Cyber security use case for the ELK stack

This comprises Kibana UI and Graph Analysis (using neo4j and apoc).

Usage

Clone this repository recursively (i.e. including submodules)

git clone --recurse-submodules https://github.com/awesome-inc/docker-elk-cyber.git

Start your stack using docker-compose:

docker-compose up

And then access Kibana UI by hitting http://localhost:5601 with a web browser.

You should see a dashboard like this

In addition to the standard ELK stack we added a neo4j container including apoc. You can access the neo4j data browser on http://localhost:7474/

You should be able to explore entity relations extracted using OpenNLP on the unstructured article data

Custom actions on neo4j objects can be configured HATEOAS style using the decorator which wraps the neo4j REST Api to provide custom data links.

Browse the current configuration on http://localhost:3000/api/ai/.config.

Test data being used for this demo are some News and Security related RSS feeds

And optionally Twitter. Note: Check Twitter API Status for the streaming API.

Latest architecture diagram