diff --git a/.github/workflows/cluster.yml b/.github/workflows/cluster.yml index f30cfe81..5e26a671 100644 --- a/.github/workflows/cluster.yml +++ b/.github/workflows/cluster.yml @@ -1,10 +1,31 @@ name: Cluster Run - Minimega on: + pull_request: + # branches: + # - '*' workflow_dispatch: - # pull_request: - # branches: - # - '*' + inputs: + azure_region: + description: 'Azure region to deploy resources' + required: true + default: 'centralus' + type: choice + options: + - centralus + - eastus + - eastus2 + - westus + - westus2 + - westus3 + - northcentralus + - southcentralus + - canadacentral + - canadaeast + - uksouth + - ukwest + - northeurope + - westeurope jobs: build-and-test-cluster: @@ -84,7 +105,7 @@ jobs: -g pipe-${{ env.UNIQUE_ID }} \ -s ${{ env.IP_ADDRESS }}/32 \ -vs Standard_D8_v4 \ - -l centralus \ + -l ${{ inputs.azure_region || 'centralus' }} \ -ast 23:00 \ -y " @@ -199,7 +220,7 @@ jobs: # Retrieve policy ID POLICY_ID=$(docker compose -p ${{ env.UNIQUE_ID }} exec -T pipeline bash -c " ssh lme-user@${{ env.AZURE_IP }} ' - curl -k -s -u \"$ES_USERNAME:$ES_PASSWORD\" -X GET \"$KIBANA_URL/api/fleet/agent_policies\" \ + curl -kL -s -u \"$ES_USERNAME:$ES_PASSWORD\" -X GET \"$KIBANA_URL/api/fleet/agent_policies\" \ -H \"kbn-xsrf: true\" \ -H \"Content-Type: application/json\" | jq -r '.items[0].id' @@ -210,7 +231,7 @@ jobs: # Retrieve enrollment token using the policy ID ENROLLMENT_TOKEN=$(docker compose -p ${{ env.UNIQUE_ID }} exec -T pipeline bash -c " ssh lme-user@${{ env.AZURE_IP }} ' - curl -k -s -u \"$ES_USERNAME:$ES_PASSWORD\" -X POST \"$KIBANA_URL/api/fleet/enrollment-api-keys\" \ + curl -kL -s -u \"$ES_USERNAME:$ES_PASSWORD\" -X POST \"$KIBANA_URL/api/fleet/enrollment-api-keys\" \ -H \"kbn-xsrf: true\" \ -H \"Content-Type: application/json\" \ -d \"{\\\"policy_id\\\":\\\"$POLICY_ID\\\"}\" | diff --git a/.github/workflows/linux_only.yml b/.github/workflows/linux_only.yml index c5e5223e..90e24964 100644 --- a/.github/workflows/linux_only.yml +++ b/.github/workflows/linux_only.yml @@ -118,6 +118,7 @@ jobs: KIBANA_PASSWORD: ${{ env.KIBANA_PASSWORD }} AZURE_IP: ${{ env.AZURE_IP }} run: | + sleep 360 cd testing/v2/development docker compose -p ${{ env.UNIQUE_ID }} exec -T pipeline bash -c " cd /home/lme-user/LME/testing/v2/installers && \ diff --git a/ansible/post_install_local.yml b/ansible/post_install_local.yml index 94c11815..7c162ff7 100644 --- a/ansible/post_install_local.yml +++ b/ansible/post_install_local.yml @@ -7,7 +7,7 @@ vars: headers: - kbn-version: "8.12.2" + kbn-version: "8.15.3" kbn-xsrf: "kibana" Content-Type: "application/json" max_retries: 60 @@ -465,7 +465,7 @@ register: dashboards - name: Upload dashboards to Kibana - shell: 'curl -X POST -k --user "{{ elastic_username }}":"{{ elastic_password }}" -H "kbn-xsrf: true" -F file=@"{{ item }}" "{{ kibana_url }}"' + shell: 'curl -X POST -kL --user "{{ elastic_username }}":"{{ elastic_password }}" -H "kbn-xsrf: true" -F file=@"{{ item }}" "{{ kibana_url }}"' loop: "{{ dashboards.files | map(attribute='path') | list }}" args: warn: false @@ -610,7 +610,7 @@ register: dashboards - name: Upload dashboards to Kibana - shell: 'curl -X POST -k --user "{{ elastic_username }}":"{{ elastic_password }}" -H "kbn-xsrf: true" -F file=@"{{ item }}" "{{ kibana_url }}"' + shell: 'curl -X POST -kL --user "{{ elastic_username }}":"{{ elastic_password }}" -H "kbn-xsrf: true" -F file=@"{{ item }}" "{{ kibana_url }}"' args: warn: false loop: "{{ dashboards.files | map(attribute='path') | list }}" @@ -901,7 +901,7 @@ shell: > curl -X POST "{{ local_es_url }}/_security/user/readonly_user" -u "{{ elastic_username }}:{{ elastic_password }}" - -k + -kL -H "Content-Type: application/json" -d '{ "password": "{{ read_only_password.stdout }}", diff --git a/ansible/set_fleet.yml b/ansible/set_fleet.yml index d7839383..0df37356 100644 --- a/ansible/set_fleet.yml +++ b/ansible/set_fleet.yml @@ -6,7 +6,7 @@ vars: headers: - kbn-version: "8.12.2" + kbn-version: "8.15.3" kbn-xsrf: "kibana" Content-Type: "application/json" max_retries: 60 @@ -109,7 +109,7 @@ max_attempts=30 delay=10 while [ $attempt -lt $max_attempts ]; do - response=$(curl -s -o /dev/null -w "%{http_code}" -k -u elastic:{{ elastic_password }} {{ local_kbn_url }}/api/fleet/agents/setup) + response=$(curl -s -o /dev/null -w "%{http_code}" -kL -u elastic:{{ elastic_password }} {{ local_kbn_url }}/api/fleet/agents/setup) if [ "$response" = "200" ]; then echo "Fleet API is ready. Proceeding with configuration..." exit 0 diff --git a/config/containers.txt b/config/containers.txt index 609346cd..0c0d81f0 100644 --- a/config/containers.txt +++ b/config/containers.txt @@ -1,6 +1,6 @@ docker.io/caddy:2-alpine -docker.elastic.co/elasticsearch/elasticsearch:8.12.2 -docker.elastic.co/beats/elastic-agent:8.12.2 -docker.elastic.co/kibana/kibana:8.12.2 -docker.io/wazuh/wazuh-manager:4.7.5 +docker.elastic.co/elasticsearch/elasticsearch:8.15.3 +docker.elastic.co/beats/elastic-agent:8.15.3 +docker.elastic.co/kibana/kibana:8.15.3 +docker.io/wazuh/wazuh-manager:4.9.1 docker.io/jertel/elastalert2:2.20.0 diff --git a/config/elastalert2/misc/smtp_auth.yml b/config/elastalert2/misc/smtp_auth.yml new file mode 100644 index 00000000..8b56c138 --- /dev/null +++ b/config/elastalert2/misc/smtp_auth.yml @@ -0,0 +1,2 @@ +user: "loggingmadeeasy@gmail.com" +password: "giyq caym zqiw chje" #this is your app password if using gmail diff --git a/config/elastalert2/rules/example-email-rule.yml b/config/elastalert2/rules/example-email-rule.yml new file mode 100644 index 00000000..1b197e7a --- /dev/null +++ b/config/elastalert2/rules/example-email-rule.yml @@ -0,0 +1,21 @@ +name: EMAIL +type: frequency +index: wazuh-* +num_events: 1 +timeframe: + minutes: 1 +filter: +- query: + match_phrase: + agent.ip: "10.1.0.4" +alert: email +alert_text: "ASDFASDF" +alert_text_type: alert_text_only +email: + - "loggingmadeeasy@gmail.com" +smtp_ssl: true +smtp_port: 465 +smtp_host: "smtp.gmail.com" +from_addr: "elastalert@elastalert.com" +smtp_auth_file: /opt/elastalert/misc/smtp_auth.yml + diff --git a/config/example.env b/config/example.env index 892c546a..38879f2f 100644 --- a/config/example.env +++ b/config/example.env @@ -23,7 +23,7 @@ LOCAL_ES_URL=https://127.0.0.1:9200 ################# # Version of Elastic products -STACK_VERSION=8.12.2 +STACK_VERSION=8.15.3 # Testing pre-releases? Use the SNAPSHOT option below: # STACK_VERSION=8.11.0-SNAPSHOT # diff --git a/config/setup/acct-init.sh b/config/setup/acct-init.sh index 99e5b517..4eb3dfe2 100644 --- a/config/setup/acct-init.sh +++ b/config/setup/acct-init.sh @@ -15,7 +15,7 @@ if [ ! -f "${CERTS_DIR}/ACCOUNTS_CREATED" ]; then until curl -s --cacert config/certs/ca/ca.crt https://lme-elasticsearch:9200 | grep -q "missing authentication credentials"; do echo "WAITING"; sleep 30; done; echo "Setting kibana_system password"; - until curl -s -X POST --cacert config/certs/ca/ca.crt -u elastic:${ELASTIC_PASSWORD} -H "Content-Type: application/json" https://lme-elasticsearch:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 2; done; + until curl -L -s -X POST --cacert config/certs/ca/ca.crt -u elastic:${ELASTIC_PASSWORD} -H "Content-Type: application/json" https://lme-elasticsearch:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 2; done; echo "All done!" | tee "${CERTS_DIR}/ACCOUNTS_CREATED" ; fi diff --git a/config/wazuh_cluster/wazuh_manager.conf b/config/wazuh_cluster/wazuh_manager.conf index 694213da..1372aaf8 100644 --- a/config/wazuh_cluster/wazuh_manager.conf +++ b/config/wazuh_cluster/wazuh_manager.conf @@ -101,91 +101,26 @@ yes - - yes - 5m - 6h - yes - - - - yes - trusty - xenial - bionic - focal - jammy - 1h - - - - - no - buster - bullseye - bookworm - 1h - - - - - no - 5 - 6 - 7 - 8 - 9 - 1h - - - - - no - amazon-linux - amazon-linux-2 - amazon-linux-2022 - 1h - - - - - no - 11-server - 11-desktop - 12-server - 12-desktop - 15-server - 15-desktop - 1h - - - - - no - 1h - - - - - no - 8 - 9 - 1h - - - - - yes - 1h - + + yes + yes + 60m + - - - yes - 1h - - - + + yes + + + https://lme-elasticsearch:9200 + + + + /etc/wazuh-manager/certs/ca/ca.crt + + /etc/wazuh-manager/certs/wazuh-manager/wazuh-manager.crt + /etc/wazuh-manager/certs/wazuh-manager/wazuh-manager.key + + diff --git a/dashboard_refactor/export_dashboards.py b/dashboard_refactor/export_dashboards.py deleted file mode 100644 index 0c98119f..00000000 --- a/dashboard_refactor/export_dashboards.py +++ /dev/null @@ -1,171 +0,0 @@ -#!/usr/bin/env python3 -import argparse -import base64 -import json -import os -import re -import requests -from pathlib import Path -from urllib3.exceptions import InsecureRequestWarning - -# Suppress the InsecureRequestWarning (We are using a self-signed cert) -requests.packages.urllib3.disable_warnings(InsecureRequestWarning) - -ALL = 'all' - - -class Api: - def __init__(self, args): - self.ids = None - self.basic_auth = self.get_basic_auth(args.user, args.password) - self.root_url = f'https://{args.host}:{args.port}' - - def export_dashboards(self): - self.set_ids() - self.export_selected_dashboard(self.select_dashboard()) - - @staticmethod - def get_basic_auth(username, password): - return base64.b64encode(f"{username}:{password}".encode()).decode() - - def get_ids(self): - url = f'{self.root_url}/api/kibana/management/saved_objects/_find?perPage=500&page=1&type=dashboard&sortField=updated_at&sortOrder=desc' - - try: - response = requests.get(url, headers={'Authorization': f'Basic {self.basic_auth}'}, verify=False) - - if response.status_code == 200: - data = response.json() - #ids = {item['id']: item['meta']['title'] for item in data.get('saved_objects', [])} - #return ids - ids = { - item['id']: item['meta']['title'] - for item in data.get('saved_objects', []) - if '[' not in item['meta']['title'] and ']' not in item['meta']['title'] - } - return ids - else: - print(f"HTTP request failed with status code: {response.status_code}") - print(response.text) - return {} - except Exception as e: - print(f"An error occurred: {str(e)}") - return {} - - def set_ids(self, ids=None): - if ids is None: - ids = self.get_ids() - self.ids = ids - - def select_dashboard(self): - print("Please select a dashboard ID:") - item = 1 - choices = {} - - # Iterate through ids and display them with corresponding numbers - for this_id, title in self.ids.items(): - print(item, this_id, title) - choices[item] = this_id - item += 1 - - if item == 1: - print("I could not find any dashboards") - return - - choices[item] = ALL - print(item, "Select all dashboards") - - # Ask the user to select a number - while True: - try: - choice = int(input("Select a number: ")) - if choice in choices: - selected_id = choices[choice] - if selected_id == ALL: - return ALL # Return 'all' if the user selects all dashboards - else: - return selected_id # Return the selected dashboard ID - else: - print("Invalid choice. Please select a valid number.") - except ValueError: - print("Invalid input. Please enter a number.") - - def export_selected_dashboard(self, selected_dashboard): - if selected_dashboard == ALL: - print("You selected to export all dashboards") - self.dump_all_dashboards() - else: - print(f"You selected dashboard ID: {selected_dashboard}") - self.dump_dashboard(selected_dashboard) - - def dump_dashboard(self, selected_id): - print(f"Dumping dashboard: {selected_id}: {self.ids[selected_id]}...") - # Dumping dashboard: e5f203f0-6182-11ee-b035-d5f231e90733: User Security - - dashboard_json = self.get_dashboard_json(selected_id) - - if dashboard_json is not None: - script_dir = os.path.dirname(os.path.abspath(__file__)) - export_path = Path(script_dir) / 'exported' - os.makedirs(export_path, exist_ok=True) - - filename = re.sub(r"\W+", "_", self.ids[selected_id].lower()) + ".dumped.ndjson" - - print(f"Writing to file {filename}") - export_path = export_path / filename - - Api.write_to_file(export_path, dashboard_json) - return - - print("There was a problem dumping the dashboard") - - def dump_all_dashboards(self): - for this_id in self.ids: - self.dump_dashboard(this_id) - - def get_dashboard_json(self, selected_id): - url = f'{self.root_url}/api/saved_objects/_export' - data = { - "objects": [{"id": selected_id, "type": "dashboard"}], - "includeReferencesDeep": True - } - headers = { - "kbn-xsrf": "true", - 'Authorization': f'Basic {self.basic_auth}' - } - try: - response = requests.post(url, headers=headers, json=data, verify=False) - - if response.status_code == 200: - return response.text - else: - print(f"HTTP request failed with status code: {response.status_code}") - print(response.text) - return None - - except Exception as e: - print(f"An error occurred: {str(e)}") - return None - - @staticmethod - def write_to_file(filename, content): - with open(filename, 'wb') as file: - file.write(content.encode('utf-8')) - - -def main(): - # Define command-line arguments with defaults - parser = argparse.ArgumentParser(description='Retrieve IDs from Elasticsearch') - parser.add_argument('-u', '--user', required=True, help='Elasticsearch username') - parser.add_argument('-p', '--password', required=True, help='Elasticsearch password') - parser.add_argument('--host', default='localhost', help='Elasticsearch host (default: localhost)') - parser.add_argument('--port', default='443', help='Elasticsearch port (default: 443)') - args = parser.parse_args() - - api = Api(args) - - api.export_dashboards() - - -if __name__ == '__main__': - main() diff --git a/dashboard_refactor/needs_refactoring/Readme.md b/dashboard_refactor/needs_refactoring/Readme.md deleted file mode 100644 index afdcc412..00000000 --- a/dashboard_refactor/needs_refactoring/Readme.md +++ /dev/null @@ -1,64 +0,0 @@ -# Folder for all the dashboards - - -## How to update dashboards -To update the dashboards, run the following command from the Linux server: -``` -sudo /opt/lme/dashboard_update.sh -``` - -Note that there is also a `dashboard_update.sh` script within the Chapter 3 Files folder. That is a generic version of the script that is used to contruct the `dashboard_update.sh` script inside the /opt/lme folder. The version inside the Chapter 3 Files folder does **not** have the information needed to update the dashboards. Only the version inside the /opt/lme folder, which is customized to your specific installation of LME, should be run. - -### Updating to new dashboards and removing old ones (Starting with 1.1.0) -Browse to `Kibana->Stack Management` then select `Saved Objects`. -On the Saved Objects page, you can filter by dashboards. - -Select the filter `Type` and select `dashboard`. - -* It is suggested that you export the dashboards first (readme below) so you have a backup. -You can delete all of the dashboards before importing the new ones. - -After having backed up the dashboards and deleting them, you can then run -`dashboard_update.sh` in the `/opt/lme` directory. - - -### Exporting dashboards: -It is recommended that you export your dashboards before updating them, especially if you have customized them or created new ones. -To export the dashboards use the `export_dashboards.py` file in the Chapter 4 directory. -It is easiest to export them from the ubuntu machine where you have installed the ELK stack because the -default port and hostname are in the script. You will need the user and password for elastic that were printed -on your initial install. - -##### The files will be exported to `Chapter 4 Files/exported` - -#### Running on Ubuntu -Change to the `Chapter 4 Files` directory and run: -``` -./export_dashboards.py -u elastic -p YOURUNIQUEPASS -``` -The modules should already be installed on Ubuntu, but If the script complains about missing modules: -``` -pip install -r requirements.txt -``` - -#### Running on Windows -You must have python and the modules installed. (You can install python 3 from the Microsoft Store) Then make -sure you are in the `Chapter 4 Files` directory and install the requirements. -``` -pip install -r requirements.txt -``` - -You will probably have to pass the host that you connect to for kibana when running on windows. -``` -python .\export_dashboards.py -u elastic -p YOURUNIQUEPASS --host x.x.x.x -``` - -## Customizing dashboards: -When customizing dashboards keep in mind to be sure the name of the file does not conflict with one on git. In future iterations of LME, updates will overwrite any dashboard file that you have customized or named the same as an original file that appears in this directory. - -In addition, any other dashboards you want to save in git and track in this repository can maintained safely (assuming the new files do not overlap in name with any original file in LME) by doing the following: - 1. Creating your own local branch in this LME repo - 2. Commiting any changes - 3. pulling in changes from `main` to your local repo - - diff --git a/dashboard_refactor/needs_refactoring/alerting_dashboard.ndjson b/dashboard_refactor/needs_refactoring/alerting_dashboard.ndjson deleted file mode 100644 index 65049038..00000000 --- a/dashboard_refactor/needs_refactoring/alerting_dashboard.ndjson +++ /dev/null @@ -1,18 +0,0 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T12:04:55.244Z","version":"WzMwMSwxXQ=="} -{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable.text\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name.text\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","runtimeFieldMap":"{\"Column1\":{\"type\":\"keyword\",\"script\":{\"source\":\"if(doc['signal.status'].size() != 0) { if(doc['signal.status'].value.equals(\\\"open\\\")) { if(doc['event.code'].size() != 0) { if(doc['event.code'].value.equals(Integer.toString(1))) { if (doc['process.pid'].size() != 0) { emit (doc['process.pid'].value.toString()) } } else if(doc['event.code'].value.equals(Integer.toString(3))) { if (doc['destination.address'].size() != 0) { emit (doc['destination.address'].value.toString()) } } } emit (\\\"No Data\\\") } } emit (\\\"Signal Closed\\\")\"}},\"Column2\":{\"type\":\"keyword\",\"script\":{\"source\":\"if(doc['signal.status'].size() != 0) { if(doc['signal.status'].value.equals(\\\"open\\\")) { if(doc['event.code'].size() != 0) { if(doc['event.code'].value.equals(Integer.toString(1))) { def args = \\\"\\\"; if (doc['process.args'].size() != 0) { for(int i=0; i winlog.computer_name:(\\\\S+) > .