KHIKA User Guide

Index

Accessing the KHIKA Gui

Login

Change the password

Creating a User Group

Creating a Workspace

Creating a new User

Access Control in KHIKA

Getting Data into KHIKA

Introduction

Data Flow and Components in KHIKA

KHIKA Apps

Importing an Application

Exporting an Application

Server monitoring in KHIKA using OSSEC

Installing OSSEC Agent for Linux

Installing OSSEC Agent for Windows

Configuring OSSEC Adapter in KHIKA

Adding the device in the Adaptor

Extract key from KHIKA OSSEC Server

Insert unique OSSEC key in Linux OSSEC Agent

Insert unique OSSEC key in Windows OSSEC Agent

Reload Configuration

Verifying OSSEC data collection

Troubleshooting

Monitoring in KHIKA using Syslog forwarding

Discover or Search Data in KHIKA

Introduction

Index Pattern

Setting the Time Filter

Searching Your Data

Lucene Query Syntax

Saving and Opening Searches

Changing the Index

Refreshing the Search Results

Filtering by Field

Managing Filters

Viewing Document Data

KHIKA Visualizations

What is a KHIKA Visualization?

Creating a Visualization

Examples of Visualization

Area Chart

Heat Map

Horizontal and Vertical Bar Chart

Line chart

Pie Chart

Data Table

Gauge

Goal

Metric

KHIKA Dashboards

Introduction

Creating a Dashboard

Editing Elements on a Dashboard

Viewing Visualization data on Dashboard

Searching / Filtering data on the dashboard

Steps for Adding a Filter on a Dashboard

Steps to Search and Save on a Dashboard

KHIKA Reports

Introduction

Adding a Report

Scheduling Reports

Generating KHIKA Report Manually

Report History

Downloading a Report

KHIKA Alerts & Correlations

Introduction

Alert Dashboard

Creating your own Alerts in KHIKA

Before creating an alert :

Creating a Simple Alert: Logon Failure on Windows

Slightly Advanced Alert: Multiple Logon failure on Windows for the same user

More Advanced Alert: 10 or more unique network connections for a windows host within 1 minute

Advanced Alert: A successful brute-force attack

Alert emails for Stakeholders

Working with KHIKA Adapters

Introduction

Adding Adapters

Searching Adapters

Assigning Data Aggregator Node to Adapters

Disabling Data Aggregator to Adapters

Modifying Adapters

Deleting Adapters

Writing your own Adaptor

Working with KHIKA Aggregators

Introduction

Adding New Data Aggregator

Assigning Data Aggregator Node to Workspace

Deleting Data Aggregator Node

Deleting Data Aggregator from Workspace

Assign Adapter to Data Aggregator

Disabling Adapter to Data Aggregator

KHIKA Workspaces

Introduction

Adding a Workspace

Suspending a Workspace

Resetting a Workspace

Applying Configuration to Workspace

Archiving a Workspace

Adding Data Aggregator to a Workspace

Adding Adapter to a Workspace

Defining and Configuring a Report

Deleting a Workspace

Refer the next section for Accessing the KHIKA Gui