Introduction
Revision History
| Date | Author | Summary |
|---|---|---|
| 06-DEC-2020 | TSgt. Bernadotte | Initial draft for CVA/H 3.3.0 |
| 08-JUL-2024 | TSgt. Bernadotte | Updated for current dashboards |
Purpose
The purpose of this AID is to provide a reference for analysts utilizing a customized CVA/H DIP with 262COS/DOK Kibana dashboards. This document contains high-level description information on the most prevalent dashboards.
262COS/DOK developed a custom Elastic Stack configuration in order to utilize the Elastic Common Schema (ECS) for normalizing field names and data types between Zeek, Suricata, Winlogbeat, and Endgame, as well as provide more detailed Kibana dashboards to facilitate in-depth analysis.