Security Onion - Network - Source IPs

Security Onion - Network - Source IPs


SSL - Version (Pie Chart)

SSL - Version (Pie Chart)


SIP - Status

SIP - Status


SIP - Destination IP Address

SIP - Destination IP Address


osquery - Chrome Extensions - Changes by Hostname


Connections - Missed Bytes

Connections - Missed Bytes


Security Onion - SMB - Path

Security Onion - SMB - Path


Security Onion - Rule - GID/SID

Security Onion - Rule - GID/SID


Connections - Source - Originator Bytes ( Tile Map)


osquery - Changes by Hostname

osquery - Changes by Hostname


FTP - Log Count Over Time

FTP - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - DNS - Query

Security Onion - DNS - Query


Security Onion - SMTP - Subject

Security Onion - SMTP - Subject


Intel - Indicator Type (Vertical Bar Chart)

Indicator Type

Count


MySQL - Command/Argument

MySQL - Command/Argument


Notices - Notice Type

Notices - Notice Type


Security Onion - HTTP - Method

Security Onion - HTTP - Method


Hash - SHA256

Hash - SHA256


SSH - Log Count Over TIme

SSH - Log Count Over TIme

@timestamp per 12 hours

Count


Security Onion - Hash - MD5

Security Onion - Hash - MD5


Syslog - Host From

Syslog - Host From


X.509 - Certificate Issuer

X.509 - Certificate Issuer


RDP - Destination IP Address

RDP - Destination IP Address


Security Onion - RDP - Certificate Type

Security Onion - RDP - Certificate Type


DNS - Query Type

DNS - Query Type


Security Onion - RADIUS - Reply

Security Onion - RADIUS - Reply


Modbus - Log Count Over Time

Modbus - Log Count Over Time

@timestamp per 12 hours

Count


Weird - Log Count Over TIme

@timestamp per 12 hours

Count

Weird - Log Count Over TIme


SNMP - Destination IP Address

SNMP - Destination IP Address


Sysmon - Summary

Sysmon - Summary


Security Onion - Kerberos Client

Security Onion - Kerberos Client


Sensors/Devices - Total Number of Logs

Sensors/Devices - Total Number of Logs


Security Onion - SSH - Direction

Security Onion - SSH - Direction


DHCP - Destination IP Address

DHCP - Destination IP Address


DCE/RPC - Destination IP Address

DCE/RPC - Destination IP Address


RADIUS - MAC

RADIUS - MAC


Connections - Source - Sum of Total Bytes ( Tile Map)


Connections - Destination - Sum of Total Bytes ( Tile Map)


Sysmon - Username

Sysmon - Username


Connections - Connection State

Connections - Connection State


RFB - Exclusive Session (Donut Chart)

RFB - Exclusive Session (Donut Chart)


Security Onion - Agents

Security Onion - Agents


X.509 - Certificate Key Length (Vertical Bar Chart)

Key Length

Count


Security Onion - Rule - Description

Security Onion - Rule - Description


Security Onion - Notice - Message

Security Onion - Notice - Message


SMB - Source IP Address

SMB - Source IP Address


Security Onion - DHCP - Server Address

Security Onion - DHCP - Server Address


Modbus - Destination Port

Modbus - Destination Port


RDP - Destination Port

RDP - Destination Port


Notices - Destination Country

Notices - Destination Country


NIDS - Drilldown - Alert Title

NIDS - Drilldown - Alert Title


Weird - Source IP Address

Weird - Source IP Address


Total Log Count Over TIme

Total Log Count Over TIme

@timestamp per 30 seconds

Count


Security Onion - SMB - Service

Security Onion - SMB - Service


Autoruns - Profile

Autoruns - Profile


OSSEC Alerts - User to Escalated User (Data Table)


DNS - Log Count Over Time

DNS - Log Count Over Time

@timestamp per 30 minutes

Count


SIP - Method (Horizontal Bar Chart)

SIP - Method (Horizontal Bar Chart)

Count


Security Onion - MySQL - Command/Argument


Modbus - Source IP Address

Modbus - Source IP Address


Security Onion - DNP3 - FC Reply

Security Onion - DNP3 - FC Reply


SSL - Destination Address

SSL - Destination Address


DNS - Response Code (Name)

DNS - Response Code (Name)


Security Onion - Connections - State

Security Onion - Connections - State


SSL - Validation Status

SSL - Validation Status


Security Onion - Logs Over Time

Security Onion - Logs Over Time

Count


Connections - Bytes and Duration

Connections - Bytes and Duration

[Top Total Bytes](/kibana/app/kibana#/dashboard/a2ab0c40-3b0a-11e7-a6f9-5d3fe735ec2b)
[Source - Originator Bytes](/kibana/app/kibana#/dashboard/68f738e0-46ca-11e7-946f-1bfb1be7c36b) | [Destination - Responder Bytes](/kibana/app/kibana#/dashboard/b65775e0-46cb-11e7-946f-1bfb1be7c36b)
[Source - Sum of Total Bytes](/kibana/app/kibana#/dashboard/f042ad60-46c6-11e7-946f-1bfb1be7c36b) | [Destination - Sum of Total Bytes](/kibana/app/kibana#/dashboard/ccfcc540-4638-11e7-a82e-d97152153689)
[Source - Top Connection Duration](/kibana/app/kibana#/dashboard/4e108070-46c7-11e7-946f-1bfb1be7c36b) | [Destination - Top Connection Duration](/kibana/app/kibana#/dashboard/ea211360-46c4-11e7-a82e-d97152153689)


Tunnels - Destination Address

Tunnels - Destination Address


RFB - Log Count Over TIme

RFB - Log Count Over TIme

@timestamp per 12 hours

Count


Security Onion - SIP - Method

Security Onion - SIP - Method


Bro - Connections - Service By Destination Country


Security Onion - RADIUS - Result

Security Onion - RADIUS - Result


OSSEC - Log Count Over Time

OSSEC - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - X.509 - Key Type

Security Onion - X.509 - Key Type


Security Onion - HTTP - Virtual Host

Security Onion - HTTP - Virtual Host


Connections - Top Source IPs

Connections - Top Source IPs


Kerberos - Source IP Address

Kerberos - Source IP Address


Security Onion - SSH - Client

Security Onion - SSH - Client


FIles - Destination IP Address

FIles - Destination IP Address


Sysmon - Target Filename

Sysmon - Target Filename


Connections - Source Country

Connections - Source Country


NTLM - Server Tree Name

NTLM - Server Tree Name


Firewall - Action/Reason (Vertical Bar Chart)

Action

Count


SNMP - Version

SNMP - Version


HTTP - Referrer

HTTP - Referrer


Bro - Notices - Notice Types

Bro - Notices - Notice Types


SSH - Client/Server

SSH - Client/Server


Security Onion - Kerberos - Request Type


Connections - Log Count Over Time

Connections - Log Count Over Time

@timestamp per 12 hours

Count


SIP - Content Type (Pie Chart)

