeExt - Change Stats


Question: "application/x-dosexec"

HTTP - Sites Hosting EXEs

HTTP - Sites Hosting EXEs


Connections - Total Bytes Per Source/Destination IP Pair


SMB - File Name

SMB - File Name


Log Type Per Sensor/Device

Log Type Per Sensor/Device


Top 50 - Source IP Address

Top 50 - Source IP Address


X.509 - Certificate Signing Algorithm

X.509 - Certificate Signing Algorithm


Security Onion - FTP - Command

Security Onion - FTP - Command


Security Onion - FTP - User

Security Onion - FTP - User


Security Onion - FTP - Password

Security Onion - FTP - Password


Question: tags:ftp

Security Onion - FTP


SMTP - "From" Address

SMTP - "From" Address


SIP - User Agent

SIP - User Agent


Question: event_type:bro_dns AND highest_registered_domain:securityonion.net~ -securityonion.net

DNS - Phishing Attempts Against Organizational Domain(s)


RDP - Cookie

RDP - Cookie


NTLM - Hostname to Username

NTLM - Hostname to Username


Security Onion - Tunnels - Type

Security Onion - Tunnels - Type


Question: event.dataset:intel

Security Onion - Intel - Indicator Type (Donut)


osquery - Chrome Extensions - Sensitive Permissions


Notices - File Description

Notices - File Description


Syslog - Log Count Over Time

Syslog - Log Count Over Time

@timestamp per 10 minutes

Count


Security Onion - FIle - Name

Security Onion - FIle - Name


IRC - Command

IRC - Command


Sysmon - Destination IP Address

Sysmon - Destination IP Address


RFB - Client Version

RFB - Client Version


Notices - Destination IP Addresses

Notices - Destination IP Addresses


SMTP - Log Count Over TIme

SMTP - Log Count Over TIme

@timestamp per 12 hours

Count


Question: event_type:bro_http AND _exists_:virtual_host_frequency_score

HTTP - Virtual Host Frequency Analysis

HTTP - Virtual Host Frequency Analysis


Security Onion - SSH - Authentication Sucess


SNMP - Destination Port

SNMP - Destination Port


PE - Machine

PE - Machine


Question: event_type:bro_dns AND _exists_:highest_registered_domain_frequency_score

DNS - Highest Registered Domain Frequency Analysis


Connections - Destination - Top Connection Duration  (Tile Map)


Security Onion - Host - MAC

Security Onion - Host - MAC


Security Onion - DHCP - Requested Address


Security Onion - DHCP - Assigned Address


Question: tags:dhcp

Security Onion - DHCP


PE - Subsystem (Pie Chart)

PE - Subsystem (Pie Chart)


Security Onion - PE - Subsytem

Security Onion - PE - Subsytem


Security Onion - MySQL - Success

Security Onion - MySQL - Success

Count


Security Onion - Rule - SID

Security Onion - Rule - SID


Question: tags:alert AND event.module:suricata

Security Onion - Alerts - Suricata


Security Onion - SIP - Response From

Security Onion - SIP - Response From


NIDS - Alerts By Country (Vertical Bar Chart)

Country

Count


Connections - Source IP Address

Connections - Source IP Address


SNMP - Community String

SNMP - Community String


Security Onion - Network Data Over Time

Security Onion - Network Data Over Time

Count


Kerberos - Destination Port

Kerberos - Destination Port


DNP3 - Function Request

DNP3 - Function Request


IRC - Log Count Over Time

IRC - Log Count Over Time

@timestamp per 12 hours

Count


Question: tags:intel

Security Onion - Intel - Indicator

Security Onion - Intel - Indicator


Question: tags:intel

Security Onion - Intel - Source

Security Onion - Intel - Source


Question: tags:intel

Security Onion - Intel - Seen Where

Security Onion - Intel - Seen Where


Question: tags:intel

Security Onion - Intel


SMB - Log Count Over Time

SMB - Log Count Over Time

@timestamp per minute

Count


DCE/RPC - Operation

DCE/RPC - Operation


RFB - Authentication Status (Donut Chart)


Security Onion - Modbus - Exception

Security Onion - Modbus - Exception


Question: event.dataset:modbus

Security Onion - Modbus


SSH - Source IP Address

SSH - Source IP Address


Security Onion - SSH - HASSH

Security Onion - SSH - HASSH


based on the Endgame - Categories with Full Event Type viz, modded by rlp 20211220

Endgame - Event Categories

Endgame - Event Categories


HTTP - Sites

HTTP - Sites


Files - MIME Type (Bar Chart)

Files - MIME Type (Bar Chart)

MIME Type

Count


Sysmon - Log Count Over Time

Sysmon - Log Count Over Time

@timestamp per 30 seconds

Count


Weird - Notice Generated (Donut Chart)

Weird - Notice Generated (Donut Chart)


RDP - Client Build

RDP - Client Build


ElastAlert - Source IP Address

ElastAlert - Source IP Address


Question: event_type:bro_ssl AND _exists_:certificate_common_name_frequency_score

SSL - Certificate Common Name Frequency Analysis


Security Onion - Files - MIME Type

Security Onion - Files - MIME Type


All Sensors - Log Type

All Sensors - Log Type


SIP - Destination Country (Pie Chart)

SIP - Destination Country (Pie Chart)


Security Onion - Rule - ID

Security Onion - Rule - ID


Bro - Syslog - Log Count Over Time

Bro - Syslog - Log Count Over Time

@timestamp per 30 seconds

Count


Security Onion - Host - Name

Security Onion - Host - Name


Question: event.category:host

Security Onion - Host


SIP - Content Type

SIP - Content Type


HTTP - MIME Type (Tag Cloud)

HTTP - MIME Type (Tag Cloud)


Question: event.module:ossec AND event.dataset:alert

Security Onion - Wazuh


Security Onion - PE - OS

Security Onion - PE - OS


Question: tags:pe

Security Onion - PE


Autoruns - Company

Autoruns - Company


Question: tags:snmp

Security Onion - SNMP


SMTP - "To" Address

SMTP - "To" Address


ElastAlert - Log Count Over Time

ElastAlert - Log Count Over Time

@timestamp per 30 seconds

Count


NIDS - Alert Summary

NIDS - Alert Summary


SSH - Destination IP Address

SSH - Destination IP Address


Connections - Destination IP Address

Connections - Destination IP Address


Software - Logs


Software - Summary

Software - Summary


MySQL - Response

MySQL - Response


Security Onion - Zeek - Notice

Security Onion - Zeek - Notice


Sensors - Sensor and Services (Pie Chart)


PE - Log Count Over Time

PE - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - Connections - Top Source Ports


Question: tags:ssh

Security Onion - SSH


Security Onion - DCE/RPC - Endpoint

Security Onion - DCE/RPC - Endpoint


Security Onion - DCE/RPC - Named Pipe

Security Onion - DCE/RPC - Named Pipe


Security Onion - DCE/RPC - Operation

Security Onion - DCE/RPC - Operation


Security Onion - DCE/RPC


Question: event.module:osquery

Security Onion - Osquery


Security Onion - SIP - Content Type

Security Onion - SIP - Content Type


OSSEC Alerts - Command (Data Table)

OSSEC Alerts - Command (Data Table)


Help

Help

## Introduction
Welcome to the Security Onion Elastic Stack!  This is our implementation of the Elastic Stack on Security Onion.  The Elastic Stack consists of three primary components:
- `Elasticsearch` - stores logs
- `Logstash` - collects and enriches logs before storing them in Elasticsearch
- `Kibana` - web interface for visualizing logs

## Sidebar
Starting on the far left side of the page, you see the Sidebar.  This contains links such as:
- `Discover` - search data
- `Visualize` - create visualizations based on searches
- `Dashboard` - view or create dashboards based on visualizations
- `Timelion` - timeline analysis
- `Dev Tools` - query Elasticsearch directly
- `Management` - view or modify Kibana settings
- `Squert` - separate web interface for viewing NIDS and HIDS alerts
- `Logout` - log out of your session

The first six of those links are within Kibana itself.  If you click one of those and then want to get back to the Dashboards area where you started, simply click the `Dashboard` link.

Clicking the `Squert` link will take you out of Kibana and into Squert.  You will not be required to authenticate to Squert since you already have an active Single Sign On (SSO) session.

