Description

This Kibana dashboard example is visualizing the results of the Elastic SIEM detection engine. We also have a similar version of this dashboard using Kibana canvas. The Elastic SIEM detection engine is a great way to analyze all the cybersecurity related data you have stored in your Elastic Security installation. You can use it for your SIEM related as well as for your Elastic Endpoint related data.

The idea of the dashboard is to highly aggregate the results of the detection engine. Every alert that is created by the detection engine is a possible threat. However there can be many of them depending on the amount and criticality of systems you observe. Being able to get these results, aggregating and visualizing it even further than the Elastic Stack is doing it OOTB is one of the big strength that the Elastic Stack has. However getting to this point as a new user takes some time.

This Kibana dashboard will help you to identify threats and observe the results of the detection engine from day 1.

What is the Elastic SIEM detection engine?

The detection engine provides SOC teams with a complete SIEM rule experience within the free Elastic SIEM. The detection engine draws from a purpose-built set of Elasticsearch analytics engines and runs on a new distributed execution platform in Kibana.

Prebuilt rules

Rules can be difficult to develop and require a lot of time to test. Therefore, the detection started with a lot of prebuilt rules developed by Elastic Security’s intelligence and analysis team and has been widely used in Elastic’s production environment. New rules to respond to the latest critical threats are constantly being developed. Getting them loaded and ready to run is as simple as clicking a button! Using the Elastic content share you can also load a big chunk of detection rules next to the ones delivered by Elastic.

Tested versions 7.13
ECS compliant Yes

You must log in to submit a review.

Related downloads

Crawler dashboard

A Kibana dashboard that visualizes the result of the crawler from Elastic Enterprise Search

Threat detection Kibana dashboard

Kibana dashboard example visualizing the results of the Elastic SIEM detection engine

osquery performance dashboard

Kibana Dashboard example to visualize osquery performance

Elasticsearch Performance Troubleshooting Kit

Download the Elasticsearch Performance Troubleshooting Kit to efficiently diagnose and resolve slow query issues in your Elasticsearch environment.

Filebeat Log analysis canvas example

This is a simple canvas dashboard example that analyzes logs created by Filebeat.

RUM extension dashboard

This dashboard provide deeper insight into the real user monitoring data collected by Elastic RUM.

These downloads could be also interesting for you

AWS Cloudtrail Monitoring dashboard

Deep insights into AWS Cloudtrail events for SIEM and Monitoring

Office 365 dashboards

A collection of Kibana dashboards to provide a holistic view of Microsoft Office 365 environments

Elastic Cloud Billing data collection and Kibana dashboard

Pulls Elastic Cloud Billing information from the Billing API then sends it to an Elasticsearch cluster and visualizes the results in Kibana dashboards.

RUM extension dashboard

This dashboard provide deeper insight into the real user monitoring data collected by Elastic RUM.

Kubernetes architecture overview

Vega visualization to show the dependencies between the different Kubernetes components in a single visualization

CMDB dependency in Kibana Dashboard

Kibana vega example to show how to load visualize relationships between different infrastructure and network components in vega.