SIP - Content Type (Pie Chart)


Security Onion - RDP - Cookie

Security Onion - RDP - Cookie


Autoruns - Entry

Autoruns - Entry


osquery - Change Stats

osquery - Change Stats


Question: event.dataset:files

Security Onion - File - Analyzer

Security Onion - File - Analyzer


Intel - Seen (Donut Chart)

Intel - Seen (Donut Chart)


Notices - Log Count Over Time

Notices - Log Count Over Time

@timestamp per 12 hours

Count


RADIUS - Authentication Result

RADIUS - Authentication Result


SMB - File/Path Summary

SMB - File/Path Summary


Sysmon - Source IP Address

Sysmon - Source IP Address


Security Onion - Alert Data

Security Onion - Alert Data


Security Onion - HTTP - Destination IPs

Security Onion - HTTP - Destination IPs


Weird - Destination IP Address

Weird - Destination IP Address


Security Onion - RFB - Server Version

Security Onion - RFB - Server Version


DHCP - Source IP Address

DHCP - Source IP Address


SMB - Destination IP Address

SMB - Destination IP Address


Tunnels - Action (Horizontal Bar Chart)

Tunnels - Action (Horizontal Bar Chart)

Count


Bro - Syslog - Severity (Horizontal Bar Chart)

Severity

Count


Security Onion - Connections Over Time

Security Onion - Connections Over Time

Count


Security Onion - SMB - Share Type

Security Onion - SMB - Share Type


Intel - Log Count Over Time

Intel - Log Count Over Time

@timestamp per 12 hours

Count


osquery - Changes by Type

osquery - Changes by Type


NTLM - Log Count Over Time

NTLM - Log Count Over Time

@timestamp per minute

Count


SSL - Certificate Subject

SSL - Certificate Subject


HTTP - Log Count Over Time

HTTP - Log Count Over Time

@timestamp per 12 hours

Count


NIDS - Alert Summary - Drilldown

NIDS - Alert Summary - Drilldown


Logstash - Error Type (Donut Chart)

Logstash - Error Type (Donut Chart)


Security Onion - MySQL - Response

Security Onion - MySQL - Response


Sysmon - Image

Sysmon - Image


Syslog - Priority (Vertical bar Chart)

Syslog - Priority (Vertical bar Chart)

Priority

Count


IRC - Destination Port

IRC - Destination Port


Modbus - Destination IP Address

Modbus - Destination IP Address


Tunnels - Source IP Address

Tunnels - Source IP Address


Security Onion - File - Source

Security Onion - File - Source


NIDS - Destination Port

NIDS - Destination Port


Kerberos - Destination IP Address

Kerberos - Destination IP Address


HTTP - Destination Port (Vertical Bar Chart)

Port

Count


Security Onion - Agent - Name

Security Onion - Agent - Name


Security Onion - SMTP - User Agent

Security Onion - SMTP - User Agent


Connections - Top 10 - Total Bytes By Source IP

Source IP Address

Total Bytes


X.509 - Log Count Over Time

X.509 - Log Count Over Time

@timestamp per 12 hours

Count


DNS - Baby Domain Requests

DNS - Baby Domain Requests


Security Onion - SNMP - Community String


DCE/RPC - Summary

DCE/RPC - Summary


Tunnels - Type (Pie Chart)

Tunnels - Type (Pie Chart)


X.509 - Certificate Key Algorithm (Horizontal Bar Chart)

Count


OSSEC Alerts - Process and Username (Data Table)


Modbus - Function

Modbus - Function


NIDS Alerts - Category

NIDS Alerts - Category

Category

Count


DNS - Query Class (Pie Chart)

DNS - Query Class (Pie Chart)


PE - OS (Pie Chart)

PE - OS (Pie Chart)


Security Onion - SSH - Server

Security Onion - SSH - Server


Security Onion - X.509 - SAN DNS

Security Onion - X.509 - SAN DNS


Autoruns - Category

Autoruns - Category

Category

Count


Security Onion - Kerberos - Service

Security Onion - Kerberos - Service


DNP3 - Destination Port

DNP3 - Destination Port


Security Onion - SIP - Request From

Security Onion - SIP - Request From


Question: network.transport:*

Security Onion - Network - Transport

Security Onion - Network - Transport


Strelka - File - Source

Strelka - File - Source


DNS - Protocol (Donut Chart)

DNS - Protocol (Donut Chart)


Kerberos - Request Type (Horizontal Bar Chart)

Count


Security Onion - Network - Destination IPs


Security Onion - Notice - Action

Security Onion - Notice - Action


NTLM - Username

NTLM - Username


Question: event_type:bro_dns AND highest_registered_domain:google.com~ -highest_registered_domain:google.com AND highest_registered_domain:youtube.com~ -highest_registered_domain:youtube.com AND highest_registered_domain:facebook.com~ -highest_registered_domain:facebook.com AND highest_registered_domain:wikipedia.org~ -highest_registered_domain:wikipedia.org AND highest_registered_domain:google.co.in~ -highest_registered_domain:google.co.in AND highest_registered_domain:reddit.com~ -highest_registered_domain:reddit.com AND highest_registered_domain:amazon.com~ -highest_registered_domain:amazon.com AND highest_registered_domain:taobao.com~ -highest_registered_domain:taobao.com AND highest_registered_domain:twitter.com~ -highest_registered_domain:twitter.com AND highest_registered_domain:google.co.jp~ -highest_registered_domain:google.co.jp AND highest_registered_domain:instagram.com~ -highest_registered_domain:instagram.com AND highest_registered_domain:sina.com.cn~ -highest_registered_domain:sina.com.cn AND highest_registered_domain:google.co.uk~ -highest_registered_domain:google.co.uk AND highest_registered_domain:linkedin.com~ -highest_registered_domain:linkedin.com AND highest_registered_domain:list.tmall.com~ -highest_registered_domain:list.tmall.com AND highest_registered_domain:google.com.br~ -highest_registered_domain:google.com.br AND highest_registered_domain:google.com.hk~ -highest_registered_domain:google.com.hk AND highest_registered_domain:netflix.com~ -highest_registered_domain:netflix.com AND highest_registered_domain:yahoo.co.jp~ -highest_registered_domain:yahoo.co.jp AND highest_registered_domain:pornhub.com~ -highest_registered_domain:pornhub.com AND highest_registered_domain:xvideos.com~ -highest_registered_domain:xvideos.com AND highest_registered_domain:microsoft.com~ -highest_registered_domain:microsoft.com AND highest_registered_domain:livejasmin.com~ -highest_registered_domain:livejasmin.com AND highest_registered_domain:aliexpress.com~ -highest_registered_domain:aliexpress.com AND highest_registered_domain:stackoverflow.com~ -highest_registered_domain:stackoverflow.com AND highest_registered_domain:wordpress.com~ -highest_registered_domain:wordpress.com AND highest_registered_domain:hao123.com~ -highest_registered_domain:hao123.com AND highest_registered_domain:github.com~ -highest_registered_domain:github.com AND highest_registered_domain:amazon.co.jp~ -highest_registered_domain:amazon.co.jp AND highest_registered_domain:blogspot.com~ -highest_registered_domain:blogspot.com AND highest_registered_domain:pinterest.com~ -highest_registered_domain:pinterest.com AND highest_registered_domain:bongacams.com~ -highest_registered_domain:bongacams.com AND highest_registered_domain:google.com.tr~ -highest_registered_domain:google.com.tr AND highest_registered_domain:popads.net~ -highest_registered_domain:popads.net AND highest_registered_domain:paypal.com~ -highest_registered_domain:paypal.com AND highest_registered_domain:office.com~ -highest_registered_domain:office.com AND highest_registered_domain:google.com.tw~ -highest_registered_domain:google.com.tw AND highest_registered_domain:google.com.au~ -highest_registered_domain:google.com.au AND highest_registered_domain:whatsapp.com~ -highest_registered_domain:whatsapp.com AND highest_registered_domain:microsoftonline.com~ -highest_registered_domain:microsoftonline.com

