Grafana Dashboard for Suricata IDS/IPS Logs JSON

[ehnwebmaster]

➡️Event_type
➡️Source IP
➡️Protocol
➡️Destination Port
➡️Signature ID
➡️Signature
➡️Category
➡️Severity

/etc/suricata/suricata.yaml

  - eve-log:
      enabled: yes
      filename: eve.json

https://grafana.com/grafana/dashboards/22247-suricata-logs-json/

Promtail Configuration

  - job_name: suricata
         - json:
             expressions:
               event_type: event_type
               src_ip: src_ip
               proto: proto
               dest_port: dest_port
               alert:
         - json:
             expressions:
               action: action
               signature_id: signature_id
               category: category
               severity: severity
             source: alert
         - labels:
             event_type:
             src_ip:
             proto:
             dest_port:
             signature_id:
             signature:
             category:
             severity:
    static_configs:
      - targets:
        - localhost
        labels:
          job: suricata_logs
          __path__: /var/log/suricata/eve.json