Optimized ELK Stack Visualization for Hybrid Intrusion Detection: A Quantitative MITRE ATT&CK-Enriched CTI Dashboard

Yuri Ariyanto, Yan Watequlis Syaifudin¹, Pramana Yoga Saputra¹, Chandrasena Setiadi¹, Triana Fatmawati¹, Muhammad Iqbal Muhtaram¹

1. ¹ Politeknik Negeri Malang

Journal of Evrimata, 2026

This study presents an optimized ELK Stack (Elasticsearch, Logstash, Kibana) visualization integrating hybrid network- and host-based intrusion detection (Suricata, Wazuh) for operational Cyber Threat Intelligence decision support. The problem addressed is alert fatigue: analysts are overwhelmed by high-volume, unstructured logs lacking tactical context, forcing manual correlation and prioritization. A Logstash pipeline maps every alert to the MITRE ATT&CK framework, classifies indicators using the Pyramid of Pain, and computes a per-source priority score before events are indexed in Elasticsearch and displayed on a zero-query Kibana dashboard. Performance was evaluated across 90 controlled attack iterations covering Nmap scanning, Hydra brute force, and Nikto web scanning, using a rotating source-IP methodology. Results show consistent detection over 90 controlled attack iterations, with mean time-to-detect below one second in 0.70-0.93 s and an automated mean time-to-respond of 8.73 s for brute force and 1.63 s for web scanning with Wazuh active response. These results indicate that condensing raw events into prioritized, human-readable incidents lets analysts decide in seconds rather than manually triaging logs. The distinctive feature is direct integration of MITRE ATT&CK enrichment, Pyramid-of-Pain classification, and priority scoring into the visualization pipeline itself, rather than treating detection and context separately. The approach suits SOC teams already operating ELK-based monitoring who need to reduce alert fatigue and accelerate incident response without deploying additional detection engines.

DOI10.70822/journalofevrmata.vi.148Copy