Cyber Security: SELKS

From OnnoWiki
Revision as of 04:09, 16 July 2023 by Onnowpurbo (talk | contribs)
Jump to navigation Jump to search

SELKS is a free, open-source, and turn-key Suricata network intrusion detection/protection system (IDS/IPS), network security monitoring (NSM) and threat hunting implementation created and maintained by Stamus Networks.


Released under GPL 3.0-or-later license, the live distribution is available as either a live and installable Debian-based ISO or via Docker compose on any Linux operating system.


SELKS is comprised of the following major components:

  • Suricata - Ready to use Suricata
  • Elasticsearch - Search engine
  • Logstash - Log injection
  • Kibana - Custom dashboards and event exploration
  • Stamus Community Edition (CE) - Suricata ruleset management and Suricata threat hunting interface


In addition, SELKS now includes Arkime, EveBox and CyberChef.


What is Stamus Community Edition?

Stamus CE is the Stamus Networks open-source application that brings all these components together. Stamus CE provides the web interface for the entire system, giving you the ability to:

  • Manage multiple Suricata rulesets and threat intelligence sources
  • Upload and manage custom Suricata rules and IoC data files
  • Hunt for threats using predefined filters and enhanced contextual views
  • Apply thresholding and suppression to limit verbosity of noisy alerts
  • View Suricata performance statistics and information about Suricata rule activity
  • Apply Kibana, EveBox, and Cyberchef to the Suricata NSM and alert data


Pranala Menarik