Description

This Kibana dashboard example is visualizing the results of the Elastic SIEM detection engine. We also have a similar version of this dashboard using Kibana canvas. The Elastic SIEM detection engine is a great way to analyze all the cybersecurity related data you have stored in your Elastic Security installation. You can use it for your SIEM related as well as for your Elastic Endpoint related data.

The idea of the dashboard is to highly aggregate the results of the detection engine. Every alert that is created by the detection engine is a possible threat. However there can be many of them depending on the amount and criticality of systems you observe. Being able to get these results, aggregating and visualizing it even further than the Elastic Stack is doing it OOTB is one of the big strength that the Elastic Stack has. However getting to this point as a new user takes some time.

This Kibana dashboard will help you to identify threats and observe the results of the detection engine from day 1.

What is the Elastic SIEM detection engine?

The detection engine provides SOC teams with a complete SIEM rule experience within the free Elastic SIEM. The detection engine draws from a purpose-built set of Elasticsearch analytics engines and runs on a new distributed execution platform in Kibana.

Prebuilt rules

Rules can be difficult to develop and require a lot of time to test. Therefore, the detection started with a lot of prebuilt rules developed by Elastic Security’s intelligence and analysis team and has been widely used in Elastic’s production environment. New rules to respond to the latest critical threats are constantly being developed. Getting them loaded and ready to run is as simple as clicking a button! Using the Elastic content share you can also load a big chunk of detection rules next to the ones delivered by Elastic.

Tested versions 7.13
ECS compliant Yes

You must log in to submit a review.

Related downloads

Filebeat Log analysis canvas example

This is a simple canvas dashboard example that analyzes logs created by Filebeat.

Elastic Stack Monitoring Dashboard

Kibana dashboards that is showing the monitoring data collected by Elastics in built monitoring capabilities.

Kibana alerting enhancement

This bundle enhances the Kibana alerting experience. Storing all relevant information in indices and visualize the data in dashboards.

RUM extension dashboard

This dashboard provide deeper insight into the real user monitoring data collected by Elastic RUM.

APM Services overview canvas

Average rating:

An adaptive turn key canvas example based on Elastic APM data.

Azure billing data network

A vega visualization that shows the connection between resource group, resource type and the resource itself based on Elastic agent azure billing data integration.

These downloads could be also interesting for you

Sigma AWS Cloudtrail Detection rules

A collection of rules based on the Sigma rules for AWS based on the Filebeat AWS module and Elastic agent integration.

Terraform Elasticsearch environments

Terraform example scripts to deploy Elastic Cloud Clusters + all necessary components in AWS and GCP

Timetable canvas

This canvas examples shows timetable data from trains. Its build based on the real world information panel in german trian stations. Its refreshing based on current time.

Vega Clock UTC

This is a working clock visualization in UTC time.

Resource Optimization Dashboard

Elastic Resource Optimization Dashboard to seamlessly integrate APM insights with cloud cost data for actionable resource management and cost-saving strategies

Elastic Cloud Monitoring dashboard

Kibana dashboard that uses the Elastic Cloud monitoring data to provide better insights into what’s happening in your cloud environment.