Implementation of Intrusion Detection System Using Snort and Log Visualization Using ELK Stack

Robbani, Fatih Dien
Haryatmi, Emy
Riyadi, Tri Agus
Supono, Riza Adrianti
Bima Kurniawan, Ary
Rosdiana, Rosdiana

International Journal of Engineering, Science and Information Technology
Vol 5, No 3 (2025)

Cyber threats like malware, ransomware, and DDoS attacks demand fast and integrated detection systems. Traditional network monitoring tools often struggle to identify complex real-time attack patterns. This study evaluates the integration of Snort, an Intrusion Detection System (IDS), with the ELK Stack (Elasticsearch, Logstash, Kibana) to detect and visualize cyberattacks effectively. The system was tested against three attack scenarios: a Windows ping flood, port scanning using Zenmap, and SSH brute force attacks via Nmap Scripting Engine (NSE). Wireshark was employed as a supporting tool to monitor raw network traffic. The results indicate that Snort detected all simulated attacks in real time, and the ELK Stack efficiently processed and visualized the alert data. However, limitations in Kibana's dashboard refresh rate slightly hindered real-time monitoring capabilities. Overall, the integration of Snort and the ELK Stack proves effective for network threat detection and analysis, with room for future improvements in visualization performance and automated response mechanisms.