PEAK Baseline Threat Hunt Dashboards

Kibana / Security Onion 3.0 — Tier 1 & ICS Protocol Analysis

Importable Kibana saved-object dashboards implementing the Splunk PEAK Baseline Threat Hunt methodology for cyber threat hunt (CTH) and incident response (IR) operations. Built and validated against Security Onion 3.0.0 with Zeek NSM and Suricata data in Elasticsearch.

---

Overview

Each dashboard follows a consistent two-phase design:

1. Establish the Baseline — volume over time, cardinality metrics, top-talker tables, and protocol-specific distribution panels that let operators build a picture of what normal looks like for a given protocol on a given network.
2. Surface Deviations — long-tail / least-frequent tables, pre-filtered anomaly panels, and nested bucket visualizations designed to expose outliers, rare values, and statistically unusual combinations that warrant investigation.

Every dashboard includes:

• A markdown context panel explaining the protocol, the hunt hypothesis, specific deviation patterns to look for, and relevant MITRE ATT&CK (Enterprise or ICS) technique IDs
• Volume-over-time trend panel for baselining and spike detection
• Top-talker and rare/long-tail tables for every key field (most-frequent establishes the baseline; least-frequent surfaces the hunt targets)
• Pre-filtered panels for high-priority hunt scenarios specific to each protocol
• A saved search with relevant columns for raw event drill-down

Dashboards are designed to serve both experienced hunters who know the protocol and analysts learning it — the markdown panels document normal behavior so the dashboard functions as a teaching aid as well as a hunt tool.

---

PEAK Methodology

The PEAK Framework (Prepare, Execute, Act with Knowledge) is a structured threat hunting methodology developed by Splunk. These dashboards implement the Baseline Hunt model from the PEAK framework:

Prepare     →  Define hypothesis; identify data sources; understand normal behavior
Execute     →  Baseline the data; surface statistical deviations; investigate anomalies
Act         →  Document findings; create detections; update the baseline
Knowledge   →  Feed results back into future hunt planning

The key insight of PEAK Baseline Hunts is that you cannot find evil until you know what normal looks like. Every panel in these dashboards is designed with that principle in mind — top-frequency tables define normal, and least-frequency tables expose what doesn't fit.

For more detail on the PEAK framework, see the Splunk PEAK Threat Hunting Framework.

---

Import Instructions

1. In Kibana, navigate to Stack Management → Saved Objects
2. Click Import
3. Select the .ndjson file for the dashboard(s) you want to import
4. Choose Request for action on conflict (or Overwrite if re-importing)
5. Click Import

Each file is fully self-contained — it includes the dashboard, all visualizations, and any saved searches. No dependencies on external saved objects.

Index pattern requirement: Dashboards use the logs-* index pattern, which is the default for Security Onion 3.0 imports. Verify this index pattern exists in your Kibana instance before importing.

---

Dashboard Reference

Standard Network Protocols (Zeek + Suricata)

---

PEAK-Baseline-Conn.ndjson

Protocol: Network Connections (Zeek conn.log) | Filter: tags:conn

The foundation of any network baseline. Covers all TCP/UDP/ICMP connection records regardless of protocol. Hunt surface: rare IP pairs and port combinations, long-duration connections (beaconing), high byte-count flows to unusual destinations, rarely-seen destination ports.

Key fields: source.ip, destination.ip, destination.port, network.transport, network.protocol, network.bytes, event.duration, connection.state, hash.ja4t

MITRE: T1071 (C2), T1048 (Exfil), T1571 (Non-Standard Port), T1572 (Protocol Tunneling)

---

PEAK-Baseline-DNS.ndjson

Protocol: DNS (Zeek dns.log) | Filter: tags:dns

DNS is the most query-able data source in the environment and one of the most abused by adversaries. Hunt surface: rare queried domains (DGA, new C2 infrastructure), high-entropy domain names, unusual query types (TXT, ANY, NULL — tunneling indicators), rare resolvers, NX-domain storms.

Key fields: dns.question.name, dns.question.type, dns.response_code, source.ip, destination.ip

MITRE: T1071.004 (DNS C2), T1568 (Dynamic Resolution), T1048.003 (DNS Exfil), T1583 (Acquire Infrastructure)

---

PEAK-Baseline-HTTP.ndjson

Protocol: HTTP/HTTPS (Zeek http.log) | Filter: tags:http or tags:http2

Web traffic baseline covering user-agents, URI patterns, status codes, and host distributions. Hunt surface: rare or malformed user-agents (tool fingerprints), unusual HTTP methods, rare external hosts receiving POST data, URI paths associated with known frameworks (Cobalt Strike, Metasploit), JA4H fingerprints.

Key fields: url.domain, url.path, http.request.method, http.response.status_code, user_agent.original, source.ip, destination.ip, hash.ja4h

MITRE: T1071.001 (HTTP C2), T1566 (Phishing), T1105 (Tool Transfer), T1059 (Scripted Execution via Web)

---

PEAK-Baseline-TLS.ndjson

Protocol: TLS/SSL (Zeek ssl.log) | Filter: tags:ssl

TLS session metadata — versions, cipher suites, certificate subjects, and JA3/JA4 fingerprints. Hunt surface: old/weak TLS versions (1.0/1.1), self-signed or unusual certificate subjects, rare JA3/JA4 client fingerprints (malware tool signatures), expired certificates, TLS to non-standard ports.

Key fields: tls.version, tls.cipher, tls.client.server_name, tls.server.subject, tls.server.issuer, hash.ja3, hash.ja3s, hash.ja4, hash.ja4s

MITRE: T1573 (Encrypted Channel), T1071 (C2), T1587.003 (Self-Signed Certs)

---

PEAK-Baseline-SMB.ndjson

Protocol: SMB (Zeek smb_mapping.log + smb_files.log) | Filter: tags:smb_mapping or tags:smb_files

Combined dashboard covering both SMB share mappings and file operations. Hunt surface: access to administrative shares (ADMIN$, C$, IPC$), rare share paths, unusual file access patterns, clients accessing shares they've never previously touched, lateral movement file staging.

Key fields: smb.path, smb.share_type, file.action, file.name, file.path, source.ip, destination.ip

MITRE: T1021.002 (SMB/Windows Admin Shares), T1570 (Lateral Tool Transfer), T1039 (Data from Network Shared Drive)

---

PEAK-Baseline-Kerberos.ndjson

Protocol: Kerberos (Zeek kerberos.log) | Filter: tags:kerberos

Active Directory authentication baseline. Hunt surface: Kerberoasting (TGS requests for service accounts, especially RC4 cipher), AS-REP Roasting (requests without pre-auth), pass-the-ticket indicators, unusual encryption types, rare client/service name pairs, authentication failures.

Key fields: kerberos.request_type, kerberos.client, kerberos.service, kerberos.success, kerberos.error_code, kerberos.cipher, kerberos.forwardable, source.ip, destination.ip

MITRE: T1558.003 (Kerberoasting), T1558.004 (AS-REP Roasting), T1550.003 (Pass-the-Ticket)

---

PEAK-Baseline-FTP.ndjson

Protocol: FTP (Zeek ftp.log) | Filter: tags:ftp

FTP command and response baseline. Hunt surface: anonymous authentication (ftp/anonymous username), rare FTP commands (especially SITE, CHMOD, DELE), unusual reply codes, FTP to non-standard ports, rare external FTP servers receiving data.

Key fields: ftp.command, ftp.user, ftp.argument, server.reply_code, server.reply_message, source.ip, destination.ip

MITRE: T1048 (Exfil over Alt Protocol), T1071 (C2), T1105 (Tool Transfer)

---