DNS - Phishing Attempts Against Alexa Top Sites

Phishing attempts against your domain(s)


PE - Section Name

PE - Section Name


DHCP - IP to MAC Assignment

DHCP - IP to MAC Assignment


Security Onion - SSL - Issuer

Security Onion - SSL - Issuer


OSSEC Alerts - Log Count Over TIme

OSSEC Alerts - Log Count Over TIme

@timestamp per 12 hours

Count


RFB - Server Version

RFB - Server Version


Security Onion - Host - Process Name

Security Onion - Host - Process Name


Security Onion - Rule - Name

Security Onion - Rule - Name


Security Onion - File Size

Security Onion - File Size


Security Onion - HTTP - Destination Port


RDP - Client

RDP - Client


Security Onion - DNS - Answers

Security Onion - DNS - Answers


Tunnels - Destination Port

Tunnels - Destination Port


SIP - Log Count Over Time

SIP - Log Count Over Time

@timestamp per 12 hours

Count


SSL - Server

SSL - Server


SMTP - Webmail - True/False (Vertical Bar Chart)

Webmail

Count


Notices - File MIME Type

Notices - File MIME Type


Security Onion - Connections - History

Security Onion - Connections - History


SSH - Destination Port

SSH - Destination Port


DCE/RPC - Endpoint

DCE/RPC - Endpoint


DNS - Client

DNS - Client


DHCP - Lease Time

DHCP - Lease Time


DNP3 - Log Count Over TIme

DNP3 - Log Count Over TIme

@timestamp per 30 minutes

Count


Devices - Log Count By Device

Devices - Log Count By Device


Security Onion - Nodes

Security Onion - Nodes


MySQL - Log Count Over Time

MySQL - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - RFB - Client Version

Security Onion - RFB - Client Version


RADIUS - Connection Information

RADIUS - Connection Information


ElastAlert - Rule

ElastAlert - Rule


SIP - URI

SIP - URI


Connections - Source - Top Connection Duration  (Tile Map)


Security Onion - FTP - Argument

Security Onion - FTP - Argument


SMB - FIle Path

SMB - FIle Path


Data Types

Data Types


SSL - Log Count Over TIme

SSL - Log Count Over TIme

@timestamp per 12 hours

Count


Intel - Source

Intel - Source


NIDS Alerts - Source Port

NIDS Alerts - Source Port


Security Onion - Modbus - Function

Security Onion - Modbus - Function


Security Onion - MySQL - Success

Security Onion - MySQL - Success


Security Onion - Connections - Top Destination IPs


Intel - Indicator

Intel - Indicator


RFB - Desktop Name

RFB - Desktop Name


Security Onion - NTLM - Server

Security Onion - NTLM - Server


Security Onion - Least Common HTTP Methods


NIDS - Drilldown - Rule Signature

NIDS - Drilldown - Rule Signature


Files - Log Count Over Time

Files - Log Count Over Time

@timestamp per 12 hours

Count


Notices - Source IP Addresses

Notices - Source IP Addresses


HTTP  - Status and Method

HTTP  - Status and Method


FIles - Source IP Address

FIles - Source IP Address


Security Onion - Network Data - Count

Security Onion - Network Data - Count


Security Onion - SMTP - Version

Security Onion - SMTP - Version


Weird - Name

Weird - Name


OSSEC Alerts - Alert Level (Pie Chart)

OSSEC Alerts - Alert Level (Pie Chart)


Security Onion - Source IPs

Security Onion - Source IPs


Sysmon - Destination Port

Sysmon - Destination Port

Port

Count


DCE/RPC - Named Pipe

DCE/RPC - Named Pipe


Bro - Syslog - Source IP Address

Bro - Syslog - Source IP Address


Autoruns - Signer

Autoruns - Signer


Security Onion - HTTP - Source IPs

Security Onion - HTTP - Source IPs


DNS - Server

DNS - Server


SMB - Action (Pie Chart)

SMB - Action (Pie Chart)


Security Onion - SSL - Subject

Security Onion - SSL - Subject


Strelka - File - MIME Flavors

Strelka - File - MIME Flavors


Security Onion - Connections - Responder Bytes


Kerberos - Client

Kerberos - Client


osquery -  Chrome Extensions - Change Stats

osquery -  ChromeExt - Change Stats


Question: "application/x-dosexec"

HTTP - Sites Hosting EXEs

HTTP - Sites Hosting EXEs


Connections - Total Bytes Per Source/Destination IP Pair

orderAgg

Order Agg

Order Agg


SMB - File Name

SMB - File Name


Log Type Per Sensor/Device

Log Type Per Sensor/Device


Top 50 - Source IP Address

Top 50 - Source IP Address


X.509 - Certificate Signing Algorithm

X.509 - Certificate Signing Algorithm


SMTP - "From" Address

SMTP - "From" Address


SIP - User Agent

SIP - User Agent


Question: event_type:bro_dns AND highest_registered_domain:securityonion.net~ -securityonion.net

DNS - Phishing Attempts Against Organizational Domain(s)


