{"id":7976,"date":"2026-03-04T22:38:47","date_gmt":"2026-03-04T20:38:47","guid":{"rendered":"https:\/\/scalemedia.co.za\/cybermedia\/?post_type=docs&p=7976"},"modified":"2026-03-04T22:46:52","modified_gmt":"2026-03-04T20:46:52","password":"","slug":"siem-visualization-example-1","status":"publish","type":"docs","link":"https:\/\/scalemedia.co.za\/cybermedia\/docs\/siem-visualization-example-1\/","title":{"rendered":"SIEM Visualization Example 1"},"content":{"rendered":"\n

SIEM Visualization Example 1: Failed Logon Attempts (All Users)<\/h1>\n\n\n\n

Dashboards in SIEM solutions serve as containers for multiple visualizations, allowing us to organize and display data in a meaningful way.<\/p>\n\n\n\n

In this and the following sections, we will create a dashboard and some visualizations from scratch.<\/p>\n\n\n\n

\n\n\n\n

Developing Our First Dashboard & Visualization<\/h2>\n\n\n\n

Navigate to the bottom of this section and click on Click here to spawn the target system!<\/code><\/p>\n\n\n\n

Now, navigate to http:\/\/[Target IP]:5601<\/code>, click on the side navigation toggle, and click on “Dashboard”.<\/p>\n\n\n\n

Delete the existing “SOC-Alerts” dashboard as follows.<\/p>\n\n\n\n

\"Elastic<\/figure>\n\n\n\n

When visiting the Dashboard page again we will be presented with a message indicating that no dashboards currently exist. Additionally, there will be an option available to create a new Dashboard and its first visualization. To initiate the creation of our first dashboard, we simply have to click on the “Create new dashboard” button.<\/p>\n\n\n\n

\"Elastic<\/figure>\n\n\n\n

Now, to initiate the creation of our first visualization, we simply have to click on the “Create visualization” button.<\/p>\n\n\n\n

\"Elastic<\/figure>\n\n\n\n

Upon initiating the creation of our first visualization, the following new window will appear with various options and settings.<\/p>\n\n\n\n

Before proceeding with any configuration, it is important for us to first click on the calendar icon to open the time picker. Then, we need to specify the date range as “last 15 years”. Finally, we can click on the “Apply” button to apply the specified date range to the data.<\/p>\n\n\n\n

\"Elastic<\/figure>\n\n\n\n

There are four things for us to notice on this window:<\/p>\n\n\n\n

    \n
  1. A filter option that allows us to filter the data before creating a graph. For example, if our goal is to display failed logon attempts, we can use a filter to only consider event IDs that match\u00a04625 \u2013 Failed logon attempt on a Windows system<\/code>. The following image demonstrates how we can specify such a filter.\"Elastic<\/li>\n\n\n\n
  2. This field indicates the data set (index) that we are going to use. It is common for data from various infrastructure sources to be separated into different indices, such as network, Windows, Linux, etc. In this particular example, we will specify\u00a0windows*<\/code>\u00a0in the “Index pattern”.<\/li>\n\n\n\n
  3. This search bar provides us with the ability to double-check the existence of a specific field within our data set, serving as another way to ensure that we are looking at the correct data. For example, let’s say we are interested in the\u00a0user.name.keyword<\/code>\u00a0field. We can use the search bar to quickly perform a search and verify if this field is present and discovered within our selected data set. This allows us to confirm that we are accessing the desired field and working with accurate data.\"Elastic“Why\u00a0user.name.keyword<\/code>\u00a0and not\u00a0user.name<\/code>?”, you may ask. We should use the\u00a0.keyword<\/code>\u00a0field when it comes to aggregations. Please refer to this\u00a0stackoverflow question<\/a>\u00a0for a more elaborate answer.<\/li>\n\n\n\n
  4. Lastly, this drop-down menu enables us to select the type of visualization we want to create. The default option displayed in the earlier image is “Bar vertical stacked”. If we click on that button, it will reveal additional available options (image redacted as not all options fit on the screen). From this expanded list, we can choose the desired visualization type that best suits our requirements and data presentation needs.\"Elastic<\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n

    For this visualization, let’s select the “Table” option. After selecting the “Table”, we can proceed to click on the “Rows” option. This will allow us to choose the specific data elements that we want to include in the table view.<\/p>\n\n\n\n

    \"Elastic<\/figure>\n\n\n\n

    Let’s configure the “Rows” settings as follows.<\/p>\n\n\n\n

    \"Elastic<\/figure>\n\n\n\n

    Note<\/strong>: You will notice Rank by Alphabetical<\/code> and not Rank by Count of records<\/code> like in the screenshot above. This is OK. By the time you perform the next configuration below, Count of records<\/code> will become available.<\/p>\n\n\n\n

    Moving forward, let’s close the “Rows” window and proceed to enter the “Metrics” configuration.<\/p>\n\n\n\n

    \"Elastic<\/figure>\n\n\n\n

    In the “Metrics” window, let’s select “count” as the desired metric.<\/p>\n\n\n\n

    \"Elastic<\/figure>\n\n\n\n

    As soon as we select “Count” as the metric, we will observe that the table gets populated with data (assuming that there are events present in the selected data set)<\/p>\n\n\n\n

    \"Elastic<\/figure>\n\n\n\n

    One final addition to the table is to include another “Rows” setting to show the machine where the failed logon attempt occurred. To do this, we will select the host.hostname.keyword<\/code> field, which represents the computer reporting the failed logon attempt. This will allow us to display the hostname or machine name alongside the count of failed logon attempts, as shown in the image.<\/p>\n\n\n\n

    \"Elastic<\/figure>\n\n\n\n

    Now we can see three columns in the table, which contain the following information:<\/p>\n\n\n\n

      \n
    1. The username of the individuals logging in (Note: It currently displays both users and computers. Ideally, a filter should be implemented to exclude computer devices and only display users).<\/li>\n\n\n\n
    2. The machine on which the logon attempt occurred.<\/li>\n\n\n\n
    3. The number of times the event has occurred (based on the specified time frame or the entire data set, depending on the settings).<\/li>\n<\/ol>\n\n\n\n

      Finally, click on “Save and return”, and you will observe that the new visualization is added to the dashboard, appearing as shown in the following image.<\/p>\n\n\n\n

      \"Elastic<\/figure>\n\n\n\n

      Let’s not forget to save the dashboard as well. We can do so by simply clicking on the “Save” button.<\/p>\n\n\n\n

      \"Elastic<\/figure>\n\n\n\n
      \n\n\n\n

      Refining The Visualization<\/h2>\n\n\n\n

      Suppose the SOC Manager suggested the following refinements:<\/p>\n\n\n\n