Clicking the `Logout` link in either Squert or Kibana will log you out of your SSO session and take you back to the logon screen.

## Navigation Panel
When you are in the Kibana Dashboard area, the panel to the immediate right of the sidebar is the Navigation Panel and it includes links to our dashboards such as Home, Help (this page), Bro Notices, ElastAlert, HIDS, NIDS, etc.  Clicking one of the links in the Navigation Panel will take you to a dashboard dedicated to that particular log type.

## Dashboards
All dashboards are designed to work at 1024x768 screen resolution in order to maximize compatibility.

### Dashboard Hyperlinks

The `source_ip` and `destination_ip` fields are hyperlinked.  These hyperlinks will take you to the Indicator dashboard which will help you analyze the traffic relating to that particular IP address.

`UID` fields are also hyperlinked.  This hyperlink will start a new Kibana search for that particular UID.  In the case of Bro UIDs this will show you all Bro logs related to that particular connection.

Each log entry also has an `_id` field that is hyperlinked.  This hyperlink will take you to CapMe, allowing you to request full packet capture for any arbitrary log type.  This assumes that the log is for tcp or udp traffic that was seen by Bro and Bro recorded it correctly in its conn.log.

### Overview Dashboard
When you first go to the Kibana Dashboard area, you are automatically placed into the Overview dashboard, where you will see overview information, such as total number of logs and sensors.  Use the information on the Overview dashboard to determine which of the other dashboards on the Navigation Panel you might want to visit next.

### Dashboard Categories
Our remaining dashboards are grouped into a few categories:
- `Alert Data` - dashboards that display alerts created by rules or signatures
- `Bro Hunting` - dashboards that allow you to slice and dice network metadata for hunting
- `Host Hunting` - dashboards that allow you to hunt via host telemetry
- `Other` - dashboards that don't fit into the categories above

### Bro Notices
Bro sniffs network traffic and generates notices such as `SSL::Invalid Server Cert` and `TeamCymruMalwareHashRegistry::Match`.

### ElastAlert
ElastAlert queries Elasticsearch on a regular basis and then generates alerts based on your desired criteria.  Security Onion includes two example rules that alert on new IDS events and new connection logs.  You can add your own ElastAlert rules in `/etc/elastalert/rules/`.

### HIDS
OSSEC analyzes log files and generates Host Intrusion Detection System alerts based on its ruleset at `/var/ossec/rules/`.  You can add your own rules in `/var/ossec/rules/local_rules.xml`.

### NIDS
Security Onion can use either Snort or Suricata to sniff network traffic and generate Network Intrusion Detection System alerts.

### Connections
Bro sniffs network traffic and logs connection metadata including source IP/port, destination IP/port, protocol, and number of bytes.

### DCE/RPC
Bro sniffs network traffic and logs DCE/RPC metadata including source IP/port, destination IP/port, operation, endpoint, and named pipe.

### DHCP
Bro sniffs network traffic and logs DHCP requests and responses including source IP/port, destination IP/port, and MAC addresses.

### DNP3
Bro sniffs network traffic and logs DNP3 metadata including source IP/port, destination IP/port, function request, function reply.

### DNS
Bro sniffs network traffic and logs DNS queries and answers.  Bro also includes other name lookups such as Windows NetBIOS name service requests and Bonjour.

### Files
Bro sniffs network traffic and logs metadata related to files being transferred over the network including IP addresses, MIME type, source, and checksums.

### FTP
Bro sniffs network traffic and logs FTP metadata including source IP/port, destination IP/port, command, reply code, argument, and username.

### HTTP
Bro sniffs network traffic and logs HTTP metadata including source IP/port, destination IP/port, method, status message, MIME type, site name, referer, and user agent.

### Intel
Bro sniffs network traffic and watches for indicators using the Intel framework.  You can add your own indicators to `/opt/bro/share/bro/intel/intel.dat`.

### IRC
Bro sniffs network traffic and logs IRC metadata including source IP/port, destination IP/port, command, and username.

### Kerberos
Bro sniffs network traffic and logs Kerberos metadata including source IP/port, destination IP/port, cipher, client, server, service, request type, and success status.

### Modbus
Bro sniffs network traffic and logs Modbus metadata including source IP/port, destination IP/port, and function.

### MySQL
Bro sniffs network traffic and logs MySQL metadata including source IP/port, destination IP/port, command/argument, status, and response.

### NTLM
Bro sniffs network traffic and logs NTLM metadata including source IP/port, destination IP/port, hostname, username, and status.

### PE
Bro sniffs network traffic and logs PE metadata including OS, subsystem, machine, and section name.

### RADIUS
Bro sniffs network traffic and logs RADIUS metadata including source IP/port, destination IP/port, username, and result.

### RDP
Bro sniffs network traffic and logs RDP metadata including source IP/port, destination IP/port, client build, keyboard layout, encryption level, and result.

### RFB
Bro sniffs network traffic and logs RFB metadata including source IP/port, destination IP/port, authentication method, authentication status, client version, server version, and desktop name.

### SIP
Bro sniffs network traffic and logs SIP metadata including source IP/port, destination IP/port, method, content type, status, uri, and user agent.

### SMB
Bro sniffs network traffic and logs SMB metadata including source IP/port, destination IP/port, file name, and action.

### SMTP
Bro sniffs network traffic and logs SMTP metadata including source IP/port, destination IP/port, from, to, subject, and user agent.

### SNMP
Bro sniffs network traffic and logs SNMP metadata including source IP/port, destination IP/port, version, community, and duration.

### Software
Bro sniffs network traffic and logs metadata relating to the kinds of software that generated that traffic including name, type, and version.

### SSH
Bro sniffs network traffic and logs SSH metadata including source IP/port, destination IP/port, client version, server version, and success.

### SSL
Bro sniffs network traffic and logs SSL metadata including source IP/port, destination IP/port, server name, certificate subject, cipher, and validation status.

### Syslog
Bro sniffs network traffic and logs Syslog metadata including source IP/port, destination IP/port, severity, and protocol.

### Tunnels
Bro sniffs network traffic and detects IP, GRE, SOCKS, TEREDO, and AVAYA tunnels.  It logs metadata including source IP/port, destination IP/port, type, and action.

### Weird
Bro sniffs network traffic and logs protocol anomalies metadata including source IP/port, destination IP/port, and the type of anomaly.

### X.509
Bro sniffs network traffic and logs X.509 metadata including certificate subject, issuer, key algorithm, key length, and signing algorithm.

### Autoruns
Sysinternals Autoruns can identify the processes which Windows is configured to automatically run.  Autoruns data can then be ingested via [Autoruns To WinEventLog](https://github.com/palantir/windows-event-forwarding/tree/master/AutorunsToWinEventLog).

### Beats
Elastic Beats can be deployed on endpoints to collect host telemetry and send to Logstash for storage in Elasticsearch.

### OSSEC
OSSEC agents can be deployed on endpoints to collect host telemetry and send to the OSSEC Server included in Security Onion.  OSSEC Alerts can be found in the Alert Data category at the top of the Navigation Panel.  This OSSEC hunting dashboard will allow you to hunt through all OSSEC logs, not just alerts.

### Sysmon
Sysinternal Sysmon provides comprehensive telemetry for Windows hosts.  Its logs can be consumed using Beats, OSSEC, or other transport mechanism.

### Domain Stats
Security Onion includes a tool called domain_stats which will do a whois lookup on a domain name to determine the age of the domain.  If enabled, this dashboard looks for baby domains that have been recently registered.  Please note that domain_stats is only enabled when running in Evaluation Mode.

### Firewall
Firewall logs can be consumed via syslog or other transport mechanism.  Once consumed, this dashboard allows you to slice and dice those firewall logs based on source IP/port, destination IP/port, protocol, and action.

### Frequency
Security Onion includes a tool called freq_server which can perform frequency analysis of hostnames.  If enabled, this dashboard will show hostnames with a frequency analysis score that indicates that they could have been randomly generated.  Please note that freq_server is only enabled when running in Evaluation Mode.

### Stats
This dashboard shows statistics for Logstash including processing times for different log types and any errors that may have occurred.