RDP - Cookie

RDP - Cookie


Security Onion - Host - Process CLI

Security Onion - Host - Process CLI


NTLM - Hostname to Username

NTLM - Hostname to Username


Security Onion - Tunnels - Type

Security Onion - Tunnels - Type


osquery - Chrome Extensions - Sensitive Permissions


Notices - File Description

Notices - File Description


Syslog - Log Count Over Time

Syslog - Log Count Over Time

@timestamp per 10 minutes

Count


Security Onion - Network - Transport

Security Onion - Network - Transport


Security Onion - SMTP - Sender

Security Onion - SMTP - Sender


Security Onion - FIle - Name

Security Onion - FIle - Name


IRC - Command

IRC - Command


Sysmon - Destination IP Address

Sysmon - Destination IP Address


RFB - Client Version

RFB - Client Version


Notices - Destination IP Addresses

Notices - Destination IP Addresses


SMTP - Log Count Over TIme

SMTP - Log Count Over TIme

@timestamp per 12 hours

Count


Question: event_type:bro_http AND _exists_:virtual_host_frequency_score

HTTP - Virtual Host Frequency Analysis

HTTP - Virtual Host Frequency Analysis


Security Onion - SSH - Authentication Sucess


SNMP - Destination Port

SNMP - Destination Port


PE - Machine

PE - Machine


Question: event_type:bro_dns AND _exists_:highest_registered_domain_frequency_score

DNS - Highest Registered Domain Frequency Analysis


Connections - Destination - Top Connection Duration  (Tile Map)


Security Onion - Network Data

Security Onion - Network Data

[Home](/kibana/app/kibana#/dashboard/a8411b30-6d03-11ea-b301-3d6c35840645)

**Datasets**
[Connections](/kibana/app/kibana#/dashboard/0cc628b0-6e9f-11ea-9266-1fd14ca6af34) |  [DCE/RPC](/kibana/app/kibana#/dashboard/9e882df0-72c5-11ea-8dd2-9d8795a1200b) |
[DHCP](/kibana/app/kibana#/dashboard/9e882df0-72c5-11ea-8dd2-9d8795a1200b)
[DNP3](/kibana/app/kibana#/dashboard/b1f52180-755a-11ea-9565-7315f4ee5cac)  |  [DNS](/kibana/app/kibana#/dashboard/55ac6bf0-6ec4-11ea-9266-1fd14ca6af34) |
[FTP](/kibana/app/kibana#/dashboard/739bfad0-755a-11ea-9565-7315f4ee5cac) |
[HTTP](/kibana/app/kibana#/dashboard/44e9c820-6eb1-11ea-9266-1fd14ca6af34) | [IRC](/kibana/app/kibana#/dashboard/38523560-75ba-11ea-9565-7315f4ee5cac)  |
[Kerberos](/kibana/app/kibana#/dashboard/b207ab90-75bc-11ea-9565-7315f4ee5cac)
[Modbus](/kibana/app/kibana#/dashboard/886a7b90-75bd-11ea-9565-7315f4ee5cac) |
[MySQL](/kibana/app/kibana#/dashboard/c3ced6d0-75be-11ea-9565-7315f4ee5cac)  |
[NTLM](/kibana/app/kibana#/dashboard/558292e0-75c1-11ea-9565-7315f4ee5cac)  |
[RADIUS](/kibana/app/kibana#/dashboard/b9769e60-75c4-11ea-9565-7315f4ee5cac) | [RDP](/kibana/app/kibana#/dashboard/5b743150-75c5-11ea-9565-7315f4ee5cac) |
[RFB](/kibana/app/kibana#/dashboard/c8b3c360-75c6-11ea-9565-7315f4ee5cac) | [SIP](/kibana/app/kibana#/dashboard/dd98e260-75c6-11ea-9565-7315f4ee5cac)
[SMB](/kibana/app/kibana#/dashboard/f24d7b80-75c6-11ea-9565-7315f4ee5cac) | [SMTP](/kibana/app/kibana#/dashboard/00304500-75e7-11ea-9565-7315f4ee5cac) | [SNMP](/kibana/app/kibana#/dashboard/96522610-75e8-11ea-9565-7315f4ee5cac) |
[SSH](/kibana/app/kibana#/dashboard/9dfd77e0-75eb-11ea-9565-7315f4ee5cac) | [SSL](/kibana/app/kibana#/dashboard/efae8de0-75eb-11ea-9565-7315f4ee5cac) | [Syslog](/kibana/app/kibana#/dashboard/66499a20-75ed-11ea-9565-7315f4ee5cac) | [Tunnels](/kibana/app/kibana#/dashboard/c962dd60-75ed-11ea-9565-7315f4ee5cac) | [X.509](/kibana/app/kibana#/dashboard/2e0865f0-75ee-11ea-9565-7315f4ee5cac)


PE - Subsystem (Pie Chart)

PE - Subsystem (Pie Chart)


Security Onion - MySQL - Success

Security Onion - MySQL - Success

Count


Security Onion - SIP - Response From

Security Onion - SIP - Response From


NIDS - Alerts By Country (Vertical Bar Chart)

Country

Count


Connections - Source IP Address

Connections - Source IP Address


Security Onion - FTP - User

Security Onion - FTP - User


SNMP - Community String

SNMP - Community String


Security Onion - Network Data Over Time

Security Onion - Network Data Over Time

Count


Kerberos - Destination Port

Kerberos - Destination Port


DNP3 - Function Request

DNP3 - Function Request


IRC - Log Count Over Time

IRC - Log Count Over Time

@timestamp per 12 hours

Count


SMB - Log Count Over Time

SMB - Log Count Over Time

@timestamp per minute

Count


DCE/RPC - Operation

DCE/RPC - Operation


RFB - Authentication Status (Donut Chart)


SSH - Source IP Address

SSH - Source IP Address


Security Onion - SSH - HASSH

Security Onion - SSH - HASSH


Question: event.module:*

Security Onion - Modules

Security Onion - Modules


HTTP - Sites

HTTP - Sites


Files - MIME Type (Bar Chart)

Files - MIME Type (Bar Chart)

MIME Type

Count


Security Onion - NTLM - Tree

Security Onion - NTLM - Tree


Sysmon - Log Count Over Time

Sysmon - Log Count Over Time

@timestamp per 30 seconds

Count


Security Onion - Navigation

Security Onion - Navigation

[Home](/kibana/app/kibana#/dashboard/a8411b30-6d03-11ea-b301-3d6c35840645)

**Event Category**
[Alert](/kibana/app/kibana#/dashboard/0e4af1d0-72ae-11ea-8dd2-9d8795a1200b) |
[File](/kibana/app/kibana#/dashboard/0245be10-6ec1-11ea-9266-1fd14ca6af34) |
[Host](/kibana/app/kibana#/dashboard/92e63cc0-6ec0-11ea-9266-1fd14ca6af34)  | [Network](/kibana/app/kibana#/dashboard/04ff3ef0-6ea4-11ea-9266-1fd14ca6af34)


Weird - Notice Generated (Donut Chart)

Weird - Notice Generated (Donut Chart)


RDP - Client Build

RDP - Client Build


ElastAlert - Source IP Address

ElastAlert - Source IP Address


Question: event_type:bro_ssl AND _exists_:certificate_common_name_frequency_score

SSL - Certificate Common Name Frequency Analysis


Security Onion - Files - MIME Type

Security Onion - Files - MIME Type


All Sensors - Log Type

All Sensors - Log Type


SIP - Destination Country (Pie Chart)

SIP - Destination Country (Pie Chart)


Security Onion - Rule - ID

Security Onion - Rule - ID


Bro - Syslog - Log Count Over Time

Bro - Syslog - Log Count Over Time

@timestamp per 30 seconds

Count


SIP - Content Type

SIP - Content Type


Security Onion - Alerts - Count

Security Onion - Alerts - Count


HTTP - MIME Type (Tag Cloud)

HTTP - MIME Type (Tag Cloud)


Security Onion - Modbus - Exception

Security Onion - Modbus - Exception


Autoruns - Company

Autoruns - Company


SMTP - "To" Address

SMTP - "To" Address


ElastAlert - Log Count Over Time

ElastAlert - Log Count Over Time

@timestamp per 30 seconds

Count


NIDS - Alert Summary

NIDS - Alert Summary


Security Onion - Connections - Client Bytes


SSH - Destination IP Address

SSH - Destination IP Address


Security Onion  - Files

Security Onion  - Files

[Home](/kibana/app/kibana#/dashboard/a8411b30-6d03-11ea-b301-3d6c35840645)

**Modules**
[Strelka](/kibana/app/kibana#/dashboard/ff689c50-75f3-11ea-9565-7315f4ee5cac)
[Zeek](/kibana/app/kibana#/dashboard/ad4d5d60-75f4-11ea-9565-7315f4ee5cac)


Connections - Destination IP Address

Connections - Destination IP Address


Security Onion - DHCP - Requested Address


Software - Summary

Software - Summary


MySQL - Response

MySQL - Response


Sensors - Sensor and Services (Pie Chart)


PE - Log Count Over Time

PE - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - Connections - Top Source Ports


Security Onion - SIP - Content Type

Security Onion - SIP - Content Type


OSSEC Alerts - Command (Data Table)

OSSEC Alerts - Command (Data Table)


Help

Help

## Introduction
Welcome to the Security Onion Elastic Stack!  This is our implementation of the Elastic Stack on Security Onion.  The Elastic Stack consists of three primary components:
- `Elasticsearch` - stores logs
- `Logstash` - collects and enriches logs before storing them in Elasticsearch
- `Kibana` - web interface for visualizing logs

## Sidebar
Starting on the far left side of the page, you see the Sidebar.  This contains links such as:
- `Discover` - search data
- `Visualize` - create visualizations based on searches
- `Dashboard` - view or create dashboards based on visualizations
- `Timelion` - timeline analysis
- `Dev Tools` - query Elasticsearch directly
- `Management` - view or modify Kibana settings
- `Squert` - separate web interface for viewing NIDS and HIDS alerts
- `Logout` - log out of your session

The first six of those links are within Kibana itself.  If you click one of those and then want to get back to the Dashboards area where you started, simply click the `Dashboard` link.

Clicking the `Squert` link will take you out of Kibana and into Squert.  You will not be required to authenticate to Squert since you already have an active Single Sign On (SSO) session.

Clicking the `Logout` link in either Squert or Kibana will log you out of your SSO session and take you back to the logon screen.

## Navigation Panel
When you are in the Kibana Dashboard area, the panel to the immediate right of the sidebar is the Navigation Panel and it includes links to our dashboards such as Home, Help (this page), Bro Notices, ElastAlert, HIDS, NIDS, etc.  Clicking one of the links in the Navigation Panel will take you to a dashboard dedicated to that particular log type.

## Dashboards
All dashboards are designed to work at 1024x768 screen resolution in order to maximize compatibility.

### Dashboard Hyperlinks

The `source_ip` and `destination_ip` fields are hyperlinked.  These hyperlinks will take you to the Indicator dashboard which will help you analyze the traffic relating to that particular IP address.

`UID` fields are also hyperlinked.  This hyperlink will start a new Kibana search for that particular UID.  In the case of Bro UIDs this will show you all Bro logs related to that particular connection.

Each log entry also has an `_id` field that is hyperlinked.  This hyperlink will take you to CapMe, allowing you to request full packet capture for any arbitrary log type.  This assumes that the log is for tcp or udp traffic that was seen by Bro and Bro recorded it correctly in its conn.log.

### Overview Dashboard
When you first go to the Kibana Dashboard area, you are automatically placed into the Overview dashboard, where you will see overview information, such as total number of logs and sensors.  Use the information on the Overview dashboard to determine which of the other dashboards on the Navigation Panel you might want to visit next.

### Dashboard Categories
Our remaining dashboards are grouped into a few categories:
- `Alert Data` - dashboards that display alerts created by rules or signatures
- `Bro Hunting` - dashboards that allow you to slice and dice network metadata for hunting
- `Host Hunting` - dashboards that allow you to hunt via host telemetry
- `Other` - dashboards that don't fit into the categories above

### Bro Notices
Bro sniffs network traffic and generates notices such as `SSL::Invalid Server Cert` and `TeamCymruMalwareHashRegistry::Match`.

### ElastAlert
ElastAlert queries Elasticsearch on a regular basis and then generates alerts based on your desired criteria.  Security Onion includes two example rules that alert on new IDS events and new connection logs.  You can add your own ElastAlert rules in `/etc/elastalert/rules/`.

### HIDS
OSSEC analyzes log files and generates Host Intrusion Detection System alerts based on its ruleset at `/var/ossec/rules/`.  You can add your own rules in `/var/ossec/rules/local_rules.xml`.

### NIDS
Security Onion can use either Snort or Suricata to sniff network traffic and generate Network Intrusion Detection System alerts.

### Connections
Bro sniffs network traffic and logs connection metadata including source IP/port, destination IP/port, protocol, and number of bytes.

### DCE/RPC
Bro sniffs network traffic and logs DCE/RPC metadata including source IP/port, destination IP/port, operation, endpoint, and named pipe.

### DHCP
Bro sniffs network traffic and logs DHCP requests and responses including source IP/port, destination IP/port, and MAC addresses.

### DNP3
Bro sniffs network traffic and logs DNP3 metadata including source IP/port, destination IP/port, function request, function reply.

### DNS
Bro sniffs network traffic and logs DNS queries and answers.  Bro also includes other name lookups such as Windows NetBIOS name service requests and Bonjour.

### Files
Bro sniffs network traffic and logs metadata related to files being transferred over the network including IP addresses, MIME type, source, and checksums.

### FTP
Bro sniffs network traffic and logs FTP metadata including source IP/port, destination IP/port, command, reply code, argument, and username.

### HTTP
Bro sniffs network traffic and logs HTTP metadata including source IP/port, destination IP/port, method, status message, MIME type, site name, referer, and user agent.

### Intel
Bro sniffs network traffic and watches for indicators using the Intel framework.  You can add your own indicators to `/opt/bro/share/bro/intel/intel.dat`.

### IRC
Bro sniffs network traffic and logs IRC metadata including source IP/port, destination IP/port, command, and username.

### Kerberos
Bro sniffs network traffic and logs Kerberos metadata including source IP/port, destination IP/port, cipher, client, server, service, request type, and success status.

### Modbus
Bro sniffs network traffic and logs Modbus metadata including source IP/port, destination IP/port, and function.

### MySQL
Bro sniffs network traffic and logs MySQL metadata including source IP/port, destination IP/port, command/argument, status, and response.

### NTLM
Bro sniffs network traffic and logs NTLM metadata including source IP/port, destination IP/port, hostname, username, and status.

### PE
Bro sniffs network traffic and logs PE metadata including OS, subsystem, machine, and section name.

### RADIUS
Bro sniffs network traffic and logs RADIUS metadata including source IP/port, destination IP/port, username, and result.

### RDP
Bro sniffs network traffic and logs RDP metadata including source IP/port, destination IP/port, client build, keyboard layout, encryption level, and result.

### RFB
Bro sniffs network traffic and logs RFB metadata including source IP/port, destination IP/port, authentication method, authentication status, client version, server version, and desktop name.

### SIP
Bro sniffs network traffic and logs SIP metadata including source IP/port, destination IP/port, method, content type, status, uri, and user agent.

### SMB
Bro sniffs network traffic and logs SMB metadata including source IP/port, destination IP/port, file name, and action.

### SMTP
Bro sniffs network traffic and logs SMTP metadata including source IP/port, destination IP/port, from, to, subject, and user agent.

### SNMP
Bro sniffs network traffic and logs SNMP metadata including source IP/port, destination IP/port, version, community, and duration.

### Software
Bro sniffs network traffic and logs metadata relating to the kinds of software that generated that traffic including name, type, and version.

### SSH
Bro sniffs network traffic and logs SSH metadata including source IP/port, destination IP/port, client version, server version, and success.

### SSL
Bro sniffs network traffic and logs SSL metadata including source IP/port, destination IP/port, server name, certificate subject, cipher, and validation status.

### Syslog
Bro sniffs network traffic and logs Syslog metadata including source IP/port, destination IP/port, severity, and protocol.

### Tunnels
Bro sniffs network traffic and detects IP, GRE, SOCKS, TEREDO, and AVAYA tunnels.  It logs metadata including source IP/port, destination IP/port, type, and action.

### Weird
Bro sniffs network traffic and logs protocol anomalies metadata including source IP/port, destination IP/port, and the type of anomaly.

### X.509
Bro sniffs network traffic and logs X.509 metadata including certificate subject, issuer, key algorithm, key length, and signing algorithm.

### Autoruns
Sysinternals Autoruns can identify the processes which Windows is configured to automatically run.  Autoruns data can then be ingested via [Autoruns To WinEventLog](https://github.com/palantir/windows-event-forwarding/tree/master/AutorunsToWinEventLog).

### Beats
Elastic Beats can be deployed on endpoints to collect host telemetry and send to Logstash for storage in Elasticsearch.

### OSSEC
OSSEC agents can be deployed on endpoints to collect host telemetry and send to the OSSEC Server included in Security Onion.  OSSEC Alerts can be found in the Alert Data category at the top of the Navigation Panel.  This OSSEC hunting dashboard will allow you to hunt through all OSSEC logs, not just alerts.

### Sysmon
Sysinternal Sysmon provides comprehensive telemetry for Windows hosts.  Its logs can be consumed using Beats, OSSEC, or other transport mechanism.

### Domain Stats
Security Onion includes a tool called domain_stats which will do a whois lookup on a domain name to determine the age of the domain.  If enabled, this dashboard looks for baby domains that have been recently registered.  Please note that domain_stats is only enabled when running in Evaluation Mode.

### Firewall
Firewall logs can be consumed via syslog or other transport mechanism.  Once consumed, this dashboard allows you to slice and dice those firewall logs based on source IP/port, destination IP/port, protocol, and action.

### Frequency
Security Onion includes a tool called freq_server which can perform frequency analysis of hostnames.  If enabled, this dashboard will show hostnames with a frequency analysis score that indicates that they could have been randomly generated.  Please note that freq_server is only enabled when running in Evaluation Mode.

### Stats
This dashboard shows statistics for Logstash including processing times for different log types and any errors that may have occurred.

## More Information
For additional information, please refer to our documentation at:

https://securityonion.net/docs/Elastic


Beats - Process IDs

Beats - Process IDs


Beats - Computer Names

Beats - Computer Names


Beats - Usernames

Beats - Usernames


Beats - Event IDs

Beats - Event IDs


Beats - Log Count Over Time

Beats - Log Count Over Time

@timestamp per 30 minutes

Count


Intel - Log Count

Intel - Log Count


Devices - Count

Devices - Count


Notices - Log Count

Notices - Log Count


NIDS - Alert Count

NIDS - Alert Count


OSSEC Alerts - Log Count

OSSEC Alerts - Log Count


Connections - Log Count

Connections - Log Count


Elastalert - Log Count

Elastalert - Log Count


DHCP - Log Count

DHCP - Log Count


DCE/RPC - Log Count

DCE/RPC - Log Count


HTTP - Log Count

HTTP - Log Count


DNP3 - Log Count

DNP3 - Log Count


DNS - Log Count

DNS - Log Count


Files - Log Count

Files - Log Count


FTP - Log Count

FTP - Log Count


Modbus - Log Count

Modbus - Log Count


IRC - Log Count

IRC - Log Count


Kerberos - Log Count

Kerberos - Log Count


Total Number of Logs

Total Number of Logs


Sensors - Count

Sensors - Count


MySQL - Log Count

MySQL - Log Count


RFB - Log Count

RFB - Log Count


NTLM - Log Count

NTLM - Log Count


PE - Log Count

PE - Log Count


RADIUS - Log Count

RADIUS - Log Count


RDP - Log Count

RDP - Log Count


SNMP - Log Count

SNMP - Log Count


SIP - Log Count

SIP - Log Count


SMB - Log Count

SMB - Log Count


SMTP - Log Count

SMTP - Log Count


Bro - Syslog - Log Count

Bro - Syslog - Log Count


Software - Log Count

Software - Log Count


SSH - Log Count

SSH - Log Count


SSL - Log Count

SSL - Log Count


Tunnels - Log Count

Tunnels - Log Count


Autoruns - Log Count

Autoruns - Log Count


Weird - Log Count

Weird - Log Count


X.509 - Log Count

X.509 - Log Count


Firewall - Log Count

Firewall - Log Count


Beats - Log Count

Beats - Log Count


OSSEC - Log Count

OSSEC - Log Count


Sysmon - Log Count

Sysmon - Log Count


Logstash - Avg Processing Time

Logstash - Avg Processing Time


Logstash - Median Processing TIme

Logstash - Median Processing TIme


Logstash - Max Processing Time

Logstash - Max Processing Time


Question: tags:_grokparsefailure OR tags:_csvparsefailure OR tags:_rubyexception

Logstash - Error Count

Logstash - Error Count


Syslog - Log Count

Syslog - Log Count


FTP - Reply Code

FTP - Reply Code


ElastAlert - Destination IP Address

ElastAlert - Destination IP Address


Security Onion - Rule - Severity

Security Onion - Rule - Severity


SMTP - Destination IP Address

SMTP - Destination IP Address


Intel - Source IP Address

Intel - Source IP Address


Security Onion - SMTP - Recipient

Security Onion - SMTP - Recipient


Intel - Destination Port

Intel - Destination Port


SMB - Destination Port

SMB - Destination Port


SNMP - Log Count Over TIme

SNMP - Log Count Over TIme

@timestamp per 12 hours

Count


NIDS Alerts - Source IP Address

NIDS Alerts - Source IP Address


Strelka - Request - Client

Strelka - Request - Client


Question: event_type:bro_ssl AND _exists_:issuer_common_name_frequency_score

SSL - Certificate Issuer Common Name Frequency Analysis


DHCP - Message Types

DHCP - Message Types


Security Onion - DNS - Response Code Name


Security Onion - Log Count By Node

Security Onion - Log Count By Node


FIles - MIME Type

FIles - MIME Type


HTTP - URIs

HTTP - URIs


Security Onion - Dataset By Node

Security Onion - Dataset By Node


Security Onion - Data Overview

Security Onion - Data Overview


Question: event_type:bro_x509 AND _exists_:issuer_common_name_frequency_score

X.509 - Certificate Issuer Frequency Analysis


Connections - Top 10 - Total Bytes By Destination Port

Destination Port

Total Bytes


Security Onion - Dataset

Security Onion - Dataset


FTP - Reply Message

FTP - Reply Message


HTTP - Source IP Address

HTTP - Source IP Address


Bro - Syslog - Destination IP Address

Bro - Syslog - Destination IP Address


HTTP - User Agent

HTTP - User Agent


SSL - Destination Country (Bar Chart)

SSL - Destination Country (Bar Chart)

destination_geo.country_name.keyword: Descending

Count


SMTP - TLS - True/False (Vertical Bar Chart)

TLS

Count


Intel - MIME Type

Intel - MIME Type


RADIUS - Destination Port

RADIUS - Destination Port


Security Onion - RFB - Authentication Method


Kerberos - Success Status (Donut Chart)

Kerberos - Success Status (Donut Chart)


Navigation

Navigation


Security Onion - Alerts Over Time

Security Onion - Alerts Over Time

Count


RADIUS - Source IP Address

RADIUS - Source IP Address


Connections - Responder Bytes

Connections - Responder Bytes


Security Onion - Tunnels - Type

Security Onion - Tunnels - Type


Security Onion - Destination IPs

Security Onion - Destination IPs


Security Onion - X.509 - Issuer

Security Onion - X.509 - Issuer


Security Onion - SSL - Validation Status


Intel - Destination IP Address

Intel - Destination IP Address


NIDS Alerts - Severity (Pie Chart)

NIDS Alerts - Severity (Pie Chart)


Kerberos - Renewable

Kerberos - Renewable


RFB - Source IP Address

RFB - Source IP Address


Security Onion - FTP - Password

Security Onion - FTP - Password


Connections - Destination Port

Connections - Destination Port


Security Onion - File - Name

Security Onion - File - Name


DNP3 - Function Reply

DNP3 - Function Reply


Security Onion - RDP - Client Build

Security Onion - RDP - Client Build


RDP - Keyboard Layout (Pie Chart)

RDP - Keyboard Layout (Pie Chart)


RFB - Authentication Method

RFB - Authentication Method


Autoruns - Log Count Over Time

Autoruns - Log Count Over Time

@timestamp per 30 seconds

Count


IRC - Destination IP Address

IRC - Destination IP Address


Bro - Notice - Message/Sub-Message

Bro - Notice - Message/Sub-Message


Top 50 - Destination IP Address

Top 50 - Destination IP Address


NTLM - Server NetBIOS Name

NTLM - Server NetBIOS Name


RFB - Authentication Method (Horizontal Bar Chart)

Count


Question: event_type:bro_ssl AND _exists_:server_name_frequency_score

SSL - Certificate Server Name Frequency Analysis


Security Onion - HTTP - UserAgent

Security Onion - HTTP - UserAgent


Connections - Protocol (Bar Chart)

Connections - Protocol (Bar Chart)

Protocol

Count


Firewall - Source IP Address

Firewall - Source IP Address


SMTP - TLS (Pie Chart)

SMTP - TLS (Pie Chart)


Question: event_type:bro_x509 AND _exists_:issuer_organization_frequency_score

X.509 - Certificate Issuer Organization Frequency Analysis


SMTP - Subject

SMTP - Subject


MySQL - Success

MySQL - Success


RDP - Result (Horizontal Bar Chart)

RDP - Result (Horizontal Bar Chart)

Count


Autoruns - Hostname (Tag Cloud)

Autoruns - Hostname (Tag Cloud)


Security Onion - HTTP - Count

Security Onion - HTTP - Count


NIDS - Alerts

NIDS - Alerts


Intel - Matched

Intel - Matched


Security Onion - Log Count Over Time

Security Onion - Log Count Over Time

Count


Security Onion - Connections - Destination Port


Security Onion - Connection Count

Security Onion - Connection Count


Kerberos - Log Count Over Time

Kerberos - Log Count Over Time

@timestamp per 12 hours

Count


Question: event_type:bro_dns AND _exists_:parent_domain_frequency_score

DNS - Parent Domain Frequency Analysis

DNS - Parent Domain Frequency Analysis


Weird - Summary

Weird - Summary


Bro - Syslog - Destination Port

Bro - Syslog - Destination Port


Security Onion - DNP3 - FC Reply

Security Onion - DNP3 - FC Reply


Files - Files By Size (Bytes)

Files - Files By Size (Bytes)


DCE/RPC - Log Count Over Time

DCE/RPC - Log Count Over Time

@timestamp per 30 minutes

Count


Security Onion - DHCP - Assigned Address


RADIUS - Log Count Over TIme

RADIUS - Log Count Over TIme

@timestamp per 12 hours

Count


ElastAlert - Destination Port

ElastAlert - Destination Port


DHCP - Domain Name

DHCP - Domain Name


Strelka - File - Entropy

Strelka - File - Entropy


RADIUS - Destination IP Address

RADIUS - Destination IP Address


Security Onion - SIP - Warning

Security Onion - SIP - Warning


FTP - Source IP Address

FTP - Source IP Address


Autoruns - Launch String

Autoruns - Launch String


Security Onion - All Logs

Security Onion - All Logs


HTTP - Destination IP Address

HTTP - Destination IP Address


Security Onion - FTP - Command

Security Onion - FTP - Command


NTLM - Destination IP Address

NTLM - Destination IP Address


FTP - Command

FTP - Command


NIDS - Alerts Over Time

NIDS - Alerts Over Time

@timestamp per 30 minutes

Count


SMTP - Destination Port

SMTP - Destination Port


Security Onion - RFB - Share Flag

Security Onion - RFB - Share Flag


NIDS - Classification

NIDS - Classification


RFB - Destination IP Address

RFB - Destination IP Address


SMTP - User Agent

SMTP - User Agent


Connections - Service

Connections - Service


NTLM - Destination Port

NTLM - Destination Port


Sensors/Devices and Services

Sensors/Devices and Services


DCE/RPC - Destination Port

DCE/RPC - Destination Port


Question: network.protocol:*

Security Onion - Top Network Protocols

Security Onion - Top Network Protocols


Software - Log Count Over Time

Software - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - RDP - Security Protocol


NIDS Alerts - Destination IP Address

NIDS Alerts - Destination IP Address


Security Onion - IRC - Command Info

Security Onion - IRC - Command Info


Security Onion - SSL - Server Name

Security Onion - SSL - Server Name


SSL - Source IP Address

SSL - Source IP Address


Security Onion - Network Datasets

Security Onion - Network Datasets


Weird - Destination Port

Weird - Destination Port


Security Onion - Notice - Note

Security Onion - Notice - Note


DNS - Queries

DNS - Queries


SSH - Authentication Success

SSH - Authentication Success

Authentication Success

Count


SIP - Request Path

SIP - Request Path


DNP3 - Source IP Address

DNP3 - Source IP Address


Firewall - Destination IP Address

Firewall - Destination IP Address


Security Onion - Host Data

Security Onion - Host Data


Autoruns - Hostname

Autoruns - Hostname


SIP - Destination Port

SIP - Destination Port


SMTP  - Destination Country (Donut Chart)


Files - Source

Files - Source


Security Onion - Syslog - Facility

Security Onion - Syslog - Facility


Question: event_type:bro_x509 AND _exists_:certificate_common_name_frequency_score

X.509 - Certificate Common Name Frequency Analysis


Hash - SSDeep

Hash - SSDeep


Sysmon - Event ID (Horizontal Bar Chart)

Count


FTP - Argument

FTP - Argument


NTLM - Hostname

NTLM - Hostname


DNS - Destination Port (Horizontal Bar Chart)

Count


Security Onion - X.509 - Subject

Security Onion - X.509 - Subject


Kerberos - Cipher (Donut Chart)

Kerberos - Cipher (Donut Chart)


HTTP - Destination Country (Vertical Bar Chart)

Country

Count


IRC - Source IP Address

IRC - Source IP Address


SNMP - Session Duration

SNMP - Session Duration


SSH -Server

SSH -Server


Firewall - Log Count Over Time

Firewall - Log Count Over Time

@timestamp per 30 seconds

Count


Security Onion - SMTP - TLS

Security Onion - SMTP - TLS


Syslog - Source IP Address

Syslog - Source IP Address


Security Onion - Host - Domain

Security Onion - Host - Domain


RADIUS - Username

RADIUS - Username


SNMP - Source IP Address

SNMP - Source IP Address


Notice - Destination Port (Vertical Bar Chart)

Port

Count


RFB - Destination Port

RFB - Destination Port


Tunnels - Log Count Over TIme

Tunnels - Log Count Over TIme

@timestamp per 12 hours

Count


Security Onion - File - MIME Type

Security Onion - File - MIME Type


DNS - Query/Answer

DNS - Query/Answer


DHCP - Log Count Over Time

DHCP - Log Count Over Time

@timestamp per 12 hours

Count


Bro - Syslog - Protocol

Bro - Syslog - Protocol


Security Onion - NTLM - Success

Security Onion - NTLM - Success


Security Onion - Host - MAC

Security Onion - Host - MAC


SSL - Summary

SSL - Summary


Security Onion - MySQL - Success

Security Onion - MySQL - Success


Security Onion - SMB - File System

Security Onion - SMB - File System


Security Onion - HTTP - Version

Security Onion - HTTP - Version


OSSEC Alerts - Event Summary

OSSEC Alerts - Event Summary


NTLM - Server DNS Name

NTLM - Server DNS Name


FTP - Destination Port

FTP - Destination Port


Connections - Top 10 - Total Bytes By Destination IP

Destination IP Address

Total Bytes


RDP - Encryption Level (Vertical Bar Chart)

Encryption Level

Count


DNP3 - Destination IP Address

DNP3 - Destination IP Address


Security Onion - FIle - Total Bytes

Security Onion - FIle - Total Bytes


Kerberos - Server

Kerberos - Server


Security Onion - Host - Name

Security Onion - Host - Name


SSL - Destination Port

SSL - Destination Port


Connections - Top 10 - Total Bytes By Connection

Connection ID

Total Bytes


SMTP - Source IP Address

SMTP - Source IP Address


FTP - Destination Address

FTP - Destination Address


Security Onion - HTTP - URI

Security Onion - HTTP - URI


DCE/RPC - Round Trip Time

DCE/RPC - Round Trip Time


NTLM - Source IP Address

NTLM - Source IP Address


Connections - Source - Responder Bytes ( Tile Map)


Security Onion - Destination Ports

Security Onion - Destination Ports


SIP - Source IP Address

SIP - Source IP Address


DCE/RPC - Source IP Address

DCE/RPC - Source IP Address


Tunnels - Country

Tunnels - Country

Country

Count


IRC - Destination Country

IRC - Destination Country


Security Onion - SIP - URI

Security Onion - SIP - URI


ElastAlert - Alert Type

ElastAlert - Alert Type


Kerberos - Service

Kerberos - Service


Security Onion - Rule - Category

Security Onion - Rule - Category


Security Onion - User Command Overview

Security Onion - User Command Overview


Logstash - Processing Performance

Logstash - Processing Performance

Log Type


Firewall - Protocol

Firewall - Protocol

Count


FTP - Username

FTP - Username


Security Onion - DNP3 - IIN

Security Onion - DNP3 - IIN


RDP - Source IP Address

RDP - Source IP Address


X.509 - Certificate Subject

X.509 - Certificate Subject


Security Onion - Syslog - Severity

Security Onion - Syslog - Severity


Firewall - Destination Port

Firewall - Destination Port


RDP - Log Count Over Time

RDP - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - Connections - Top Source IPs


Security Onion - RFB - Desktop Name

Security Onion - RFB - Desktop Name


DNS - Answers

DNS - Answers