PEAK Baseline Threat Hunt Dashboards

Kibana / Security Onion 3.0 — Tier 1 & ICS Protocol Analysis

Importable Kibana saved-object dashboards implementing the Splunk PEAK Baseline Threat Hunt methodology for cyber threat hunt (CTH) and incident response (IR) operations. Built and validated against Security Onion 3.0.0 with Zeek NSM and Suricata data in Elasticsearch.

Overview

Each dashboard follows a consistent two-phase design:

1. Establish the Baseline — volume over time, cardinality metrics, top-talker tables, and protocol-specific distribution panels that let operators build a picture of what normal looks like for a given protocol on a given network.
2. Surface Deviations — long-tail / least-frequent tables, pre-filtered anomaly panels, and nested bucket visualizations designed to expose outliers, rare values, and statistically unusual combinations that warrant investigation.

Every dashboard includes:

• A markdown context panel explaining the protocol, the hunt hypothesis, specific deviation patterns to look for, and relevant MITRE ATT&CK (Enterprise or ICS) technique IDs
• Volume-over-time trend panel for baselining and spike detection
• Top-talker and rare/long-tail tables for every key field (most-frequent establishes the baseline; least-frequent surfaces the hunt targets)
• Pre-filtered panels for high-priority hunt scenarios specific to each protocol
• A saved search with relevant columns for raw event drill-down

Dashboards are designed to serve both experienced hunters who know the protocol and analysts learning it — the markdown panels document normal behavior so the dashboard functions as a teaching aid as well as a hunt tool.

PEAK Methodology

The PEAK Framework (Prepare, Execute, Act with Knowledge) is a structured threat hunting methodology developed by Splunk. These dashboards implement the Baseline Hunt model from the PEAK framework:

Prepare     →  Define hypothesis; identify data sources; understand normal behavior
Execute     →  Baseline the data; surface statistical deviations; investigate anomalies
Act         →  Document findings; create detections; update the baseline
Knowledge   →  Feed results back into future hunt planning

The key insight of PEAK Baseline Hunts is that you cannot find evil until you know what normal looks like. Every panel in these dashboards is designed with that principle in mind — top-frequency tables define normal, and least-frequency tables expose what doesn't fit.

For more detail on the PEAK framework, see the Splunk PEAK Threat Hunting Framework.

Import Instructions

1. In Kibana, navigate to Stack Management → Saved Objects
2. Click Import
3. Select the .ndjson file for the dashboard(s) you want to import
4. Choose Request for action on conflict (or Overwrite if re-importing)
5. Click Import

Each file is fully self-contained — it includes the dashboard, all visualizations, and any saved searches. No dependencies on external saved objects.

Index pattern requirement: Dashboards use the logs-* index pattern, which is the default for Security Onion 3.0 imports. Verify this index pattern exists in your Kibana instance before importing.

Dashboard Reference

Standard Network Protocols (Zeek + Suricata)

PEAK-Baseline-Conn.ndjson

Protocol: Network Connections (Zeek conn.log) | Filter: tags:conn

The foundation of any network baseline. Covers all TCP/UDP/ICMP connection records regardless of protocol. Hunt surface: rare IP pairs and port combinations, long-duration connections (beaconing), high byte-count flows to unusual destinations, rarely-seen destination ports.

Key fields: source.ip, destination.ip, destination.port, network.transport, network.protocol, network.bytes, event.duration, connection.state, hash.ja4t

MITRE: T1071 (C2), T1048 (Exfil), T1571 (Non-Standard Port), T1572 (Protocol Tunneling)

PEAK-Baseline-DNS.ndjson

Protocol: DNS (Zeek dns.log) | Filter: tags:dns

DNS is the most query-able data source in the environment and one of the most abused by adversaries. Hunt surface: rare queried domains (DGA, new C2 infrastructure), high-entropy domain names, unusual query types (TXT, ANY, NULL — tunneling indicators), rare resolvers, NX-domain storms.