## More Information
For additional information, please refer to our documentation at:

https://securityonion.net/docs/Elastic


*:logstash-beats-*


All Beats Logs


Beats - Process IDs

Beats - Process IDs


Beats - Computer Names

Beats - Computer Names


Beats - Usernames

Beats - Usernames


Beats - Event IDs

Beats - Event IDs


Beats - Log Count Over Time

Beats - Log Count Over Time

@timestamp per 30 minutes

Count


Intel - Log Count

Intel - Log Count


Devices - Count

Devices - Count


Notices - Log Count

Notices - Log Count


NIDS - Alert Count

NIDS - Alert Count


OSSEC Alerts - Log Count

OSSEC Alerts - Log Count


Connections - Log Count

Connections - Log Count


Elastalert - Log Count

Elastalert - Log Count


DHCP - Log Count

DHCP - Log Count


DCE/RPC - Log Count

DCE/RPC - Log Count


HTTP - Log Count

HTTP - Log Count


DNP3 - Log Count

DNP3 - Log Count


DNS - Log Count

DNS - Log Count


Files - Log Count

Files - Log Count


FTP - Log Count

FTP - Log Count


Modbus - Log Count

Modbus - Log Count


IRC - Log Count

IRC - Log Count


Kerberos - Log Count

Kerberos - Log Count


Total Number of Logs

Total Number of Logs


Sensors - Count

Sensors - Count


MySQL - Log Count

MySQL - Log Count


RFB - Log Count

RFB - Log Count


NTLM - Log Count

NTLM - Log Count


PE - Log Count

PE - Log Count


RADIUS - Log Count

RADIUS - Log Count


RDP - Log Count

RDP - Log Count


SNMP - Log Count

SNMP - Log Count


SIP - Log Count

SIP - Log Count


SMB - Log Count

SMB - Log Count


SMTP - Log Count

SMTP - Log Count


Bro - Syslog - Log Count

Bro - Syslog - Log Count


Software - Log Count

Software - Log Count


SSH - Log Count

SSH - Log Count


SSL - Log Count

SSL - Log Count


Tunnels - Log Count

Tunnels - Log Count


Autoruns - Log Count

Autoruns - Log Count


Weird - Log Count

Weird - Log Count


X.509 - Log Count

X.509 - Log Count


Firewall - Log Count

Firewall - Log Count


Beats - Log Count

Beats - Log Count


OSSEC - Log Count

OSSEC - Log Count


Sysmon - Log Count

Sysmon - Log Count


Logstash - Avg Processing Time

Logstash - Avg Processing Time


Logstash - Median Processing TIme

Logstash - Median Processing TIme


Logstash - Max Processing Time

Logstash - Max Processing Time


Question: tags:_grokparsefailure OR tags:_csvparsefailure OR tags:_rubyexception

Logstash - Error Count

Logstash - Error Count


Syslog - Log Count

Syslog - Log Count


FTP - Reply Code

FTP - Reply Code


Question: event.category.keyword : "registry"

Endgame - All Event.Cat:Registry Logs

Endgame - All Event.Cat:Registry Logs


ElastAlert - Destination IP Address

ElastAlert - Destination IP Address


Connections - Top 10 - Total Bytes By Connection

Connection ID

Total Bytes


Connections - Top 10 - Total Bytes By Destination Port

Destination Port

Total Bytes


Connections - Top 10 - Total Bytes By Destination IP

Destination IP Address

Total Bytes


Connections - Total Bytes


SMTP - Destination IP Address

SMTP - Destination IP Address


Intel - Source IP Address

Intel - Source IP Address


Intel - Destination Port

Intel - Destination Port


SMB - Destination Port

SMB - Destination Port


SNMP - Log Count Over TIme

SNMP - Log Count Over TIme

@timestamp per 12 hours

Count


Endgame - Navigation

Endgame - Registry All Logs

Endgame - Registry Logs Over Time

Endgame - Registry Event Process

Endgame - Registry Events

Endgame - Registry


NIDS Alerts - Source IP Address

NIDS Alerts - Source IP Address


Strelka - Request - Client

Strelka - Request - Client


Question: event_type:bro_ssl AND _exists_:issuer_common_name_frequency_score

SSL - Certificate Issuer Common Name Frequency Analysis


Security Onion - Data Overview

Security Onion - Data Overview


Question: observer.name:* OR agent.name:*

Security Onion - Log Count By Node

Security Onion - Log Count By Node


Security Onion - Home


DHCP - Message Types

DHCP - Message Types


Security Onion - DNS - Response Code Name (Donut)


FIles - MIME Type

FIles - MIME Type


HTTP - URIs

HTTP - URIs


Security Onion - Osquery - Query Results Count


Security Onion - Users


Security Onion - Dataset By Node

Security Onion - Dataset By Node


Question: event_type:bro_x509 AND _exists_:issuer_common_name_frequency_score

X.509 - Certificate Issuer Frequency Analysis


Question: event.module:zeek AND event.dataset:*file*

Security Onion - Zeek Files


FTP - Reply Message

FTP - Reply Message


HTTP - Source IP Address

HTTP - Source IP Address


Bro - Syslog - Destination IP Address

Bro - Syslog - Destination IP Address


HTTP - User Agent

HTTP - User Agent


SSL - Destination Country (Bar Chart)

SSL - Destination Country (Bar Chart)

destination_geo.country_name.keyword: Descending

Count


SMTP - TLS - True/False (Vertical Bar Chart)

TLS

Count


Question: server

Question: server

Chrome Extensions - Logs

Chrome Extensions - Sensitive Permissions

Chrome Extensions - Changes by Hostname

osquery - Chrome Extensions


Security Onion - Osquery - Name

Security Onion - Osquery - Name


Security Onion - DHCP - Message Type (Donut)


Intel - MIME Type

Intel - MIME Type


metrics-*


Regions

Stream Names

Availability Zones

Account Names

Overview of Amazon Kinesis Metrics

Question: aws.kinesis

Stream Count

Average Incoming Bytes (in selected time range)

Incoming Bytes

Average Get Records Bytes (in selected time range)

Average Get Records Bytes

Incoming Data

Incoming Data Label

Top 10 values of aws.dimensions.StreamName

Incoming Bytes per Stream

Incoming Records per Stream

Outgoing Data

Outgoing Data Label

Get Records Bytes per Stream

Get Records per Stream

Latency

latency label

Put Records Latency

Get Records Latency

Top 3 values of aws.dimensions.StreamName

Put Records Latency

Get Records Latency

Get Records Iterator Age (ms)

Iterator Age

iterator age label

[Metrics AWS] Kinesis Overview


Overview of AWS Transit Gateway Metrics

Question: aws.transitgateway

TransitGateway Filters [Metrics AWS]

filters

Transit Gateway Bytes In [Metrics AWS]

Bytes In

Transit Gateway Packets In [Metrics AWS]

Packets In

Transit Gateway Bytes Out [Metrics AWS]

Bytes Out

Transit Gateway Packets Out [Metrics AWS]

Packets Out

Transit Gateway Bytes Drop Count No Route [Metrics AWS]

Bytes Dropped - no route

Transit Gateway Packets Drop Count No Route [Metrics AWS]

Packets Dropped - no route

Transit Gateway Bytes Drop Count Blackhole [Metrics AWS]

Bytes Dropped - black hole

Transit Gateway Packets Drop Count Blackhole [Metrics AWS]

Packets Dropped - black hole

[Metrics AWS] TransitGateway Overview


Question: aws.inspector

Findings Essential Details [Logs Inspector]


AWS Inspector Findings Severity

Overview of AWS Inspector Findings logs.

