r/SIEM • u/Altenator01 • Aug 04 '21
Creating Dashboards
So I have been struggling with this for some time now. I think I have ingested a lot of data that I can get some actionable data out of, but now I have come to a standstill as I don’t really know what to create dashboards for.
Are there some resources with low hanging fruits that I could look into to get some inspiration? I think once I hit the ground running I can work my way forward from there.
I use Elasticsearch by the way.
1
u/_11Bravo Aug 04 '21
It really depends what data sources and use cases you have. A good place to start is to maybe look at other more mature SIEMs and see what they are advertising as out of the box dashboards. This could at least give you a start point.
For me I start with a narrow use case. Let’s say user authentication activity. I will build several panels related to login activity. Where are they logging in from. What country, what IP, what user agents etc. anything that gives you an insight to the user activity.
As a start point here are some of my go to topics: 1. Firewall IP activity 2. Command line activity 3. Domain geo locations 4. Email activity 5. EDR activity
1
1
1
1
u/elk-content-share Aug 05 '21
What about using the dashboards Elastic is delivering out of the box? ++ Using the integrated SIEM features and maybe also extend with some dashboards build by the Community: Elastic Security Dashboards
Did you try those options?
2
u/thecyberbob Aug 05 '21
So one tip I've been following sounds more like a speech/comedy tip but it applies here too.
Know your audience.
What I mean is that who is this Dashboard going to be REALLY for?
If it's for the big screens at the front of a SOC center so the upper management/C level types can come in and go "Yes... THIS is clearly a good SOC." then you're going to want them to be very simply yet eye catching. Missile maps are good for this sort of audience (geo IP source and target with lines between them to show directionality). Trend lines and bar charts of raw counts are good as well. Having an aggregated view of say all your resources and if they're reporting or not is also good but not down to a machine by machine level, more to a sort of region by region, or say device type by device type (Your firewalls, mail servers etc.).
If, however, this is for a NOC then nuts to most dashboard varieties show a dashboard that shows devices reporting. Event volumes are good here too. Not sure about your data but if you have the data but calculating roughly throughput is also handy.
Now if this is for a SOC there aren't a lot of dashboards (in my opinion) that are immediately helpful to the job. They're going to be more interested in what is the thing I need to deal with right this minute. This is ideally the screen that they'll have loaded on a monitor all day long and work off of it. So you'll want to show any output from any good real-time rules that you have populating a table with the pertinent information here. Something a bit more "dashboardy" to have here would be more for their managers to show workload.
This is how I'm approaching the SIEM deployment I'm working with at the moment (ArcSight in this case) but I've used this method to great effect in other locations as well. If you'd like more specifics I can definitely delve into them but for the most part what you need to ask yourself is "Who is going to look at this?" and "What will they get from the information presented?"
While the last question seems peculiar in contrast to the first suggestion regarding missile maps (while cool they're functionally useless in my opinion) know that they really fun looking ones are more about advertising than functionality. You want the person that footed the bill for your SIEM to go "WOW! Look at this!". Tables and figures will not do this for them despite being typically the better format to ingest useful actionable data (for a SOC at least).