Key fields: dns.question.name, dns.question.type, dns.response_code, source.ip, destination.ip

MITRE: T1071.004 (DNS C2), T1568 (Dynamic Resolution), T1048.003 (DNS Exfil), T1583 (Acquire Infrastructure)

PEAK-Baseline-HTTP.ndjson

Protocol: HTTP/HTTPS (Zeek http.log) | Filter: tags:http or tags:http2

Web traffic baseline covering user-agents, URI patterns, status codes, and host distributions. Hunt surface: rare or malformed user-agents (tool fingerprints), unusual HTTP methods, rare external hosts receiving POST data, URI paths associated with known frameworks (Cobalt Strike, Metasploit), JA4H fingerprints.

Key fields: url.domain, url.path, http.request.method, http.response.status_code, user_agent.original, source.ip, destination.ip, hash.ja4h

MITRE: T1071.001 (HTTP C2), T1566 (Phishing), T1105 (Tool Transfer), T1059 (Scripted Execution via Web)

PEAK-Baseline-TLS.ndjson

Protocol: TLS/SSL (Zeek ssl.log) | Filter: tags:ssl

TLS session metadata — versions, cipher suites, certificate subjects, and JA3/JA4 fingerprints. Hunt surface: old/weak TLS versions (1.0/1.1), self-signed or unusual certificate subjects, rare JA3/JA4 client fingerprints (malware tool signatures), expired certificates, TLS to non-standard ports.

Key fields: tls.version, tls.cipher, tls.client.server_name, tls.server.subject, tls.server.issuer, hash.ja3, hash.ja3s, hash.ja4, hash.ja4s

MITRE: T1573 (Encrypted Channel), T1071 (C2), T1587.003 (Self-Signed Certs)

PEAK-Baseline-SMB.ndjson

Protocol: SMB (Zeek smb_mapping.log + smb_files.log) | Filter: tags:smb_mapping or tags:smb_files

Combined dashboard covering both SMB share mappings and file operations. Hunt surface: access to administrative shares (ADMIN$, C$, IPC$), rare share paths, unusual file access patterns, clients accessing shares they've never previously touched, lateral movement file staging.

Key fields: smb.path, smb.share_type, file.action, file.name, file.path, source.ip, destination.ip

MITRE: T1021.002 (SMB/Windows Admin Shares), T1570 (Lateral Tool Transfer), T1039 (Data from Network Shared Drive)

PEAK-Baseline-Kerberos.ndjson

Protocol: Kerberos (Zeek kerberos.log) | Filter: tags:kerberos

Active Directory authentication baseline. Hunt surface: Kerberoasting (TGS requests for service accounts, especially RC4 cipher), AS-REP Roasting (requests without pre-auth), pass-the-ticket indicators, unusual encryption types, rare client/service name pairs, authentication failures.

Key fields: kerberos.request_type, kerberos.client, kerberos.service, kerberos.success, kerberos.error_code, kerberos.cipher, kerberos.forwardable, source.ip, destination.ip

MITRE: T1558.003 (Kerberoasting), T1558.004 (AS-REP Roasting), T1550.003 (Pass-the-Ticket)

PEAK-Baseline-FTP.ndjson

Protocol: FTP (Zeek ftp.log) | Filter: tags:ftp

FTP command and response baseline. Hunt surface: anonymous authentication (ftp/anonymous username), rare FTP commands (especially SITE, CHMOD, DELE), unusual reply codes, FTP to non-standard ports, rare external FTP servers receiving data.

Key fields: ftp.command, ftp.user, ftp.argument, server.reply_code, server.reply_message, source.ip, destination.ip

MITRE: T1048 (Exfil over Alt Protocol), T1071 (C2), T1105 (Tool Transfer)

PEAK-Baseline-SSH.ndjson

Protocol: SSH (Zeek ssh.log) | Filter: tags:ssh

SSH session baseline including client/server version strings and HASSH fingerprints. Hunt surface: rare SSH clients or server banners (tool fingerprints), anomalous cipher/MAC algorithm selections, HASSH fingerprints matching known attack tools (Paramiko, Metasploit), SSH to non-standard ports, rare source → destination pairs.