Question: aws.inspector

Distribution of Findings by Status [Logs Inspector]

Total Findings Count [Logs Inspector]

Distribution of Findings by Type [Logs Inspector]

Distribution of Findings by Network Protocol [Logs Inspector]

Top 10 Findings Title with Highest Inspector Score [Logs Inspector]

[Inspector Inspector Findings Overview Dashboard](#/dashboard/aws-131a1550-5a0b-11ed-a807-bd2da8f2e79b) | [Inspector Severity Dashboard](#/dashboard/aws-60881ab0-63e0-11ed-be08-4b4db5223139) | [Inspector Vulnerabilities Dashboard](#/dashboard/aws-383d4630-63df-11ed-be08-4b4db5223139) | [Inspector Inspector EC2 and ECR Overview Dashboard](#/dashboard/aws-63984b70-63e1-11ed-be08-4b4db5223139)

Dashboards [Logs Inspector]

[Logs AWS] Inspector Findings Overview


Question: aws.vpcflow

Question: aws.vpcflow

Question: REJECT

Question: REJECT

VPC Flow Reject Logs [Logs AWS]


Logs AWS VPC Flow Log Overview Dashboard

S3 Bucket Name Filter [Logs AWS]

S3 Bucket Filter

Question: aws.vpcflow.action : "ACCEPT"

Question: aws.vpcflow.action : "REJECT"

VPC Flow Action Geo Location[Logs AWS]

VPC Flow Action Geo Location

Question: data_stream.dataset : "aws.vpcflow"

VPC Flow Top IP Addresses [Logs AWS]

VPC Flow Top IP Addresses

Question: data_stream.dataset : "aws.vpcflow" and aws.vpcflow.action : "REJECT"

Question: data_stream.dataset : "aws.vpcflow" and aws.vpcflow.action : "ACCEPT"

Question: data_stream.dataset : "aws.vpcflow" and aws.vpcflow.action : "-"

Question: data_stream.dataset : "aws.vpcflow"

VPC Flow Total Requests [Logs AWS]

VPC Flow Total Requests

VPC Flow Reject Logs

VPC Flow Reject Logs

[Logs AWS] VPC Flow Log Overview


Overview of AWS SQS Metrics

Question: aws.sqs

SQS Messages Visible [Metrics AWS]

SQS Messages Visible

SQS Oldest Message Age in Seconds [Metrics AWS]

SQS Oldest Message Age in Seconds

SQS Messages Received [Metrics AWS]

SQS Messages Received

SQS Messages Deleted [Metrics AWS]

SQS Messages Deleted

SQS Messages Delayed [Metrics AWS]

SQS Messages Delayed

SQS Messages Sent [Metrics AWS]

SQS Messages Sent

SQS Filters [Metrics AWS]

SQS Filters

SQS Empty Receives [Metrics AWS]

SQS Empty Receives

[Metrics AWS] SQS Overview


Firewall Logs [Logs AWS]


Dashboard providing an overall view of the AWS Network Firewall integration.

**Navigation**

**[Overview (This Page)](/app/dashboards#/view/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc)**
[Alerts](/app/dashboards#/view/aws-dfa76470-4ba1-11ec-8282-5342b8988acc)
[Flows](/app/dashboards#/view/aws-562bdea0-4ba7-11ec-8282-5342b8988acc)
[Metrics](/app/dashboards#/view/aws-3abffe60-4ba9-11ec-8282-5342b8988acc)

[Integrations Page](/app/integrations/detail/aws/overview?integration=firewall)

**Overview**

This dashboard provides an overall view of the AWS Network Firewall integration.

Firewall Filters [Logs AWS]

Firewall Filters

Question: alert

Total Alerts

Question: event

Total Flows

Question: alert

Unique Destination IPs

Question: alert

Unique Source IPs

Question: event

Unique Network Protocols

Question: event

Total Bytes

Question: event

Total Bytes

Events

Total Events by Firewall

Firewall Logs

[Logs AWS] Firewall Overview


Question: aws.cloudtrail

CloudTrail Events [Logs AWS]


Overview of AWS RDS Metrics

Question: aws.rds

RDS Database Connections [Metrics AWS]

Database Connections

RDS Transaction Blocked [Metrics AWS]

Transaction Blocked

AWS Region Filter [Metrics AWS]

AWS Region Filter

Top values of aws.rds.db_instance.identifier

RDS Free Storage Bytes [Metrics AWS]

Free Storage

RDS Read Latency in Milliseconds [Metrics AWS]

Read Latency

RDS Write Latency in Milliseconds [Metrics AWS]

Write Latency

RDS Insert Throughput [Metrics AWS]

Insert Throughput

RDS Select Throughput[Metrics AWS]

Select Throughput

RDS CPU Total Pct [Metrics AWS]

CPU Total Pct

RDS Disk Queue Depth [Metrics AWS]

Disk Queue Depth

RDS Write IOPS [Metrics AWS]

Write IOPS

RDS Read IOPS [Metrics AWS]

Read IOPS

[Metrics AWS] RDS Overview


Question: aws.inspector

Findings Package Vulnerability Essential Details [Logs Inspector]


AWS Inspector Findings Severity

Overview of AWS Inspector Vulnerabilities.

Question: aws.inspector

Top 10 Vulnerability CVSS Source with Highest CVSS Score [Logs Inspector]

Question: CRITICAL

Vulnerabilities Package Name with Most Critical Findings [Logs Inspector]

Dashboards [Logs Inspector]

[Logs AWS] Inspector Vulnerabilities


Dashboard providing statistics about metrics ingested from the AWS Network Firewall integration.

**Navigation**

[Overview](/app/dashboards#/view/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc)
[Alerts](/app/dashboards#/view/aws-dfa76470-4ba1-11ec-8282-5342b8988acc)
[Flows](/app/dashboards#/view/aws-562bdea0-4ba7-11ec-8282-5342b8988acc)
**[Metrics (This Page)](/app/dashboards#/view/aws-3abffe60-4ba9-11ec-8282-5342b8988acc)**

[Integrations Page](/app/integrations/detail/aws/overview?integration=firewall)

**Overview**

This dashboard provides an overall view of AWS Network Firewall metrics.

Firewall Filters

Received Packets

Dropped Packets

Passed Packets

Custom Actions

Custom Action Packets

Unique Firewalls

Packet Metrics

Top values of aws.dimensions.CustomAction

Custom Action Packet Metrics

Top Metrics by Firewall

Top Custom Actions

[Metrics AWS] Firewall Overview


Logs AWS ELB Access Log Overview Dashboard

ELB Requests Geolocation [Logs AWS]

ELB Requests Geolocation

Question: data_stream.dataset : "aws.elb_logs"

ELB Inbound Traffic [Logs AWS]

ELB Inbound Traffic

Question: data_stream.dataset : "aws.elb_logs"

ELB Top User Agents [Logs AWS]

ELB Top User Agents

Question: data_stream.dataset : "aws.elb_logs"

ELB Total Requests [Logs AWS]

ELB Total Requests

Question: data_stream.dataset : "aws.elb_logs"

ELB Top IP Addresses [Logs AWS]

ELB Top IP Addresses

Question: data_stream.dataset : "aws.elb_logs"

ELB Outbound Traffic [Logs AWS]

ELB Outbound Traffic

Question: data_stream.dataset : "aws.elb_logs" and http.response.status_code >= 200 and http.response.status_code	< 300

ELB HTTP 2xx [Logs AWS]

ELB HTTP 2xx

Question: data_stream.dataset : "aws.elb_logs" and http.response.status_code >= 400 and http.response.status_code < 500

ELB HTTP 4xx [Logs AWS]

ELB HTTP 4xx

Question: data_stream.dataset : "aws.elb_logs" and http.response.status_code >= 500 and http.response.status_code < 600

ELB HTTP 5xx [Logs AWS]

ELB HTTP 5xx

[Logs AWS] ELB Access Log Overview


Overview of AWS Security Hub Findings Action

Question: data_stream.dataset : "aws.securityhub_findings"

[Findings and Insights Overview](#/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4) | [Findings Malware, Threat Intelligence Indicator and Network Path Overview](#/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267) | [Summary Dashboard](#/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30)

Dashboards [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

AWS API Call by Countries [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Network Connection by Countries [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Action Type [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Network Connection Direction [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by AWS API Call Action Service Name [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by DNS Request Blocked [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Port Probe Blocked [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Network Connection Action Blocked [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by AWS API Call Caller Type [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Top 10 DNS Request Domain [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by DNS Request Protocol [Logs AWS]

[Logs AWS] Security Hub Findings Action


Findings Severity

Cloud Account ID

Cloud Region

Cloud Provider

Overview of Amazon Guardduty Severity.