*\\\").legend(position=ne)\",\"interval\":\"auto\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:14.768Z","id":"e48bf6f0-e90f-11e9-9070-f78ae052729a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:14.768Z","version":"WzIyNywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_types_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_types_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"|Logon Type|Logon Title|Description|\\n| :-: | :- | :- |\\n| 2 | Interactive | A user logged on to this computer. |\\n| 3 | Network | A user or computer logged on to this computer from the network. |\\n| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |\\n| 5 | Service | A service was started by the Service Control Manager. |\\n| 7 | Unlock | This workstation was unlocked. |\\n| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |\\n| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |\\n| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |\\n| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:14.768Z","id":"846ca470-e9ac-11e9-92c4-d918939a618e","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:14.768Z","version":"WzIyOCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_status_codes_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_codes_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.LogonType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.Status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.SubStatus\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:14.768Z","id":"43ef93b0-e9a9-11e9-92c4-d918939a618e","managed":false,"references":[{"id":"0b549610-e902-11e9-9070-f78ae052729a","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:14.768Z","version":"WzIyOSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_status_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"| Code | Description |\\n| :- | :- |\\n| 0XC000005E | There are currently no logon servers available to service the logon request. |\\n| 0xC0000064 | User logon with misspelled or bad user account |\\n| 0xC000006A | User logon with misspelled or bad password |\\n| 0XC000006D | This is either due to a bad username or authentication information |\\n| 0XC000006E | Unknown user name or bad password. |\\n| 0xC000006F | User logon outside authorized hours |\\n| 0xC0000070 | User logon from unauthorized workstation |\\n| 0xC0000071 | User logon with expired password |\\n| 0xC0000072 | User logon to account disabled by administrator |\\n| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |\\n| 0XC0000133 | Clocks between DC and other computer too far out of sync |\\n| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |\\n| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |\\n| 0XC0000192 | An attempt was made to logon, but the Netlogon service was not started. |\\n| 0xC0000193 | User logon with expired account |\\n| 0XC0000224 | User is required to change password at next logon |\\n| 0XC0000225 | Evidently a bug in Windows and not a risk |\\n| 0xC0000234 | User logon with account locked |\\n| 0XC00002EE | Failure Reason: An Error occurred during Logon |\\n| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |\\n| 0x0 | Status OK. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:14.768Z","id":"3690c770-e9ae-11e9-92c4-d918939a618e","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:14.768Z","version":"WzIzMCwxXQ=="} -{"attributes":{"columns":["host.name","winlog.event_data.SubjectUserName","winlog.event_data.TargetUserName","winlog.event_data.TargetServerName","winlog.event_data.SubjectDomainName","winlog.event_data.TargetDomainName","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4648 \",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"custom\",\"disabled\":false,\"negate\":false,\"alias\":null,\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[{\\\"script\\\":{\\\"script\\\":\\\"doc['winlog.event_data.SubjectUserName'].value != doc['winlog.event_data.TargetUserName'].value\\\"}}]}}\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"must\":[{\"script\":{\"script\":\"doc['winlog.event_data.SubjectUserName'].value != doc['winlog.event_data.TargetUserName'].value\"}}]}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"alias\":null,\"negate\":true,\"disabled\":false,\"type\":\"phrase\",\"key\":\"winlog.event_data.TargetDomainName\",\"params\":{\"query\":\"Window Manager\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"match_phrase\":{\"winlog.event_data.TargetDomainName\":\"Window Manager\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"alias\":null,\"negate\":true,\"disabled\":false,\"type\":\"phrase\",\"key\":\"winlog.event_data.TargetDomainName\",\"params\":{\"query\":\"Font Driver Host\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index\"},\"query\":{\"match_phrase\":{\"winlog.event_data.TargetDomainName\":\"Font Driver