Now that we demonstrated that we can adjust our Snort data into the ELK stack,
Globomantics leadership is excited to see the results of all of our work.
They want to see if you can create a dashboard for them that
displays the top 10 destination ports and the top 25
applications used from your test data.
Let's head over to Kibana and start creating the dashboard.
Before we create a dashboard,
we're going to need to create the visualizations that
Globomantics leadership is looking for.
To get started, we select the Visualize option and then Create visualization.
For the top ports, let's go ahead and use a pie chart.
We need to select the source for the top ports, which will be our alert data.
To configure the pie chart, we simply add a bucket,
choose Split slices, select an aggregation,
and we'll go to Terms.
We select a field, which will be destination port and then change our size to 10.
And once we click update, we should have our pie chart with our top 10 ports.
So a quick save, and we'll call it Globomantics Top 10 Destination Ports,
and we click Save and that's all set.
Now we just need to create our top 25 applications.
For that we'll go back to Visualize again,
create another visualization, and this time we'll use a horizontal bar chart.
We select our apps as a source.
And then here we're going to add another bucket, for our X axis for this chart.
Select an aggregation of terms again.
And in this field, we're going to choose app.keyword,
leave our metric count in descending, and do our top 25 apps.
And when we click update, you should see a chart that looks something like this.
So now we have our top 25 applications used in our test data.
Let's go ahead and change this custom label to Top 25 Applications.
And when we click update,
we should see our X axis change its name to what we want it to look like.
Now we come up here and click Save again,
and we'll call this Globomantics Top 25 Apps and we'll hit Save,
and then we have both of our visualizations that we need.
Now we just need to create the dashboard.
To do that, we click over here to dashboards,
which should bring you straight into editing a new dashboard.
And then we go to Add up here and we'll add in our Globomantics Top 10
Destination Ports and our Globomantics Top 25 Apps.
And there we go.
We have our dashboard.
Within Kibana, you can move these dashboards around,
rearrange them however you want, and even change their sizes.
But for now, let's go ahead and save this dashboard.
I'll call it Globomantics Test and save it, and that's it.
Now we have our dashboard saved and ready to show to
leadership. For a quick recap, in this demo,
we took our application and alert data and created a visual
display showing the top 10 ports in a pie chart and the top 25
applications in a horizontal bar chart.
We then created a dashboard to display this information on
one page for Globomantics leadership.