Question: aws.guardduty

Total Findings Severity [Logs Guardduty]

Distribution of Findings by Severity [Logs Guardduty]

Empty XY chart

Findings Resource Type by Severity [Logs Guardduty]

Empty XY chart

Findings Region by Severity [Logs Guardduty]

Empty XY chart

Severity Over Time [Logs Guardduty]

Question: aws.guardduty.severity.value : "High"

Question: aws.guardduty.severity.value : Medium

Question: aws.guardduty.severity.value : Low

Total Findings Count Based on Severity [Logs Guardduty]

[Logs AWS] Guardduty Findings Severity


AWS Region

AWS Volume ID

[Metrics AWS] Overview of EBS Metrics

Question: aws.ebs

Top 10 values of aws.dimensions.VolumeId

Empty XY chart

Volume Write Ops

Empty XY chart

Volume Read Ops

Empty XY chart

Volume Write Bytes

Empty XY chart

Volume Read Bytes

Empty XY chart

Volume Queue Length

Empty XY chart

Volume Total Write Time

Volume Total Write Time

Empty XY chart

Volume Total Read Time

Empty XY chart

Volume Idle Time

[Metrics AWS] EBS Overview


Error Logs [Logs AWS]


Logs AWS S3 Server Access Log Overview Dashboard

Top URLs [Logs AWS]

Top URLs

Question: aws.s3access.http_status < 300 and aws.s3access.http_status >= 200

Question: aws.s3access.http_status < 400 and aws.s3access.http_status >= 300

Question: aws.s3access.http_status < 500 and aws.s3access.http_status >= 400

Question: aws.s3access.http_status < 600 and aws.s3access.http_status >= 500

Http Status over time [Logs AWS]

Http Status over time

Error Logs

Error Logs

[Logs AWS] S3 Server Access Log Overview


Question: aws.inspector

Findings AWS EC2 Instance Essential Details [Logs Inspector]


Dashboard providing statistics about flows ingested from the AWS Network Firewall integration.

Question: event

**Navigation**

[Overview](/app/dashboards#/view/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc)
[Alerts](/app/dashboards#/view/aws-dfa76470-4ba1-11ec-8282-5342b8988acc)
**[Flows (This Page)](/app/dashboards#/view/aws-562bdea0-4ba7-11ec-8282-5342b8988acc)**
[Metrics](/app/dashboards#/view/aws-3abffe60-4ba9-11ec-8282-5342b8988acc)

[Integrations Page](/app/integrations/detail/aws/overview?integration=firewall)

**Overview**

This dashboard provides an overall view of AWS Network Firewall flow logs.

Firewall Filters [Logs AWS]

Firewall Filters

Unique Flows

Unique Destination IPs

Unique Source IPs

Unique Network Protocols

Unique Network Protocols

Total Bytes

Top Protocols

Top Source Countries

Top values of destination.geo.country_name

Top Destination Countries

Top Firewalls

Top Source IPs

Top Destination IPs

Top Firewalls

Top Protocols

Firewall Logs

[Logs AWS] Firewall Flows


AWS Inspector Findings Severity

Overview of AWS Inspector Severity.

Question: aws.inspector

Empty XY chart

Distribution of Findings by Severity [Logs Inspector]

Total Findings Count [Logs Inspector]

Question: aws.inspector.severity : "CRITICAL"

Question: aws.inspector.severity : "HIGH"

Question: aws.inspector.severity : "MEDIUM"

Question: aws.inspector.severity : "LOW"

Question: aws.inspector.severity : "INFORMATIONAL"

Question: aws.inspector.severity : "UNTRIAGED"

Total Findings Count Based on Severity [Logs Inspector]

Dashboards [Logs Inspector]

[Logs AWS] Inspector Severity


Question: aws.inspector

Question: data_stream.dataset : aws.inspector

Findings Resource Essential Details [Logs Inspector]


AWS Inspector Findings Severity

Overview of AWS Inspector EC2 and ECR logs.

Question: aws.inspector

Top 10 EC2 Instances ARN with Highest Inspector Score [Logs Inspector]

Question: CRITICAL

ECR Repositories with Most Critical Findings [Logs Inspector]

Question: CRITICAL

ECR Container Images with Most Critical Findings [Logs Inspector]

Dashboards [Logs Inspector]

[Logs AWS] Inspector EC2 and ECR Overview


Overview of AWS VPN Metrics

Question: aws.vpn

VPN Filters [Metrics AWS]

Filters

VPN Tunnel Data State [Metrics AWS]

Tunnel State Per VPN ID

VPN Tunnel Data State Per Tunnel IP [Metrics AWS]

Tunnel State Per Tunnel IP

VPN Tunnel Data In Per VPN ID [Metrics AWS]

Tunnel Data In Per VPN ID

VPN Tunnel Data In [Metrics AWS]

Tunnel Data In Per Tunnel IP

VPN Tunnel Data Out Per VPN ID [Metrics AWS]

Tunnel Data Out Per VPN ID

VPN Tunnel Data Out [Metrics AWS]

Tunnel Data Out Per Tunnel IP

[Metrics AWS] VPN Overview


Overview of DynamoDB AWS Cloudwatch metrics

Question: aws.dynamodb

Region/Account Filters [Metrics AWS]

Region/Account Filters

DynamoDB Consumed Read Capacity Units [Metrics AWS]

Consumed Read Capacity Units

DynamoDB Consumed Write Capacity Units [Metrics AWS]

Consumed Write Capacity Units

Account Max Reads

DynamoDB Max Read/Write Account Limits [Metrics AWS]

Max Read/Write Account Limits

DynamoDB Successful Request Latency [Metrics AWS]

Successful Request Latency

DynamoDB Read Throttle Events [Metrics AWS]

Read Throttle Events

DynamoDB Throttle Requests [Metrics AWS]

Throttle Requests

DynamoDB Max Request Latency Per Operation [Metrics AWS]

Max Request Latency Per Operation

DynamoDB Write Throttle Events [Metrics AWS]

Write Throttle Events

Write Utilization

DynamoDB Account Provisioned Capacity Utilization [Metrics AWS]

Account Provisioned Write Capacity Utilization

[Metrics AWS] DynamoDB Overview


Overview of AWS Lambda Metrics

Question: aws.lambda

AWS Account Filter [Metrics AWS]

AWS Account Filter

Lambda Top Errors [Metrics AWS]

Top Errors

AWS Region Filter [Metrics AWS]

AWS Region Filter

Lambda Duration in Milliseconds [Metrics AWS]

Lambda Function Duration in Milliseconds

Lambda Top Invoked Functions [Metrics AWS]

Top Invoked Lambda Functions

Lambda Top Throttles [Metrics AWS]

Top Throttled Lambda Functions

[Metrics AWS] Lambda Overview


Overview of AWS S3 Storage Lens Metrics

Daily Overview

S3 Storage Lens Daily Overview Markdown [AWS Metrics]

S3 Storage Lens Filters [Metrics AWS]

Filters

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Total Storage [Metrics AWS]

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Object Count [AWS Metrics]

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Average Object Size[Metrics AWS]

Question: not aws.dimensions.storage_class : "-"

S3 Storage Lens Active Buckets [AWS Metrics]

Question: not aws.dimensions.storage_class : "-"

S3 Storage Lens Accounts [AWS Metrics]

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Total Storage Region Distribution [AWS Metrics]

Total Storage Region Distribution

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Total Storage Class Distribution [AWS Metrics]

Total Storage Class Distribution

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Object Count Region Distribution [AWS Metrics]

Object Count Region Distribution

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Object Count Class Distribution [AWS Metrics]

Object Count Class Distribution

Trends

S3 Storage Lens Trends Markdown [AWS Metrics]

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

sum(aws.s3_storage_lens.metrics.ObjectCount.avg, kql='aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-" ')

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Total Storage and Object Count [Metrics AWS]

Total Storage and Object Count

Cost Efficiency

S3 Storage Lens Cost Efficiency Markdown [AWS Metrics]

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Delete Marker Object Count [AWS Metrics]

divide(sum(aws.s3_storage_lens.metrics.CurrentVersionStorageBytes.avg, kql='aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-" '), sum(aws.s3_storage_lens.metrics.StorageBytes.avg, kql='aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-" '))

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

divide

S3 Storage Lens Percentage Current Version Bytes [AWS Metrics]

Current Version Bytes Percentage

divide(sum(aws.s3_storage_lens.metrics.IncompleteMultipartUploadStorageBytes.avg, kql='aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-" '), sum(aws.s3_storage_lens.metrics.StorageBytes.avg, kql='aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-" '))

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Percentage incomplete MPU bytes [AWS Metrics]

Incomplete MPU bytes Percentage

Data Protection

S3 Storage Lens Data Protection Markdown [AWS Metrics]

