Home

Welcome to the SELKS wiki!

User documentation

Initial Setup

• First time setup
• Initial Setup - Network card (NIC) setup
• Initial Setup - Suricata IDPS
• Initial Setup - Suricata IPS

Tuning and Maintenance

• Config files
• Tuning SELKS
• Running SELKS in production
• How to load or update dashboards
• How to compile latest Suricata on SELKS
• Using the SELKS Debian Repositories
• Ruleset updates
• Alert suppression and threshold.conf
• Scirius backup
• Scirius documentation
• Misc improvements
• RestAPI

Monitoring the system

• Metricbeat

Data and logs

• Logrotate
• Data lifecycle
• Reset stats and logs
• Delete specific logs from Elasticsearch

Troubleshooting and Getting Help

• Troubleshooting and Logs
• Services status check
• Forgot Scirius/web log in password
• Getting Help

Misc

• A stop job running for logstash takes too long on shutdown
• AD authentication
• Kibana did not load properly

Misc - old

• Kibana 4.5 - GeoIP Map visualizations not working
• Logstash 5.6.9 breaking upgrade

SELKS Regular Upgrades

• SELKS upgrades
• Scirius CE 2.x to 3.1.0+ upgrade

SELKS Major Upgrades

• SELKS 1.2 to SELKS 2.0 upgrades
• SELKS 2.0 to SELKS 2.1 upgrades
• SELKS 2.0 to SELKS 3.0 upgrades
• SELKS 3.0RC1 upgrades
• SELKS 3.0RC1 to SELKS 3.0 upgrades
• SELKS 3.0 to SELKS 4.0 upgrades
• SELKS 4.0 to SELKS 5.0 Beta1 upgrades
• SELKS 4.0 to SELKS 5.0 RC1 upgrades
• SELKS 4.0 to SELKS 5.0 upgrades
• SELKS 5.0 Beta1
• SELKS 5.0 RC1
• SELKS 5.0 Buster upgrade
• SELKS 5.0 to SELKS 6RC1
• SELKS 5.0 to SELKS 6.0

Developer documentation

• Building SELKS
• Customizing SELKS

Tutorials

• SELKS 3 ESXi Installation Guide
• SELKS 5 install in AWS/Azure - thanks to Nimdy
• SELKS 5 additional dashboards - thanks to Nimdy
• Webinar - Hunting Threats That Use Encrypted Network Traffic with Suricata

Splunk

SELKS Splunk App - thanks to Damien Hotz

Papers

SANS Institute InfoSec Reading Room - Continuous Monitoring: Build A World Class Monitoring System for Enterprise, Small Office, or Home.