Key fields: ssh.client, ssh.server, ssh.version, ssh.cipher_algorithm, ssh.kex_algorithm, ssh.authentication.success, hash.hassh, ssh.hassh_server

MITRE: T1021.004 (SSH Lateral Movement), T1071 (C2), T1110 (Brute Force)

PEAK-Baseline-RDP.ndjson

Protocol: RDP (Zeek rdp.log) | Filter: tags:rdp

Remote Desktop baseline. Hunt surface: RDP from external/geo-unusual source IPs, low certificate counts (self-signed), unusual security protocols, RDP without NLA (Network Level Authentication), rare source → destination pairs for admin access.

Key fields: rdp.result, rdp.cookie, rdp.security_protocol, rdp.certificate_count, source.ip, destination.ip, source.geo.*

MITRE: T1021.001 (Remote Desktop Protocol), T1133 (External Remote Services), T1563.002 (RDP Hijacking)

PEAK-Baseline-SMTP.ndjson

Protocol: SMTP (Zeek smtp.log) | Filter: tags:smtp

Email traffic baseline. Hunt surface: rare sender domains in smtp.helo, unusual mail_from addresses, high-volume senders to external destinations, SMTP without TLS (smtp.tls:false), transaction depth anomalies, webmail clients to non-standard mail servers.

Key fields: smtp.helo, smtp.mail_from, smtp.recipient_to, smtp.last_reply, smtp.tls, smtp.is_webmail, source.ip, destination.ip

MITRE: T1566 (Phishing), T1048 (Exfil via Email), T1071 (C2 via Mail Protocol)

PEAK-Baseline-NTLM.ndjson

Protocol: NTLM (Zeek ntlm.log) | Filter: tags:ntlm

NTLM authentication baseline for detecting credential attacks. Hunt surface: NTLM authentication where Kerberos should be used (legacy auth or forced downgrade), unusual workstation → server authentication pairs, rare domain names, high NTLM failure rates (spray/brute), SMB relay indicators.

Key fields: user.name, host.domain, ntlm.server.nb.name, ntlm.server.dns.name, source.ip, destination.ip

MITRE: T1110 (Brute Force), T1557.001 (NTLM Relay), T1550.002 (Pass-the-Hash), T1187 (Forced Authentication)

PEAK-Baseline-DCE-RPC.ndjson

Protocol: DCE/RPC (Zeek dce_rpc.log) | Filter: tags:dce_rpc

Windows RPC call baseline for detecting lateral movement and credential attacks. Hunt surface: drsuapi endpoint (DCSync — T1003.006), svcctl endpoint (remote service creation), atsvc / ITaskSchedulerService (remote scheduled tasks), samr/lsarpc from non-DC hosts (credential dump), rare operations from workstations.

Pre-filtered panels for drsuapi and svcctl endpoints make this the fastest path to DCSync detection in the environment.

Key fields: dce_rpc.endpoint, dce_rpc.operation, dce_rpc.named_pipe, source.ip, destination.ip

MITRE: T1003.006 (DCSync), T1569.002 (Remote Services), T1053.005 (Scheduled Tasks), T1021.003 (DCOM)

PEAK-Baseline-LDAP.ndjson

Protocol: LDAP (Zeek ldap_search.log) | Filter: tags:ldap_search

Active Directory query baseline for detecting enumeration tools. Hunt surface: high result-count queries from workstations (BloodHound/SharpHound bulk enumeration), rare LDAP filter strings (tool-specific syntax), unusual base objects (trustedDomain, AdminSDHolder, msDS-AllowedToDelegateTo), rare client hosts querying LDAP.

Key fields: ldap.result, ldap.domain, ldap.object, ldap.common_name, ldap_search.filter, ldap_search.scope, ldap_search.result_count

MITRE: T1087 (Account Discovery), T1069 (Permission Groups Discovery), T1482 (Domain Trust Discovery)

PEAK-Baseline-WireGuard.ndjson

Protocol: WireGuard VPN (Zeek wireguard.log) | Filter: tags:wireguard

WireGuard tunnel baseline. In environments where WireGuard is not authorized, every event in this dashboard is a finding. Hunt surface: unauthorized initiating hosts, unknown external endpoints, unestablished sessions (failed handshakes), WireGuard on non-standard ports.

