Description

This Kibana dashboard example is visualizing the results of the Elastic SIEM detection engine. We also have a similar version of this dashboard using Kibana canvas. The Elastic SIEM detection engine is a great way to analyze all the cybersecurity related data you have stored in your Elastic Security installation. You can use it for your SIEM related as well as for your Elastic Endpoint related data.

The idea of the dashboard is to highly aggregate the results of the detection engine. Every alert that is created by the detection engine is a possible threat. However there can be many of them depending on the amount and criticality of systems you observe. Being able to get these results, aggregating and visualizing it even further than the Elastic Stack is doing it OOTB is one of the big strength that the Elastic Stack has. However getting to this point as a new user takes some time.

This Kibana dashboard will help you to identify threats and observe the results of the detection engine from day 1.

What is the Elastic SIEM detection engine?

The detection engine provides SOC teams with a complete SIEM rule experience within the free Elastic SIEM. The detection engine draws from a purpose-built set of Elasticsearch analytics engines and runs on a new distributed execution platform in Kibana.

Prebuilt rules

Rules can be difficult to develop and require a lot of time to test. Therefore, the detection started with a lot of prebuilt rules developed by Elastic Security’s intelligence and analysis team and has been widely used in Elastic’s production environment. New rules to respond to the latest critical threats are constantly being developed. Getting them loaded and ready to run is as simple as clicking a button! Using the Elastic content share you can also load a big chunk of detection rules next to the ones delivered by Elastic.

Tested versions 7.13
ECS compliant Yes

You must log in to submit a review.

Related downloads

CMDB dependency in Kibana Dashboard

Kibana vega example to show how to load visualize relationships between different infrastructure and network components in vega.

Filebeat Log analysis canvas example

This is a simple canvas dashboard example that analyzes logs created by Filebeat.

Sigma detection rules for proxy server logs

A collection of rules based on the Sigma detection rules for proxy server and web server looks, e.g. zeek or suricata.

Sigma Zeek Detection rules

A collection of rules based on the Sigma rules for Zeek based on the Filebeat Zeek module.

Azure billing data network

A vega visualization that shows the connection between resource group, resource type and the resource itself based on Elastic agent azure billing data integration.

These downloads could be also interesting for you

Filebeat Log analysis canvas example

This is a simple canvas dashboard example that analyzes logs created by Filebeat.

Kibana Canvas examples collection

Average rating:

A collection of canvas examples, like using conditionals, creating buttons, animations or context menues. Just copy paste into your Kibana Canvas project.

Crawler dashboard

A Kibana dashboard that visualizes the result of the crawler from Elastic Enterprise Search

Watcher History Dashboard

This dashboard shows the history of executed watcher jobs.

Office display canvas example

Kibana canvas example showing an office screen with weather, news and stock information

Elastic Stack Monitoring Dashboard

Kibana dashboards that is showing the monitoring data collected by Elastics in built monitoring capabilities.