Host\"}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[],"timeRestore":false,"title":"srch_sd_security_4648_logon_explicit_creds_running_as_different_user","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:14.768Z","id":"103ccef0-ea73-11e9-be68-7f08998695a8","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:14.768Z","version":"WzIzMSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_logs_computernames_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Logged events\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"filters\",\"schema\":\"bucket\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_id : 4624\",\"language\":\"kuery\"},\"label\":\"EventID 4624\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":1000,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computername\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"vis_sd_security_logs_computernames_datatable\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:14.768Z","id":"1c4214a0-f0cf-11e9-a5fc-65ed253cef03","managed":false,"references":[{"id":"e30872f0-e698-11e9-8be5-cd86dcca33f3","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:14.768Z","version":"WzIzMiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T12:04:55.244Z","version":"WzMwMSwxXQ=="} -{"attributes":{"description":"Security log related events","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":24,\"h\":15,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security logs events\",\"panelRefName\":\"panel_1\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":134,\"w\":48,\"h\":17,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Process creation - event ID 4688\",\"panelRefName\":\"panel_2\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":109,\"w\":48,\"h\":8,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Log Cleared - event ID 1102 or 104\",\"panelRefName\":\"panel_3\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":151,\"w\":48,\"h\":18,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logon created - Logon type 2\",\"panelRefName\":\"panel_6\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":3,\"w\":24,\"h\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select a computer to filter the below results. Leave blank for all\",\"panelRefName\":\"panel_7\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":169,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - network logon created - Logon type 3\",\"panelRefName\":\"panel_8\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":117,\"w\":48,\"h\":17,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log events - Detail\",\"panelRefName\":\"panel_9\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":184,\"w\":48,\"h\":17,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - logon as a service - Logon type 5\",\"panelRefName\":\"panel_10\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":201,\"w\":48,\"h\":15,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Credential sent as clear text - Logon type 8\",\"panelRefName\":\"panel_11\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":18,\"w\":24,\"h\":15,\"i\":\"15\"},\"panelIndex\":\"15\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon attempts\",\"panelRefName\":\"panel_15\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":216,\"w\":48,\"h\":18,\"i\":\"19\"},\"panelIndex\":\"19\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logons with special privileges assigned - event ID 4672\",\"panelRefName\":\"panel_19\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":18,\"w\":24,\"h\":15,\"i\":\"20\"},\"panelIndex\":\"20\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Computers showing failed login attempts - 10 maximum shown\",\"panelRefName\":\"panel_20\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":33,\"w\":48,\"h\":18,\"i\":\"21\"},\"panelIndex\":\"21\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon type codes\",\"panelRefName\":\"panel_21\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":16,\"i\":\"22\"},\"panelIndex\":\"22\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon and reason (status code)\",\"panelRefName\":\"panel_22\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":83,\"w\":48,\"h\":26,\"i\":\"23\"},\"panelIndex\":\"23\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon status codes\",\"panelRefName\":\"panel_23\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":234,\"w\":48,\"h\":15,\"i\":\"28\"},\"panelIndex\":\"28\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"title\":\"Security log - Process started with different credentials- event ID 4648 [could be RUNAS, scheduled tasks]\",\"panelRefName\":\"panel_28\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":11,\"w\":24,\"h\":7,\"i\":\"30\"},\"panelIndex\":\"30\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"title\":\"Select a computername to