-
Notifications
You must be signed in to change notification settings - Fork 11
/
Truvis-Suricata Categories Overview [SUB]
121 lines (121 loc) · 4.22 KB
/
Truvis-Suricata Categories Overview [SUB]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
<form theme="dark">
<label>Truvis-Suricata Categories Overview [SUB]</label>
<fieldset submitButton="false">
<input type="time" token="field1" searchWhenChanged="true">
<label>Time Frame</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="category" searchWhenChanged="true">
<label>Category</label>
<fieldForLabel>category</fieldForLabel>
<fieldForValue>category</fieldForValue>
<search>
<query>index="suricata" sourcetype="suricata:alert" | fields category | dedup category | table category</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<default>$cat$</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>SRC IPS</title>
<search>
<query>index="suricata" sourcetype="suricata:alert" category="$category$" | stats count by src_ip</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel>
<chart>
<title>DEST IPS</title>
<search>
<query>index="suricata" sourcetype="suricata:alert" category="$category$" | stats count by dest_ip</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel>
<chart>
<title>PROTOCOL</title>
<search>
<query>index="suricata" sourcetype="suricata:alert" category="$category$" | stats count by proto</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel>
<chart>
<title>Action</title>
<search>
<query>index="suricata" sourcetype="suricata:alert" category="$category$" | stats count by action</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>Connections</title>
<search>
<query>index="suricata" sourcetype="suricata:alert" category="$category$"
| stats count by src_ip dest_ip dest_port transport
| stats list(dest_ip) as dest_ip list(dest_port) as dest_port list(transport) as transport list(count) as count by src_ip</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<event>
<title>Raw Logs</title>
<search>
<query>index="suricata" sourcetype="suricata:alert" category="$category$"</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="list.drilldown">full</option>
<option name="list.wrap">0</option>
<option name="raw.drilldown">full</option>
<option name="table.drilldown">none</option>
<option name="table.wrap">0</option>
<option name="type">raw</option>
</event>
</panel>
</row>
</form>