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

test	{{ object_lock_bytes_percentage.last.raw }}

S3 Storage Lens Object Lock Bytes Percentage [AWS Metrics]

Object Lock Bytes Percentage

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Replicated Bytes Percentage [AWS Metrics]

Replicated Bytes Percentage

Question: aws.dimensions.record_type : "ACCOUNT" and not aws.dimensions.storage_class : "-"

S3 Storage Lens Encrypted Bytes Percentage [AWS Metrics]

Encrypted Bytes Percentage

[Metrics AWS] S3 Storage Lens Overview


Overview of Amazon Redshift metrics

Question: aws.redshift

AWS Account and Redshift Cluster Filters

## Cluster monitoring

Health Status

Maintenance mode

Database connections

## Resource Usage

CPU Utilization per Node

Disk Read Throughput

Storage Write Throughput

Storage Read Latency

Storage Write Latency

Percentage of disk space used

## Query Performance

Query Duration by latency range

Query duration by WLM queue

Network Receive Throughput

Network Transmit Throughput

[Metrics AWS] Redshift metrics overview


Overview of AWS Security Hub Findings Malware, Threat Intelligence Indicator and Network Path

Question: data_stream.dataset : "aws.securityhub_findings"

[Findings and Insights Overview](#/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4) | [Findings Action Overview](#/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267) | [Summary Dashboard](#/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30)

Dashboards [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Malware Type [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Malware Name [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Malware State [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Network Path Component Type [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Top 10 Ingress Protocol [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Top 10 Egress Protocol [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Threat Intelligence Indicator Type [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Threat Intelligence Indicator Source [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Threat Intelligence Indicator Category [Logs AWS]

[Logs AWS] Security Hub Findings Malware, Threat Intelligence Indicator and Network Path


Overview of AWS Usage Metrics

Question: aws.usage

AWS Region Filter [Metrics AWS]

AWS Region Filter

Question: aws.dimensions.Type : "Resource"

Usage ResourceCount [Metrics AWS]

Usage Resource Count

Question: aws.dimensions.Type : "API"

Usage CallCount [Metrics AWS]

Usage API Call Count

AWS Account Filter [Metrics AWS]

AWS Account Filter

AWS Service Filter [Metrics AWS]

AWS Service Filter

Question: aws.dimensions.Type : "Resource"

Usage Resource Count Per Service [Metrics AWS]

Usage Resource Count Per Service

Question: aws.dimensions.Type : "API"

Usage Call Count Per Service [Metrics AWS]

Usage API Call Count Per Service

[Metrics AWS] Usage Overview


Summary of events from AWS CloudTrail.

Question: aws.cloudtrail

CloudTrail Source Location [Logs AWS]

Count

CloudTrail Event Outcome over time [Logs AWS]

event.action values separated by event.provider.

CloudTrail Actions [Logs AWS]

CloudTrail Event Type [Logs AWS]

CloudTrail User Agents [Logs AWS]

CloudTrail Error Code [Logs AWS]

CloudTrail Top User IDs [Logs AWS]

[Logs AWS] CloudTrail


Question: aws.guardduty

Findings Essential Details [Logs Guardduty]


Findings Severity

Cloud Account ID

Cloud Region

Cloud Provider

Overview of Amazon Guardduty Findings logs.

Question: aws.guardduty

Empty XY chart

Distribution of Findings by Action Type [Logs Guardduty]

Top 10 Account ID [Logs Guardduty]

Top 10 Highest Findings by Type [Logs Guardduty]

Top 10 Findings ARN with Highest Confidence Score [Logs Guardduty]

[Logs AWS] Guardduty Findings Overview


Account Names

Regions

Availability Zones

Bucket Names

Overview of AWS S3 Metrics

Total S3 Bucket Size

Question: aws.s3_daily_storage.number_of_objects: *

Total number of objects

Question: aws.s3_daily_storage.bucket.size.bytes: *

Last value of aws.s3_daily_storage.bucket.size.bytes

Top 10 Bucket Size in Bytes

Question: aws.s3_daily_storage.number_of_objects: *

Last value of aws.s3_daily_storage.number_of_objects

Top 10 Number of Objects

Question: aws.s3_daily_storage.bucket.size.bytes: *

Bucket Size

Question: aws.s3_daily_storage.number_of_objects: *

Number of Objects

Note: visualizations below rely on S3 request metrics to be enabled in AWS first. Please see how to [enable request metrics](https://docs.aws.amazon.com/AmazonS3/latest/userguide/configure-request-metrics-bucket.html) for more details.

s3_request_note

Requests

requests title

Question: aws.s3_request.latency.total_request.ms: *

Average Total Request Latency

Question: aws.s3_request.requests.total: *

Total HTTP Requests

Average Download Bytes per Request

Average Upload Bytes per Request

Bytes per Period Downloaded

Bytes per Period Uploaded

All Requests

Get Requests

Put Requests

Head Requests

Average 4xx Errors per Request

Average 5xx Errors per Request

Downloads and Uploads

downloads and uploads title

Downloaded Bytes per Request

Uploaded Bytes per Request

Latency

latency label

Question: aws.s3_request.latency.first_byte.ms: *

Total Request Latency (ms)

Question: aws.s3_request.latency.first_byte.ms: *

First Byte Latency (ms)

[Metrics AWS] S3 Overview


Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Security Hub - Raw Events [Logs AWS]


Question: aws.guardduty

Question: High

High Severity Threat Details [Logs Guardduty]


Overview of AWS NAT Gateway Metrics

Question: aws.natgateway

NATGateway Filters [Metrics AWS]

Filters

NATGateway Error Port Allocation [Metrics AWS]

Error Port Allocation

NATGateway Packet Drop [Metrics AWS]

Packets Drop

NATGateway Connection Established [Metrics AWS]

Total Connection Established

NATGateway Active Connection Count Top10 [Metrics AWS]

Active Connection Count

NATGateway Bytes In From Destination [Metrics AWS]

Bytes In From Destination

NATGateway Bytes In From Source [Metrics AWS]

Bytes In From Source

NATGateway Bytes Out To Destination [Metrics AWS]

Bytes Out To Destination

NATGateway Bytes Out To Source [Metrics AWS]

Bytes Out To Source

NATGateway Packet In From Destination [Metrics AWS]

Packets In From Destination

NATGateway Packet In From Source [Metrics AWS]

Packets In From Source

NATGateway Packet Out To Destination [Metrics AWS]

Packets Out To Destination

NATGateway Packet Out To Source [Metrics AWS]

Packets Out To Source

[Metrics AWS] NATGateway Overview


Overview of AWS EC2 Metrics

Question: data_stream.dataset : "aws.ec2_metrics"

EC2 DiskIO Write Bytes [Metrics AWS]

EC2 DiskIO Write Bytes

EC2 Status Check Failed [Metrics AWS]

EC2 Status Check Failed

Question: data_stream.dataset : "aws.ec2_metrics"

EC2 Network In Bytes [Metrics AWS]

EC2 Network In Bytes

Question: data_stream.dataset : "aws.ec2_metrics"

EC2 Network Out Bytes [Metrics AWS]

EC2 Network Out Bytes

Question: data_stream.dataset : "aws.ec2_metrics"

EC2 DiskIO Read Bytes [Metrics AWS]

EC2 DiskIO Read Bytes

Question: data_stream.dataset : "aws.ec2_metrics"

EC2 CPU Utilization [Metrics AWS]

EC2 CPU Utilization

AWS Account Filter [Metrics AWS]

AWS Account Filter

EC2 Instance State [Metrics AWS]

EC2 Instance State

[Metrics AWS] EC2 Overview


Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Essential Details - Security Hub [Logs AWS]


Integrations

Region

Account

AWS Security Hub Findings Summary

Question: aws

# AWS Security Hub Finding summary

Distribution of Events by Account [Logs AWS]

Distribution of Events by Region [Logs AWS]

Count by Severity [Logs AWS]

Top 5 values of aws.securityhub_findings.severity.label

Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Distribution of Finding's Severity Over Time [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Security Hub - Affected Instance ID [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Security Hub - Finding Types [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Security Hub - Network Direction [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Security Hub - Findings [Logs AWS]

