Hi Sam, thanks for trying the Elastic SIEM beta with Suricata!
The first step towards working with Suricata data in Elastic SIEM is to ingest it via the Suricata Filebeat module, as documented here: Filebeat Reference 7.2 » Modules » Suricata module
If you’re already running an older version of Filebeat, please upgrade it on the host running Suricata to the latest version, currently 7.2.
The Hosts view shown in the screenshot below is filtered with a KQL query, host.name: suricata* , to only show hostnames starting with suricata in the All Hosts widget:
Per the arrow in the screenshot above, drag the host to the timeline to view events collected from that host.
The screenshot below shows a Suricata alert in the timeline:
Anything draggable in the screenshot above, (alert signature, network community_id, source / destination IP, etc) can be dropped into the timeline query builder to narrow results with an AND, or widen the search with an OR.