filter\",\"panelRefName\":\"panel_30\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"b71dba65-ed1c-4917-9fc7-54923511ad2d\"},\"panelIndex\":\"b71dba65-ed1c-4917-9fc7-54923511ad2d\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b71dba65-ed1c-4917-9fc7-54923511ad2d\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":67,\"w\":48,\"h\":16,\"i\":\"96010259-5ae8-4632-bcce-34078573b1cd\"},\"panelIndex\":\"96010259-5ae8-4632-bcce-34078573b1cd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed Logons\",\"panelRefName\":\"panel_96010259-5ae8-4632-bcce-34078573b1cd\"}]","timeRestore":false,"title":"Security Dashboard - Security Log","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:14.768Z","id":"51186cd0-e8e9-11e9-9070-f78ae052729a","managed":false,"references":[{"id":"e5245110-e8e8-11e9-9070-f78ae052729a","name":"1:panel_1","type":"visualization"},{"id":"781b09e0-e8ea-11e9-9070-f78ae052729a","name":"2:panel_2","type":"search"},{"id":"8c100710-e8eb-11e9-9070-f78ae052729a","name":"3:panel_3","type":"search"},{"id":"0222a210-e8f0-11e9-9070-f78ae052729a","name":"6:panel_6","type":"visualization"},{"id":"5c6f40d0-e8f4-11e9-9070-f78ae052729a","name":"7:panel_7","type":"visualization"},{"id":"666027c0-e8f5-11e9-9070-f78ae052729a","name":"8:panel_8","type":"visualization"},{"id":"e30872f0-e698-11e9-8be5-cd86dcca33f3","name":"9:panel_9","type":"search"},{"id":"d99cb4d0-e8f8-11e9-9070-f78ae052729a","name":"10:panel_10","type":"visualization"},{"id":"80125e30-e900-11e9-9070-f78ae052729a","name":"11:panel_11","type":"visualization"},{"id":"fefc2830-e904-11e9-9070-f78ae052729a","name":"15:panel_15","type":"visualization"},{"id":"379f1cb0-e90a-11e9-9070-f78ae052729a","name":"19:panel_19","type":"visualization"},{"id":"e48bf6f0-e90f-11e9-9070-f78ae052729a","name":"20:panel_20","type":"visualization"},{"id":"846ca470-e9ac-11e9-92c4-d918939a618e","name":"21:panel_21","type":"visualization"},{"id":"43ef93b0-e9a9-11e9-92c4-d918939a618e","name":"22:panel_22","type":"visualization"},{"id":"3690c770-e9ae-11e9-92c4-d918939a618e","name":"23:panel_23","type":"visualization"},{"id":"103ccef0-ea73-11e9-be68-7f08998695a8","name":"28:panel_28","type":"search"},{"id":"1c4214a0-f0cf-11e9-a5fc-65ed253cef03","name":"30:panel_30","type":"visualization"},{"id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","name":"b71dba65-ed1c-4917-9fc7-54923511ad2d:panel_b71dba65-ed1c-4917-9fc7-54923511ad2d","type":"visualization"},{"id":"0b549610-e902-11e9-9070-f78ae052729a","name":"96010259-5ae8-4632-bcce-34078573b1cd:panel_96010259-5ae8-4632-bcce-34078573b1cd","type":"search"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-08-13T11:59:14.768Z","version":"WzIzNCwxXQ=="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":26,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboard_refactor/needs_refactoring/sysmon_summary.ndjson b/dashboard_refactor/needs_refactoring/sysmon_summary.ndjson deleted file mode 100644 index f1018c68..00000000 --- a/dashboard_refactor/needs_refactoring/sysmon_summary.ndjson +++ /dev/null @@ -1,11 +0,0 @@ -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"winlogbeat-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"68a051a0-1d7f-11e9-9fc5-a91039822035","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1NSwxXQ=="} -{"attributes":{"columns":["_source"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:\\\"Microsoft-Windows-Sysmon/Operational\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"title":"srch_sd_sysmon_all_events","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"8b6d5950-e5c8-11e9-8f1d-73a2ea4cc3ed","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzIzNiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"6bae6b40-e5cd-11e9-8f1d-73a2ea4cc3ed","managed":false,"references":[{"id":"8b6d5950-e5c8-11e9-8f1d-73a2ea4cc3ed","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzIzNywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":false,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":0},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"8fcbbf80-e5ca-11e9-8f1d-73a2ea4cc3ed","managed":false,"references":[{"id":"8b6d5950-e5c8-11e9-8f1d-73a2ea4cc3ed","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzIzOCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_datatable\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event code\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"fb34c760-e5cc-11e9-8f1d-73a2ea4cc3ed","managed":false,"references":[{"id":"8b6d5950-e5c8-11e9-8f1d-73a2ea4cc3ed","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzIzOSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_host_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_host_events_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Missing