I am using suricata module for the IDS and I am also activating suricata Integrations on SIEM. The filebeat suricata dashboard was created in kibana, and the suricata alert dashboard can also be checked in kibana(Security -> alerts). Both come from the same data source, but when comparing the data…

These two views are looking at different data sources. The first is looking at the raw events from Suricata. The second is looking at alerts in .alerts-security.alerts-default. These would events would have been put here by a detection rule. There is generic rule called External Alerts that ta…

The suricata results shown on the [filebeat dashboard] are different from the results shown in the [security -> alerts] on kibana

Elastic Security SIEM

system (system) Closed October 29, 2024, 2:41pm 3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Drilling into Suricata data SIEM	5	2245	August 8, 2019
Suricata (3 of 4 shards failed) Beats	1	330	April 8, 2020
Pfsense suricata fails to process alerts in elasticsearch via filebeat module Beats filebeat	2	1427	November 24, 2019
Tutorial suricata with Kibana 4 Kibana	6	3368	July 6, 2017
SURICATA LOGS NOT SHOWING UP IN NETWORK EVENTS IN ELASTIC SIEM Endpoint Security	14	2668	February 11, 2022

The suricata results shown on the [filebeat dashboard] are different from the results shown in the [security -> alerts] on kibana

Related topics