HedgeHog Kiosk event.dataset viewer

[ee-hex-ee]

Is your feature request related to a problem? Please describe.
The kiosk mode of Hedgehog OS shows stats for disk and network usage among other items. It would be wonderful to know WHAT types of logs were being generated instead of just the size on disk.

Describe the solution you'd like
A panel or rotating datapoint that shows the top 3 event.dataset types to ensure that what is being written to conn is more than router solicitations or noise from potentially misconfigured port mirrors.

Describe alternatives you've considered
I cannot think of alternatives other than going to terminal and looking at what logs are written in the zeek directory anyway. The idea is to have a quick and reliable method to see what quality of PCAP/logs are being collected.

Additional context
Find me at my desk for any questions.

[mmguero]

So @ee-hex-ee do we want to show the top n most recently written Zeek log types? Or the top n Zeek log counts with the highest total counts?

[ee-hex-ee]

Great question. If I had to throw a concept I'd say top 5 logs overall and the count of logs for those. Just rotating to make sure capture isn't seeing just rstp or broadcast dhcp for misconfigured span ports.

Ie
Enip.log - 999,999
Cip.log - 999,998
Conn.log - 123,456
Dns.log - 7,890
Modbus.log - 5,432

[mmguero]

@ee-hex-ee thoughts on this?

[ee-hex-ee]

glorious

[mmguero]

Slightly better formatting, then calling this "good":