Security Standards and Controls

Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

Details

[Findings Action Overview](#/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267) | [Findings Malware, Threat Intelligence Indicator and Network Path Overview](#/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267) | [Findings and Insights Overview](#/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4)

Dashboards [Logs AWS]

[Logs AWS] Security Hub Summary Dashboard


Overview of AWS Security Hub Findings and Insights

Question: data_stream.dataset : "aws.securityhub_findings" or data_stream.dataset : "aws.securityhub_insights"

[Findings Action Overview](#/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267) | [Findings Malware, Threat Intelligence Indicator and Network Path Overview](#/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267) | [Summary Dashboard](#/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30)

Dashboards [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Top 10 Network Protocols [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Network Direction [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Patch Summary Operation [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Severity Label [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Workflow Status [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Top 10 Process Name [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Patch Summary Reboot Option [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Top 10 Software Packages having Vulnerability [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Vendor Severity [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Vulnerable Packages Architecture [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_findings"

Distribution of Events by Compliance Status [Logs AWS]

Question: data_stream.dataset : "aws.securityhub_insights"

Top 10 Security Hub Insight Name [Logs AWS]

[Logs AWS] Security Hub Findings and Insights Overview


Overview of AWS SNS Metrics

Question: aws.sns

Question: aws.sns

AWS Region Filter [Metrics AWS]

SNS Messages and Notifications [Metrics AWS]

SNS Messages and Notifications

SNS Topic Name Filter [Metrics AWS]

SNS Publish Size [Metrics AWS]

SNS Publish Size

SNS Notifications Filtered Out [Metrics AWS]

SNS Notifications Filtered Out

SNS Notifications Filtered Out Invalid Attributes [Metrics AWS]

SNS Notifications Filtered Out No Message Attributes [Metrics AWS]

SNS Notifications Failed To Redrive To DLQ [Metrics AWS]

SNS Notifications Failed to Redrive to DLQ

SNS SMS Success Rate [Metrics AWS]

SNS SMS Success Rate

SNS Notifications Redriven To DLQ [Metrics AWS]

SNS Notifications Redriven To DLQ

SNS SMS Month To Date Spent USD [Metrics AWS]

SNS SMS Month To Date Spent USD

[Metrics AWS] SNS Overview


Dashboard providing statistics about alerts ingested from the AWS Network Firewall integration.

Question: alert

**Navigation**

[Overview](/app/dashboards#/view/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc)
**[Alerts (This Page)](/app/dashboards#/view/aws-dfa76470-4ba1-11ec-8282-5342b8988acc)**
[Flows](/app/dashboards#/view/aws-562bdea0-4ba7-11ec-8282-5342b8988acc)
[Metrics](/app/dashboards#/view/aws-3abffe60-4ba9-11ec-8282-5342b8988acc)

[Integrations Page](/app/integrations/detail/aws/overview?integration=firewall)

**Overview**

This dashboard provides an overall view of AWS Network Firewall alerts.

Firewall Filters [Logs AWS]

Firewall Filters

Unique Source IPs

Unique Destination IPs

Unique Source Countries

Unique Destination Countries

Unique Network Protocols

Unique Rules

Empty XY chart

Top Rules

Top Source Countries

Top Destination Countries

Network Protocols and Applications

Top Event Generating Firewalls

Top Event Source IPs

Top Event Destination IPs

Top Network Protocols

Firewall Logs

[Logs AWS] Firewall Alerts


Overview of AWS Billing Metrics

Question: aws.billing

AWS Account Filter [Metrics AWS]

AWS Account Filter

Estimated Billing Pie Chart [Metrics AWS]

Estimated Billing Chart

Question: not aws.billing.ServiceName : *

Total Estimated Charges [Metrics AWS]

Total Estimated Charges

Top 10 Billing per Service Name [Metrics AWS]

Top 10 Estimated Billing Per Service Name

[Metrics AWS] Billing Overview


Overview of AWS ELB Metrics

ELB HTTP 5XX Errors [Metrics AWS]

HTTP 5XX Errors

ELB Request Count [Metrics AWS]

Request Count

ELB Unhealthy Host Count [Metrics AWS]

Unhealthy Host Count

ELB Healthy Host Count [Metrics AWS]

Healthy Host Count

ELB Latency in Seconds [Metrics AWS]

Latency in Seconds

ELB HTTP Backend 4XX Errors [Metrics AWS]

HTTP Backend 4XX Errors

ELB Backend Connection Errors [Metrics AWS]

Backend Connection Errors

AWS Region Filter [Metrics AWS]

ELB HTTP Backend 2XX [Metrics AWS]

HTTP Backend 2XX

[Metrics AWS] ELB Overview


Findings Severity

Cloud Account ID

Cloud Region

Cloud Provider

Overview of Amazon Guardduty Threat.

Question: aws.guardduty

Threats by Threat Purpose, Resource Type [Logs Guardduty]

Empty XY chart

Distribution of Findings by Threat Name [Logs Guardduty]

[Logs AWS] Guardduty Findings Threat


Overview of AWS Metrics

AWS Region Filter [Metrics AWS]

EC2 Instance State [Metrics AWS]

EC2 CPU Utilization [Metrics AWS]

S3 Total Error 4xx [Metrics AWS]

S3 Total Error 5xx [Metrics AWS]

SQS Empty Receives Top5 [Metrics AWS]

SQS Messages Delayed Top5 [Metrics AWS]

Cloudwatch ELB Request Count Top5 [Metrics AWS]

Cloudwatch ELB Latency [Metrics AWS]

Cloudwatch ELB Unhealthy Host Count [Metrics AWS]

Cloudwatch Lambda Invocations Top5 [Metrics AWS]

Cloudwatch Lambda Errors Top5 [Metrics AWS]

Cloudwatch Lambda Throttles Top5 [Metrics AWS]

Question: (aws.cloudwatch.namespace:"AWS/ECS") AND (_exists_: aws.ecs.metrics.CPUReservation.avg) AND (_exists_: aws.ecs.metrics.CPUUtilization.avg)

Cloudwatch CPU Available [Metrics AWS]

Question: (aws.cloudwatch.namespace:"AWS/ECS") AND (_exists_: aws.ecs.metrics.MemoryReservation.avg) AND (_exists_: aws.ecs.metrics.MemoryUtilization.avg)

Cloudwatch Memory Available [Metrics AWS]

[Metrics AWS] Overview


Azure Spring cloud Logs Application Console Apps [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs" and azure.springcloudlogs.category : "ApplicationConsole"


Azure Spring Cloud Logs System Logs Services [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs" and azure.springcloudlogs.category : "SystemLogs"


Subscriptions Filter [Logs Azure]

Subscriptions Filter [Logs Azure]


Authorization Activity User [Logs Azure]

Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.operation_name : *LISTKEYS*

Question: azure.activitylogs.result_type : "Success"

Question: azure.activitylogs.result_type : "Fail"


Navigation Alerts [Logs Azure]

### Azure Monitoring

[Overview](#/dashboard/azure-41e84340-ec20-11e9-90ec-112a988266d5) | [Users](#/dashboard/azure-87095750-f05a-11e9-90ec-112a988266d5) | [**Alerts**](#/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5)

Navigation Alerts [Logs Azure]


Alerts Overview [Logs Azure]

Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.event_category : "Alert"

Question: azure.activitylogs.result_type: "Activated"

Question: azure.activitylogs.result_type: "Resolved" or azure.activitylogs.result_type: "Succeeded"

Alerts Overview [Logs Azure]


Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.event_category : "Alert"

Alerts Count [Logs Azure]

Question: azure.activitylogs.result_type : "Activated"

Question: azure.activitylogs.result_type : "Resolved"

Question: azure.activitylogs.result_type : "Succeeded"

Alerts Count [Logs Azure]


Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.event_category : "Alert"

Alerts Heatmap [Logs Azure]

Alerts Heatmap [Logs Azure]


This dashboard provides expanded alerts overview for Azure cloud

Navigation Alerts

Subscriptions Filter

Alerts Overview

Alerts Count

Alerts Heatmap

[Logs Azure] Alerts Overview


Azure Spring Cloud Logs System Logs Level List [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs" and azure.springcloudlogs.category : "SystemLogs"


Azure Spring Cloud Logs Navigation System Logs [Logs Azure]

