How to load or update dashboards

SELKS comes with ready to use Kibana dashboards.

Those are in a package called kibana-dashboards-stamus and are aiming at providing the most of fully enabled Suricata IDS/IPS JSON logging features available. The package is derived from the GitHub repository located here.

NOTE: For best user experience use at least a 1680 x 1050 screen resolution!!

From Scirius

NOTE: Make sure (especially if you have upgraded to Scirius 3.2.0+) that in /etc/scirius/local_settings.py you have the following variable:

KIBANA6_DASHBOARDS_PATH = "/opt/selks/kibana6-dashboards/"

To reload/reset the dashboards from Scirius GUI -

Go to System settings (from the Stamus logo drop down menu in the left upper corner) -> Kibana -> choose the desired action.

Source location:

/opt/selks/kibana6-dashboards/

From the command line

To reload/reset the dashboards from the cmd/shell (as root) :

cd /usr/share/python/scirius/ && . bin/activate && python bin/manage.py kibana_reset && deactivate

WARNING: That will RESET all your Kibana 6 dashboards - DELETE any custom dashboards/visualisatons (not the data) that you might have and (re)load the deafult ones !!

NOTE: Please make sure elasticsearch is running in order to update/reload the kibana dashboards.

NOTE: If the traffic you are inspecting contains vlans - in order to use the VLAN template, make sure you have enabled vlan tracking in suricata.yaml:

 vlan:
   use-for-tracking: true