Cyber Security: Intrusion Detection
Description
The Intrusion Detection section monitors threats, their sources, and their targets.
Displayed Data
- number of unique threat source IP addresses
- number of unique threat target IP addresses
- total number of unique addresses
- threat statistics by type
- statistics by user agent
- number of events by source
- threat trends
- top 10 threat sources by number of intrusion attempts
- top 10 threat targets by number of intrusion attempts
List of Dashboards
The section includes three dashboards.
Intrusion Detection: Overview
Intrusion Detection: Threat Source Profile
Intrusion Detection: Threat Target Profile
Data Model
The section uses the data source fields listed below. Alias: sm_cs_threat_indeces.
Categorization Fields
Categorization fields are not used by this section.
General Purpose Fields
Observer observer
| Field Name | Value | Usage in Dashboards |
|---|---|---|
observer.vendor | Information about the manufacturer of the intrusion detection system or network equipment that generated the event. | Allows users to identify which system generates the most events. |
Source source
| Field Name | Value | Usage in Dashboards |
|---|---|---|
source.ip | IP address of the threat source. | Used to count the number of unique attackers aggs count by source.ip. Used as a link to the source profile from table rows. |
source.address | The physical or logical address of the source. | Displayed in the target details table. |
source.port | The source port. | Displayed in the targets table (column name: Source Port). |
Destination destination
| Field Name | Value | Usage in Dashboards |
|---|---|---|
destination.ip | IP address of the threat target. | Primary filter $dest_ip$. Used to select a specific node for event analysis. |
destination.port | The target port. | Displayed in the Target Information table (column name: Target Port). |
Threat Type rule
| Field Name | Value | Usage in Dashboards |
|---|---|---|
rule.category | Type of threat source/target. | Used in pie charts and bar graphs to analyze the distribution of threat types. |
Agent ID user_agent
| Field Name | Value | Usage in Dashboards |
|---|---|---|
user_agent.name | The user agent information. | Used in visualizations. |
Dictionaries
Dictionaries are not used by this section.