The purpose of this project is to provide a collection of dashboards that are useful for quickly conducting a forensic investigation on a host, user, or processes using centralized collection of Sysmon logs. These dashboards were created using Sysmon data injested through Kafka, you may need to adjust the field names if you are using a different forwarder.

Log into your Kibana instance navigate to Management -> Kibana -> Saved Objects Import the JSON file

Enter a hostname in the search bar to investigate activity on that host.

• Timelion Network Events by user
• Timelion Process Creation events by user
• elastalert alerts for this host
• executed commands - events where the parent process is Cmd.exe, PowerShell.exe, wscript.exe, or cscript.exe
• EventId 1 - Process Execution events on the host
• EventId 3 - Network events on the host
• EventId 11 - File creation events on the host
• EventId 15 - Downloaded files
• EventId 12,13,14 - Registry Modification events
• EventId 19,20,21 - WMI Subscription modifications
• Login events - Windows Security Event 4624, local authentication events

Enter a username in the search bar to investigate activity on that host.

• Timeline of all events split by hostname
• count of user related events per hostname
• Processes excuted by the user
• Network Connections by the user
• Files Created by the user
• Files Downloaded by the user
• Registry modifications by the user
• Local authentication events by the user

Dashboard for investigating individual processes using the ProcessGuid in Sysmon events. Every executing process has a unique process_guid that can be used to show every sysmon event related to that process.

• Process Creation events (event_id 1) also contain the parent_process_guid which can be used to track the lineage of a processes.
• Multiple Process Guids can be displayed at once by chaining them together with OR statements