molu8bits / snort-siem-grafana

snort siem grafana dashboard snort2

Snort2 grafana dashboard

While some IDS/IPS systems still wait for upgrade to Snort3 where JSON logging is available (or Suricata) it may be useful give elasticity of logs handling given by Elasticsearch and Grafana for Snort2

Project is based on existing grafana security dashboard Security center but removes existing hard-coded dependencies and provides all configuration details for Snort, Barnyard2, Elasticsearch and Grafana.

This tag works with ELK stack version 6.5

Logs flow and components:

Example dashboards:

Snort configuration: Snort uses "-l" configuration inside systemd service definition to inform what is the log output directory.

Barnyard2 configuration:

Barnyard2 takes files from snort and sends them via UDP protocol to Logstash server listening to 5142 udp port

Logstash:

Logstash listen to 5142 and all logs marks with "snort" tag. Tagged "snort" logs are treated with grok and later some transformation. Output for snort log is set to elasticsearch and index name like snortids-%YY-%MM-%dd

Grafana:

Just connects to defined Elasticsearch clusters:

Elasticsearch datasource definition (before importing Grafana dashboard):

snort-siem-grafana's Issues

Regex Query in Grafana

Hi everyone I have Grafana v 7.5.7 and I 'm trying to extract some content from my data.

In this case, my goal is to take the message from snort alert.
I created event.original as my own variable to collect data from elasticsearch and now I can see my logs.

These values are store by a variable called snort.

However I need extract only the message of the alert, in the section Query

Ex: What I have:

05/27-11:30:12.466603 [] [1:19559:13] “INDICATOR-SCAN SSH brute force login attempt” [] [Classification: Misc activity] [Priority: 3] {TCP} x.x.x.x:53962 → x.x.x.x:xx

What I need:

INDICATOR-SCAN SSH brute force login attempt

If anyone knows how I can do, please help me, I didn't get any answer from Grafana's community.

How to groupby unique values from ElasticSearch

Details:

Grafana 7.5.7
Elastic 7.11
Linux OS
I would like to know how can I get unique values from elasticsearch with Grafana’s query editor.

I have the next picture:

It shows SSH Detected several times and I wish it just once.

I don't know how to do this, I need some help.

Thanks!