Key fields: wireguard.established, wireguard.initiations, wireguard.responses, source.ip, destination.ip

MITRE: T1572 (Protocol Tunneling), T1090 (Proxy), T1048 (Exfiltration over Alt Protocol), T1133 (External Remote Services)

PEAK-Baseline-x509.ndjson

Protocol: X.509 Certificates (Zeek x509.log) | Filter: tags:x509

Certificate observation baseline. Note: x509 logs contain certificate attributes only — no source/destination IPs. Correlate findings with the TLS dashboard for connection context. Hunt surface: self-signed certificates (subject = issuer), rare or unknown CAs, weak key lengths (RSA < 2048), deprecated signing algorithms (MD5, SHA1), rogue CA certificates (basic_constraints.ca:true from unknown issuers), rare SAN DNS domains.

Key fields: x509.certificate.subject, x509.certificate.issuer, x509.certificate.serial, x509.certificate.key.type, x509.certificate.key.length, x509.certificate.signing_algorithm, x509.san_dns, x509.basic_constraints.ca, hash.sha256

MITRE: T1573.002 (Asymmetric Crypto C2), T1587.003 (Digital Certificates), T1588.004 (Obtain Certificates)

PEAK-Baseline-Files.ndjson

Protocol: Zeek Files (Zeek files.log) | Filter: tags:file

File transfer baseline covering all protocols that carry files (HTTP, SMTP, SMB, FTP, etc.). Hunt surface: rare or unexpected MIME types — especially application/x-dosexec (PE executable), application/x-msdownload, ZIP/RAR archives from external sources — rare file senders, unusual delivery protocols (non-HTTP/SMTP analyzers), large outbound transfers. MD5 and SHA1 hash tables provided for threat intelligence cross-reference.

Key fields: file.mime_type, file.source, file.analyzer, file.bytes.seen, hash.md5, hash.sha1, source.ip, destination.ip

MITRE: T1105 (Ingress Tool Transfer), T1566 (Phishing), T1048 (Exfiltration), T1560 (Archive Collected Data)

PEAK-Baseline-Suricata.ndjson

Protocol: Suricata IDS/IPS Alerts | Filter: event.module:suricata

Suricata alert baseline for noise reduction and high-signal detection. The rare signatures table is the primary hunt entry point — single-occurrence rules are the highest-priority investigation surface. Hunt surface: rare alert signatures (not in baseline noise), critical severity alerts (severity 1), blocked traffic (IPS mode), unknown alert source IPs, alert category patterns (lateral movement, C2, exploit categories).

Key fields: rule.name, rule.category, rule.severity, rule.action, event.severity_label, source.ip, destination.ip, network.transport

MITRE: Varies by rule. Key categories: T1021 (Lateral), T1071 (C2), T1190 (Exploit Public App), T1566 (Phishing)

ICS / OT Protocols

⚠️ ICS Dashboard Note: Modbus and DNP3 have NO authentication and NO authorization in their baseline implementations. Any unauthorized host sending commands to a PLC, RTU, or IED is a critical finding regardless of whether the command succeeded. Treat anomalies in these dashboards as incidents, not alerts.

PEAK-Baseline-Modbus-Summary.ndjson

Protocol: Modbus/TCP Session Summary (Zeek modbus.log) | Filter: tags:modbus

Lower-volume, higher-level view of Modbus activity — one record per PDU transaction. Use as the entry point dashboard for Modbus hunts: authorized master inventory, function code distribution, traffic volume baseline. When you identify a suspicious master→slave pair, pivot to PEAK-Baseline-Modbus.ndjson for register-level detail.

Key fields: modbus.function, source.ip, destination.ip, destination.port

MITRE ICS: T1843 (Program Upload), T1846 (Remote System Discovery), T1855 (Unauthorized Command Message)

PEAK-Baseline-Modbus.ndjson

Protocol: Modbus/TCP Register Detail (Zeek modbus_detailed.log) | Filter: tags:modbus_detailed

Register and coil-level detail — one record per individual Modbus read/write operation. Use for deep-dive analysis after identifying suspicious hosts in the Summary dashboard. Hunt surface: write operations to specific registers from unauthorized hosts, address ranges outside normal operational parameters, rare function codes, register address probing (sequential address access patterns).

