Home › Docs ›Observability › Kibana Dashboards

Kibana Dashboards

Visual dashboards for monitoring honeypot activity

Six saved dashboards cover alert triage, aggregate threat posture, decisioning, session behaviour, attack patterns and threat intelligence, plus a seventh embed-only timeline dashboard used for evidence capture. All of them are generated from Python and committed as NDJSON, so the same definition can be rebuilt offline or imported into a live Kibana. The kibana_dashboards_setup service re-imports the NDJSON on every docker compose up with overwrite=true, so the set is idempotent and self-healing, and it sets the Web Traffic dashboard as Kibana's landing page.

Operational 6 registered views Alerts, web threat overview, decisions and decay, session analysis, attack patterns and threat intelligence. dashboard-* IDs

Evidence Timeline capture A dedicated embed-mode dashboard renders a pattern's request timeline before a screenshot is taken. per-pattern

Code-managed Review friendly Layouts live in Python, so changes are reviewable and exportable rather than click-only state. NDJSON in git

Dashboard Registry

Dashboard ID	Title	Answers the question…
dashboard-ids-alerts	Honeypot: IDS Alerts (Suricata)	What did the network IDS see? Severity over time, categories, protocols, targeted ports, top signatures and source IPs.
dashboard-web-threat-overview	Honeypot: Web Traffic & Threat Overview	What was requested and how was it answered? The Top URIs table marks every URI `attack_pattern` or `safe`.
dashboard-threat-decisions	Honeypot: Threat Decisions & Decay	Why did each request go where it went? Request score vs the decayed score carried from the session, against the threshold; decay state, offenses and routing reasons.
dashboard-session-analysis	Honeypot: Session Analysis	How did each session behave? Per-session volume, duration, peak score, offenses and sophistication class.
dashboard-attack-patterns	Honeypot: Attack Patterns	What did requests match? Attack patterns and CVEs, the URIs behind them, security events, honeytokens and top attacking IPs.
dashboard-threat-intel	Honeypot: Threat Intelligence	What does external reputation say? Threat-intelligence integrations and flagged addresses.

Each dashboard is built via _dashboard(dash_id, title, description, layout) and registered as ("dashboard", did, body) objects in saved_objects/honeypot-dashboards.ndjson, all built on the honeypot-* data view whose time field is timestamp.

What powers the decision panels

The Threat Decisions & Decay panels read fields the reverse proxy writes to its security access log (log_format security in nginx.conf, filled by router_rules.decision_trace()): request_score, decayed_score, carried_score, offenses, decay_state, uri_class, patterns and route_reason. Vector parses them into typed Elasticsearch fields — see SIEM & Log Pipeline.

Building and Exporting

Offline build. python3 siem/kibana/build_dashboards.py --ndjson regenerates saved_objects/honeypot-dashboards.ndjson from the Python definitions. It is idempotent and needs no running Kibana.
Live import. The same script can push the objects into a running Kibana through the Saved Objects API, using KIBANA_URL, ELASTIC_USERNAME and ELASTIC_PASSWORD. On a normal start, kibana_dashboards_setup does this for you.
Export after live edits. If you change panels by hand in Kibana, python3 siem/kibana/export_dashboards.py writes the live objects back to NDJSON so the next build or import does not overwrite them.

Inside the operator dashboard, the SIEM Analytics page opens these dashboards with autologin and can export them to PDF.

Pattern Report Timeline Dashboard

A dedicated pattern report timeline dashboard (pattern-report-request-timeline-dashboard) is used in embed mode to capture screenshots of request timelines for specific patterns.

Automates a login process (via autologin script if configured) to access Kibana.
Imports the necessary saved objects using the Kibana API.
Loads the specific timeline dashboard in embed mode for a given time window.
Waits for a rendering signal (checking for a "render complete" flag) before capturing a screenshot.

Dashboard Python Module Reference

Module	Purpose	Key Functions
`siem/kibana/build_dashboards.py`	Generates dashboard objects and visualizations into NDJSON	_dashboard(), dashboard registration
`siem/kibana/export_dashboards.py`	Exports live dashboard objects from Kibana to local NDJSON	Export by dashboard ID list
`dashboard/core/kibana_timeline.py`	Defines structure and payload for request timeline visualization	DASHBOARD_ID, _dashboard_body(), NDJSON generation
`dashboard/ui/kibana_timeline_capture.py`	Client-side workflow for live dashboard capture	Autologin, Kibana API import, embed-mode loading, screenshot capture

Honest Assessment

Strengths: Offline generation is idempotent. Export workflow preserves manual panel edits. Timeline capture enables per-pattern visual evidence.

Limitations: Dashboard generation and export are separate scripts with potential drift. Timeline capture depends on Kibana auth setup. Layout defined in Python code (not editable JSON). No automated dashboard health monitoring. The honeypot-docker-* index currently ingests nothing — Docker container labels trigger an Elasticsearch field-mapping conflict (label.com.docker.compose.project), a pre-existing issue out of scope for the nginx/Suricata dashboards.