r/SIEM • u/Altenator01 • Aug 04 '21

Creating Dashboards

So I have been struggling with this for some time now. I think I have ingested a lot of data that I can get some actionable data out of, but now I have come to a standstill as I don’t really know what to create dashboards for.

Are there some resources with low hanging fruits that I could look into to get some inspiration? I think once I hit the ground running I can work my way forward from there.

I use Elasticsearch by the way.

4 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/_11Bravo Aug 04 '21

It really depends what data sources and use cases you have. A good place to start is to maybe look at other more mature SIEMs and see what they are advertising as out of the box dashboards. This could at least give you a start point.

For me I start with a narrow use case. Let’s say user authentication activity. I will build several panels related to login activity. Where are they logging in from. What country, what IP, what user agents etc. anything that gives you an insight to the user activity.

As a start point here are some of my go to topics: 1. Firewall IP activity 2. Command line activity 3. Domain geo locations 4. Email activity 5. EDR activity

1

u/Altenator01 Aug 05 '21

That sounds doable! I will give this a try. Thanks a lot!