Key fields: modbus.function, modbus.address, source.ip, destination.ip, destination.port

MITRE ICS: T1855 (Unauthorized Command Message), T1856 (Spoof Reporting Message), T1801 (Monitor Process State)

PEAK-Baseline-DNP3.ndjson

Protocol: DNP3 Session + Data Objects (Zeek dnp3.log + dnp3_objects.log) | Filter: tags:dnp3 or tags:dnp3_objects

Combined dashboard covering DNP3 session-level requests and data object detail. Common in electric utilities, water/wastewater, and oil & gas SCADA environments. Hunt surface: unauthorized master hosts sending READ requests, Class 0 polls from unknown hosts (full outstation data dump = recon), unusual object types being requested, anomalous function codes (COLD_RESTART, WARM_RESTART, STOP_APPLICATION). Pre-filtered panel for disruptive function codes. Pivot to DNP3 Control for relay command analysis.

Key fields: dnp3.fc_request (session), dnp3.function_code (objects), dnp3.object_type, source.ip, destination.ip

MITRE ICS: T1801 (Monitor Process State), T1846 (Remote System Discovery), T1814 (Denial of Service), T1858 (Change Operating Mode)

PEAK-Baseline-DNP3-Control.ndjson

Protocol: DNP3 Control Relay Commands (Zeek dnp3_control.log) | Filter: tags:dnp3_control

Highest-risk ICS dashboard in this collection. Every record represents a command to change the physical state of a field device (relay actuation, breaker open/close, valve command). Modeled on the DNP3 SELECT→OPERATE pattern used in real-world ICS attacks (see: 2015 Ukraine power grid attack).

Hunt surface: unauthorized commanding hosts (should be 1–2 known SCADA servers maximum), DIRECT_OPERATE commands (bypasses SELECT confirmation safety step), Trip/Close operations (breaker-level consequence), index numbers outside documented control point list, execute_count > 1 (repeated actuation), timing parameters outside operational norms.

Every record in this dashboard should be corroborated against authorized change management records.

Key fields: dnp3.function_code, dnp3.block_type, dnp3.operation_type, dnp3.trip_control_code, dnp3.index_number, dnp3.execute_count, dnp3.on_time, dnp3.off_time

MITRE ICS: T1855 (Unauthorized Command Message), T1831 (Manipulation of Control), T1836 (Modify Parameter), T1816 (Device Restart/Shutdown)

Dashboard Summary Table

Technical Details

Tested against: Security Onion 3.0.0
Elasticsearch version: 8.x
Kibana object format: Legacy aggregation-based visualizations (not Lens)
Index pattern: logs-*
Visualization types used: metric, table, line, pie, tagcloud, markdown, saved search
Object versioning: typeMigrationVersion: 8.5.0 (viz), 10.5.0 (search), 10.2.0 (dashboard) | coreMigrationVersion: 8.8.0

Field mappings were validated against live Elasticsearch data from Security Onion 3.0.0 imports. All fields used in visualizations are confirmed present in the indexed fields block of their respective data streams.

Suggested Hunt Workflow

1. Start with PEAK-Baseline-Conn  →  Establish overall network baseline, identify unknown talkers
2. Follow protocols of interest   →  Use protocol-specific dashboards for deep dives
3. Surface rare values            →  Least-frequent tables in each dashboard are your primary hunt targets
4. Pivot on findings              →  Use saved searches to drill to raw events
5. ICS environments               →  Run Modbus Summary → Modbus Detail → DNP3 → DNP3 Control
6. Alert triage                   →  Use Suricata dashboard: start with rare signatures, not top signatures

License

These dashboards are provided for defensive security operations use. Field mappings and design patterns are specific to Security Onion 3.0 with Zeek/Suricata. Adaptation may be required for other deployments.