### Azure Spring Cloud System Logs
[Overview](#/dashboard/azure-5ad41d90-f50e-11eb-a831-732d3e9bbd43) | [**System Logs**](#/dashboard/azure-1adf52d0-f50f-11eb-a831-732d3e9bbd43) | [Application Console Logs](#/dashboard/azure-32aedb00-f524-11eb-b9f3-73fa29f35762)


Subscription and Type Filter [Logs Azure]


Azure Spring Cloud Logs System Logs Activity [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs" and azure.springcloudlogs.category : "SystemLogs"


Azure Spring Cloud Logs System Logs Logger Type [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs" and azure.springcloudlogs.category : "SystemLogs"


[Logs Azure] Azure Spring cloud Logs System Logs

### Azure Spring Cloud Logs

[Overview](#/dashboard/azure-41e84340-ec20-11e9-90ec-112a988266d5) | [**System Logs**](#/dashboard/azure-87095750-f05a-11e9-90ec-112a988266d5) | [Application Console Logs](#/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5)

Navigation Azure System Logs

Subscription and Type Filter

System Logs Activity

Log Level

Operations

Services

Logger & Type

[Logs Azure] Azure Spring Cloud Logs System Logs


Azure Spring Cloud Logs Navigation Application Console Logs [Logs Azure]

### Azure Spring Cloud Application Console Logs

[Overview](#/dashboard/azure-5ad41d90-f50e-11eb-a831-732d3e9bbd43) | [System Logs](#/dashboard/azure-1adf52d0-f50f-11eb-a831-732d3e9bbd43) | [**Application Console Logs**](#/dashboard/azure-32aedb00-f524-11eb-b9f3-73fa29f35762)


Question: azure.firewall.operation_name : "AzureFirewallApplicationRuleLog"

Firewall Network Application Rule Logs [Logs Azure]


Dashboard providing statistics about alerts ingested from the Azure Firewall Application Rule Log events.

Question: AzureFirewallApplicationRuleLog

**Navigation**

[Overview](/app/dashboards#/view/auzre-280493a0-f1a1-11ec-a5a8-bf965bcd5646)
[Network Rule Logs](/app/dashboards#/view/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646)
[Network NAT Rule Logs](/app/dashboards#/view/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646)
**[Application Rule Logs (This Page)](/app/dashboards#/view/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646)**
[DNS Proxy Logs](/app/dashboards#/view/azure-cad82b40-f251-11ec-a5a8-bf965bcd5646)

[Integrations Page](/app/integrations/detail/azure/overview?integration=firewall_logs)

**Overview**

This dashboard provides an overall view of Azure Firewall Application Rule Log events.

Firewall Filters

Unique Source IPs

Unique Destination IPs

Unique Source Countries

Unique Destination Countries

Unique Network Protocols

Top Event Generating Firewalls

Top Source Countries

Top Destination Countries

Network Protocols and Applications

Top Event Rules

Top Event Source Addresses

Top Event Destination Addresses

Top Network Protocols

[Logs Azure] Firewall Application Rule Log


Question: azure.firewall.operation_name : "AzureFirewallNatRuleLog"

Firewall Network NAT Rule Logs [Logs Azure]


Firewall Logs [Logs Azure]


Dashboard providing an overall view of the AWS Network Firewall integration.

**Navigation**

**[Overview (This Page)](/app/dashboards#/view/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646)**
[Network Rule Logs](/app/dashboards#/view/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646)
[Network NAT Rule Logs](/app/dashboards#/view/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646)
[Application Rule Logs](/app/dashboards#/view/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646)
[DNS Proxy Logs](/app/dashboards#/view/azure-cad82b40-f251-11ec-a5a8-bf965bcd5646)

[Integrations Page](/app/integrations/detail/azure/overview?integration=firewall_logs)

**Overview**

This dashboard provides an overall view of Azure Firewall integration.

Firewall Filters

Question: event

Total Events

Question: network

Question: allowed

Total Allowed Events

Question: network

Question: denied

Total Denied Events

Unique Source IPs

Unique Destination IPs

Question: event

Unique Network Protocols

Events

Total Events by Firewall

Firewall Logs

[Logs Azure] Firewall Overview


Azure Spring Cloud Logs Application Console Logs [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs" and azure.springcloudlogs.category : "ApplicationConsole"


Azure Spring Cloud Logs Application Console Logs Log Level [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs" and azure.springcloudlogs.category : "ApplicationConsole"


Navigation Application Console Logs

Subscription and Type Filter

Application Console Logs Activity

Log Level

Services

Applications

Operations

Applications & Instances

[Logs Azure] Azure Spring Cloud Logs Application Cloud Logs


Lists sync activities produced by the Azure AD Provisioning service.

Question: azure.provisioning.category : "ProvisioningLogs"

Provisioning Logs [Azure Logs]


Provide an overview and statistics of the provisioning activities on your enterprise applications.

Question: azure.provisioning.category : "ProvisioningLogs"

Source Systems

Question: azure.provisioning.category : "ProvisioningLogs"

Provisioning Timeline

Question: azure.provisioning.category : "ProvisioningLogs"

Target Systems

Question: azure.provisioning.category : "ProvisioningLogs" and azure.provisioning.operation_name : "Provisioning activity"

Provisioning Activities

Question: azure.provisioning.category : "ProvisioningLogs"

Last Activity

[Logs Azure] Azure AD Provisioning Logs


Question: azure.firewall.operation_name : "AzureFirewallDnsProxyLog"

Firewall Network DNS Proxy Logs [Logs Azure]


Navigation Overview [Logs Azure]

### Azure Monitoring

[**Overview**](#/dashboard/azure-41e84340-ec20-11e9-90ec-112a988266d5) | [Users](#/dashboard/azure-87095750-f05a-11e9-90ec-112a988266d5) | [Alerts](#/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5)

Navigation Overview [Logs Azure]


Activity Level [Logs Azure]

Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.event_category :"Administrative"

Activity Level [Logs Azure]


Question: data_stream.dataset : "azure.activitylogs"

Activity Stats [Logs Azure]

Activity Stats [Logs Azure]


Access Requests [Logs Azure]

Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.operation_name : *LISTKEYS*

Question: event.outcome : "success" or event.outcome : "Success"

Question: event.outcome : "Failure"  or event.outcome : "failure"

Access Requests [Logs Azure]


User Tag Cloud [Logs Azure]

User Tag Cloud [Logs Azure]


Service Health Overview [Logs Azure]

Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.event_category : "ServiceHealth"

Question: azure.activitylogs.result_type: "Active"

Question: azure.activitylogs.result_type: "Resolved"

Service Health Overview [Logs Azure]


Top Resource Groups [Logs Azure]

Count

Top Resource Groups [Logs Azure]


Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.event_category : "ServiceHealth"

Service Health Count [Logs Azure]

Question: azure.activitylogs.result_type : "Active"

Question: azure.activitylogs.result_type : "Resolved"

Service Health Count [Logs Azure]


Question: data_stream.dataset :"azure.activitylogs"

Resource Creations [Logs Azure]

Count

Resource Creations [Logs Azure]


Question: data_stream.dataset :"azure.activitylogs"

Resource Deletions [Logs Azure]

Count

Resource Deletions [Logs Azure]


This dashboard provides an overview of user activity, alerts and resource in Azure cloud.

Navigation Overview

Subscriptions Filter

Activity Level

Activity Stats

Access Requests

Top Active Users

Alerts Overview

Service Health

Top Resource Groups

Alerts Count

Service Health Count

Resource Creations

Resource Deletions

[Logs Azure] Cloud Overview


Users List [Logs Azure]

Users List [Logs Azure]


Azure Spring Cloud Logs Navigation Overview [Logs Azure]

### Azure Spring Cloud  Overview Logs

[**Overview**](#/dashboard/azure-5ad41d90-f50e-11eb-a831-732d3e9bbd43) | [System Logs](#/dashboard/azure-1adf52d0-f50f-11eb-a831-732d3e9bbd43) | [Application Console Logs](#/dashboard/azure-32aedb00-f524-11eb-b9f3-73fa29f35762)


Azure Spring Cloud Logs Activity Level [Logs Azure]

Question: data_stream.dataset :"azure.springcloudlogs"


Azure Spring Cloud Logs Top Resource Groups [Logs Azure]

Count


Azure Spring Cloud Logs Service  List [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs"


Azure Spring Cloud Logs Overview Level [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs"