Warning: You are viewing an older version of this documentation. Most recent is here: 40.0.1

Kibana Dashboards

Stamus Central Server embed the suite ELK and Kibana’s dashboards are accessible through the app switcher in the header.

Open Kibana. Once in Kibana, click on the Dashboard menu to see the full list of available dashboards. The use case examples below are for the purpose of idea generation and are not meant to be exhaustive.

Note

Any data from the Kibana dashboards or visualizations can be exported as CSV or PDF.

Dashboard

Description

Data types

Example Use Cases

SN-ALERTS

Alerts dashboard.

Alerts with metadata.

  • Audit or investigate a certain alert events with respect to common criteria such as Stamus Network Definitions, Networks, Ports, UserAgents, Domains, JA3s, JA3s etc.

  • Report of all Http user agents or source IPs for a certain alert.

SN-ALERTS-CVE

CVE specific alerts dashboard.

Alerts with metadata.

  • Report and overview metadata from CVE centric Alert dashboard.

  • Report on all domains seen related to a CVE (Log4j for example).

  • List all IPs scanning or answering for certain CVE.

SN-ALERTS-EXE-HUNT-1

Executables hunt and metadata export dashboard.

Alerts with metadata.

  • Audit or investigate on domain/IP/HTTP server/HTTP host/User agents/SMB clients etc that are most involved in plain executable transfers? What is the least?

SN-ALERTS-PHISHING

Phishing specific alerts dashboard.

Alerts with metadata.

  • Audit or investigate on domain/IP/HTTP server/HTTP host/HTTP host/User agents/ involved in possible phishing attempts.

SN-ALL

General events dashboard.

Any log type.

  • Audit or investigate on mixed events metadata, not just alerts.

SN-ANOMALY

Protocol anomaly events dashboard.

Anomaly events.

  • Audit or investigate on application Anomaly based events - for example top/bottom TLS versions/SNIs and IPs involved in TLS protocol anomaly.

SN-BEACONING-TLS

TLS beacons dashboard.

Beaconing events.

  • Audit or investigate on top TLS JA3S/JA3/SNI/Fingerprint/Subject involved int a specific beacon.

SN-DCERPC

DCERPC protocol events dashboard.

DCERPC logs.

  • Audit or investigate on Microsoft UUID and opnum usage.

SN-DHCP

DHCP protocol events dashboard.

DHCP logs.

  • Report and search on client/server MAC addresses usage

  • Audit or investigate DHCP servers seen on the network.

SN-DNP3

DNP3 protocol events dashboard.

DNP3 logs.

  • Audit or investigate on DNP3 function usage

SN-DNS

DNS protocol events dashboard.

DNS logs.

  • Audit or report on NXDOMAINS and the source IPs requesting those

  • Audit or investigate on AAAA domains.

  • List DNS ttl usage.

  • Audit or investigate on TCP or UDP DNS usage.

SN-DNS-HUNT-Tunnel

DNS tunnel detection and threat hunting dashboard.

DNS logs.

  • Report on and investigate on most DNS transactions per flow and the abusing hosts.

  • Report on and investigate on most and least domains used.

  • Report on and investigate on most subdomins.

SN-FILE-Transactions

File transactions protocol events dashboard.

Fileinfo, file transaction logs.

  • Audit or investigate on file type/magic in the enterprise.

  • Audit or investigate on most protocols used for file transfer.

  • Audit or investigate on size breakdown of files transfer at off business hours.

  • Audit or investigate on most/least used public hosts for clear text transfer (aka http/ftp etc).

  • Audit or investigate on most/least used NFS/SMB files.

SN-FLOW

Generic FLOW records dashboard.

Flow, netflow logs.

  • Investigate on protocol breakdown of biggest flows.

  • Investigate on flows bigger than 1Gb,10Gb,100Gb, top talkers off/on business hours.

  • Audit or investigate on most used Port/Networks.

  • I want to hunt on flow data specifically.

SN-FLOW-HTTP

HTTP flow records dashboard.

Flow logs specific to HTTP.

  • Investigate HTTP flows and occurrence.

  • Audit or investigate on any HTTP flow metric.

SN-FLOW-HUNT-DNS-EXFIL

Larger DNS flows dashboard. Possible exfil.

Flow logs specific to DNS.

  • Investigate DNS flows sizes and age.

  • Audit or investigate on DNS flow records

SN-FLOW-HUNT-ICMP-Possible-EXFIL

ICMP tunneling or exfil hunting dashboard.

Flow logs specific to ICMP.

  • Investigate and report on ICMP flows sizes and age.

  • Audit or investigate on ICMP flow records.

SN-FLOW-SIZE

Generic FLOW size based search dashboard.

Flow logs.

  • Investigate and report on flows sizes.

  • What are the top flow size talkers off business hours with flows bigger than 100GB

  • What are the top flow size talkers with flows bigger than 10GB

SN-FLOW-SMB

SMB flow records dashboard.

Flow logs specific to SMB.

  • Audit and report on SMB flows sizes.

  • What are the top SMB flow size talkers off business hours, from user networks with flows bigger than 1GB.

SN-FLOW-SSH

SSH flow records dashboard.

Flow logs specific to SSH.

  • Audit and report on SSH flows sizes.

  • What network hosts use SSH transfer bigger than 1GB off business hours.

  • What network hosts use SSH the most.

  • What network hosts use SSH the most from non IT management networks.

SN-FLOW-TCP

TCP flow records dashboard.

Flow logs specific to TCP.

  • Audit and report on TCP flows.

  • What are the top TCP flow size talkers off business hours with flows bigger than 1-20GB.

  • What are the top TCP flow size talkers with flows bigger than 200GB.

SN-FLOW-TLS

TLS flow records dashboard.

Flow logs specific to TLS.

  • Audit and report on TLS flows sources,destination networks and ports.

  • What are the top TLS flow size talkers off business hours with flows bigger than 1-20GB.

  • What are the most TLS flow sources during certain period of time.

  • What are the most TLS flow sources for specific TLS version.

SN-FLOW-UDP

UDP flow records dashboard.

Flow logs specific to UDP.

  • Audit or investigate on UDP flow usage over time

  • What are the biggest UDP flow sizes, from where.

SN-HTTP

HTTP protocol events dashboard.

HTTP logs.

  • Audit or investigate on any HTTP field.

  • List of all User Agents in the organisation.

  • List of all HTTP Servers software in the network.

  • List of all HTTP host names and connections in the network.

SN-HTTP-HUNT

HTTP protocol hunting dashboard.

HTTP logs.

  • Audit or investigate on HTTP rare occurrences of hostnames,User Agents etc.

  • Investigate on HTTP content lengths and method requests rom user networks.

SN-HUNT-1

All events hunting dashboard. IP or user search.

TLS, HTTP, DNS, Flow, SMB, KRB, ICMP, File transaction logs.

  • Investigate all protocol and file transaction data for a specific host over a specific time.

  • Incident response Audit or investigate on any protocol or alert field metadata for specific host.

  • Incident response

  • Audit connections and protocol usage from specific host or network for legacy app usage.

SN-IDS

Generic IDS alerts timelion dashboard.

Alert logs.

  • Timeline of specific alert or category over time.

  • Timeline of protocols or Geoip location of alerts.

SN-IKEv2

IKE protocol events dashboard.

IKE logs.

  • Audit or investigate on IKE top sources ,destinations, roles,versions.

SN-KRB5

KRB5 protocol events dashboard.

KRB5 logs.

  • Audit or investigate on KRB5 protocol Encryption and message errors, user cnames and snames.

  • Audit and investigate KRB weak encryption occurrences.

SN-MQTT

MQTT protocol events dashboard.

MQTT logs.

  • Audit or investigate on MQTT top sources ,destinations,versions.

SN-NFS

NFS protocol events dashboard.

NFS logs.

  • Audit or investigate on top NFS talkers during a period of time.

  • Audit and investigate NFS file transactions and usage.

SN-Network-Overview

Network flow data overview dashboard.

Flow logs.

  • Investigate network statistics like Syn/Rst storms, IPv4/IPV6 usage from a Stamus networks probe area of deployment.

SN-Network-Overview-1

SN Probe Network flow data overview dashboard.

Flow logs.

  • Time graph report form a specific Stamus networks probe interface.

  • Network troubleshooting.

SN-Network-Overview-2

Network flow data overview dashboard.

Flow logs.

  • Audit or investigate on top flow volume clients.

  • Audit or investigate on top flow volume servers.

  • Audit or investigate on top single flows sizes going out of the network.

SN-OVERVIEW

General network overview dashboard.

Any logs.

  • Timeline based hunting by volume of transactions for DNS rtypes or NXDOMAINS.

  • Timeline of HTTP status code 4xx or 5xx.

  • Timeline of ICMP request/reply volumes.

SN-POLICY-OLD-TLS

Older or vulnerable TLS protocol encryption.

TLS logs.

  • Audit or investigate on any and all TLS records that use old TLS versions.

SN-POLICY-Violations

General Policy violations.

Alert logs.

  • Audit or investigate on clear text passwords.

  • Audit or investigate on known abused file sharing services.

  • Investigate and audit TOR connections present.

  • Investigate and report on external DNS resolvers.

  • Audit and report on vulnerable TLS protocol usage.

SN-POSTPROC-Stats

Post processing stats dashboard.

Stats logs.

  • Audit Stamus post processing statistics.

SN-RDP

RDP protocol events dashboard.

RDP logs.

  • List RDP versions and keyboard layouts used in the enterprise.

  • What are the top RDP host users.

SN-RFB

RFB protocol events dashboard.

RFB logs.

  • Is RFB used in my network and where.

  • What VLAN uses RFB.

  • What RFB authentication type is used in my network.

  • List all RFB server security failures.

SN-SIP

SIP protocol events dashboard.

SIP logs.

  • What are the most used SIP methods, sources and ports.

  • SIP usage over time.

SN-SMB

SMB protocol events dashboard.

SMB logs.

  • What are the SMB dialects offered and present in the network.

  • What are the most or least SMB filenames and shares used.

  • List of all SMB functions detected.

SN-SMB-DCERPC-Lateral-1

Stamus Networks Lateral Detection Dashboard

SMB logs.

  • Audit or investigate on UUID and OPNUM.

  • What are the most transactions per SMB/DCERPC flows.

  • Investigate status codes like SMB STATUS_ACCESS_DENIED.

SN-SMTP

SMTP protocol events dashboard.

SMTP logs.

  • Investigate encrypted e-mail usage

  • Investigate encrypted e-mail servers or addresses

SN-SNMP

SNMP protocol events dashboard.

SNMP logs.

  • Audit or investigate on SNMP version usage.

  • What are the SNMP communities advertised and used in the network.

  • What are the vlans using SNMP the most.

SN-SSH

SSH protocol events dashboard.

SSH logs.

  • Audit or investigate on SSH client or server software and version in the network.

  • What are the top or least SSH talkers in the network.

  • What are all the hosts that use specific SSH software.List of all SSH protocol events of those.

  • What are all the hosts that use specific SSH hash.

SN-STAMUS

Declarations of Compromise dashboard.

DoC logs.

  • Export report on Stamus DoC.

  • Create a list of IoCs

SN-TFTP

TFTP protocol events dashboard.

TFTP logs.

  • Is TFTP used in my network. What hosts use it.

  • List of all files and checksum transferred over TFTP.

SN-TLS

TLS protocol events dashboard.

TLS logs.

  • Audit or investigate on all TLS issuers in the network.

  • Audit all events and hosts that use a specific TLS certificate fingerprint.

  • Search for all TLS logs for a specific JA3/JA3S hash.

  • What are all the TLS versions seen on the network and from where.

  • Export and report on TLS connections not using port 443. What is using TLS port 18000.

SN-TrafficID

Social media dashboard.

Alert logs.

  • What is the top social media usage.

SN-VLAN

VLAN dashboard.

All logs.

  • What are all vlans seen in the network.

  • What vlans have the most SSH or DNS connections.

  • What vlans have the most file transfers from SMB.

  • What vlans have the most file transfers from FTP.

  • What vlans have the most file transfers from HTTP.