The last update to the DShield SIEM [4<\/a>] was in Sep 2025 which contained some minor tweaks. This update currently is using ELK stack version 8.19.15, contains some additional dashboards and new logs.<\/p>\n The following have been added to the DShield SIEM<\/a> to provide additional information about what the DShield sensor [1<\/a>] is receiving. These 2-addition installed in the DShield sensor provide direct collection of TTY logs [2<\/a>] and Suricata [3<\/a>] which are now reported to the DShield SIEM. The TTY logs are parsed and uploaded daily at 23:58Z which can be reviewed in the DShield – Traffic Analysis tab to match the TTY Log Hashes and shows which actor ran any series of commands while logged in the sensor.\u00a0<\/p>\n The TTY logs are base64 encoded before they are sent to the SIEM and decoded by Kibana upon review. TTY logs in base64 format:<\/p>\n transaction.id: 021d88f11b09defc8756e1bd6eabaea8113b3fbf917c9bd4fef4f546a1c9512a \nThe TTY logs are parsed once per day and uploaded directly into DShield SIEM with filebeat. The BASH script needs to be installed and configure according to the GitHub page [2<\/a>] to provide a transcript of the activity reviewed in Kibana.<\/p>\n The addition of Suricata [3<\/a>] is also available in the DShield dashboards and linked to all other logs.\u00a0<\/p>\n An updated dashboard now contains these changes to reflect the ability to share between sub-dashboard most of the queries selected (i.e. selecting an IP will replicate everywhere).\u00a0<\/p>\n The dashboard also has a Threat Map that can be used to view the logs traffic activity in “movement<\/em>“.<\/p>\n Jesse<\/a> and I are at SANSFIRE, if you are onsite, come tonight at the SANSFIRE 2026 Honeypot Workshop in Independence A – West (Level 5B) at 6:45 PM.<\/strong><\/p>\n [1] https:\/\/isc.sans.edu\/honeypot.html ———– (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n \t
\nevent.hash: ZWNobyAtZSAieCFcbjBPc0NsT21WU0JGOVxuME9zQ2xPbVZTQkY5InxwYXNzd2R8YmFzaC1iYXNoOiBFbnRlcjogY29tbWFuZCBub3QgZm91bmQK
\ntransaction.id: 02caa940d3e30057af8235125c8376b2394622118344516895b045a6fe9b5ecb
\nevent.hash: ZWNobyAtZSAiMTIzXG53QjV1clY4NXFxa1dcbndCNXVyVjg1cXFrVyJ8cGFzc3dkfGJhc2gtYmFzaDogRW50ZXI6IGNvbW1hbmQgbm90IGZvdW5kCg==
\ntransaction.id: 052b36a73707754c7d49814cdc1f32fef3f72d334a7479f78f11c3229c1599d9
\nevent.hash: ZWNobyAtZSAieCFcbkNLbGFOS0lOdWlYalxuQ0tsYU5LSU51aVhqInxwYXNzd2R8YmFzaC1iYXNoOiBFbnRlcjogY29tbWFuZCBub3QgZm91bmQK<\/span><\/p>\n![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/ttylogs_pic.png?ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/suricata_events_pic.png?ssl=1\")
\n![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/suricata_alerts_pic.png?ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/dashboard_pic.png?ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/threat_map.png?ssl=1\")
<\/p>\n
\n[2] https:\/\/github.com\/bruneaug\/DShield-SIEM\/blob\/main\/AddOn\/TTYLogs_To_DShield-SIEM.md
\n[3] https:\/\/github.com\/bruneaug\/DShield-SIEM\/blob\/main\/AddOn\/Configure_Suricata.md
\n[4] https:\/\/isc.sans.edu\/diary\/DShield+SIEM+Docker+Updates\/32276
\n[5] https:\/\/github.com\/bruneaug\/DShield-SIEM\/tree\/main<\/p>\n
\nGuy Bruneau IPSS Inc.<\/a>
\nMy GitHub Page<\/a>
\nTwitter: GuyBruneau<\/a>
\ngbruneau at isc dot sans dot edu<\/p>\n
\n
<\/BR><\/p>\n