All dashboards

suricata - IDS & IPS

Surricata, IDS/IPS

suricata - IDS & IPS screenshot 1

IDS / IPS Dashboard

dashboard that visualizes suricata entries
for updates visit https://github.com/TripleConsult/suricata_grafana_dashboard
this is the updated version from dashboard id 5243

Require

suricata
elasticsearch <7.xx
filebeat <7.xx
grafana 7.xx/8.xx

Configure

filebeat:

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["yourhostip:port"]
  # index: "filebeat-suricata"
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elasticuser"
  password: "setsecrethere"

we use the suricata module from filebeat:

cd /etc/filebeat/modules.d
mv suricata.yml.disabled suricata.yml
Revisions
RevisionDescriptionCreated

Get this dashboard

Import the dashboard template

or

Download JSON

Datasource
Dependencies
Resources
Docs: Importing dashboards Webinar: Getting started with Grafana dashboard design Webinar: Building advanced Grafana dashboards