computer name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"split\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Missing computer name\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"4ff18f60-e5d0-11e9-8f1d-73a2ea4cc3ed","managed":false,"references":[{"id":"8b6d5950-e5c8-11e9-8f1d-73a2ea4cc3ed","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzI0MCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_event_code_reference","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| \\tEvent ID\\t | \\tEvent\\t | \\tDescription\\t |\\n| \\t:-:\\t | \\t:-\\t | \\t-\\t |\\n| \\t1\\t | \\tProcess creation\\t | \\tThe process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.\\t |\\n| \\t2\\t | \\tA process changed a file creation time\\t | \\tThe change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\\t |\\n| \\t3\\t | \\tNetwork connection\\t | \\tThe network connection event logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.\\t |\\n| \\t4\\t | \\tSysmon service state changed\\t | \\tThe service state change event reports the state of the Sysmon service (started or stopped).\\t |\\n| \\t5\\t | \\tProcess terminated\\t | \\tThe process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.\\t |\\n| \\t6\\t | \\tDriver loaded\\t | \\tThe driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.\\t |\\n| \\t7\\t | \\tImage loaded\\t | \\tThe image loaded event logs when a module is loaded in a specific process. This event is disabled by default and needs to be configured with the �l option. It indicates the process in which the module is loaded, hashes and signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading. This event should be configured carefully, as monitoring all image load events will generate a large number of events.\\t |\\n| \\t8\\t | \\tCreateRemoteThread\\t | \\tThe CreateRemoteThread event detects when a process creates a thread in another process. This technique is used by malware to inject code and hide in other processes. The event indicates the source and target process. It gives information on the code that will be run in the new thread: StartAddress, StartModule and StartFunction. Note that StartModule and StartFunction fields are inferred, they might be empty if the starting address is outside loaded modules or known exported functions.\\t |\\n| \\t9\\t | \\tRawAccessRead\\t | \\tThe RawAccessRead event detects when a process conducts reading operations from the drive using the \\\\\\\\\\\\\\\\.\\\\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.\\t |\\n| \\t10\\t | \\tProcessAccess\\t | \\tThe process accessed event reports when a process opens another process, an operation that�s often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks. Enabling it can generate significant amounts of logging if there are diagnostic utilities active that repeatedly open processes to query their state, so it generally should only be done so with filters that remove expected accesses.\\t |\\n| \\t11\\t | \\tFileCreate\\t | \\tFile create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.\\t |\\n| \\t12\\t | \\tRegistryEvent (Object create and delete)\\t | \\tRegistry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications. Sysmon uses abbreviated versions of Registry root key names, with the following mappings: |\\n|||**Key name**                                                                                          **Abbreviation**|\\n|||HKEY_LOCAL_MACHINE                                                                  HKLM|\\n|||HKEY_USERS                                                                                     HKU|\\n|||HKEY_LOCAL_MACHINE\\\\System\\\\ControlSet00x                          HKLM\\\\System\\\\CurrentControlSet|\\n|||HKEY_LOCAL_MACHINE\\\\Classes                                                    HKCR|\\n| \\t13\\t | \\tRegistryEvent (Value Set)\\t | \\tThis Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.\\t |\\n| \\t14\\t | \\tRegistryEvent (Key and Value Rename)\\t | \\tRegistry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.\\t |\\n| \\t15\\t | \\tFileCreateStreamHash\\t | \\tThis event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream. There are malware variants that drop their executables or configuration settings via browser downloads, and this event is aimed at capturing that based on the browser attaching a Zone.Identifier �mark of the web� stream.\\t |\\n| \\t16\\t | \\tServiceConfigurationChange\\t | \\tThis event logs changes in the Sysmon configuration - for example when the filtering rules are updated.\\t |\\n| \\t17\\t | \\tPipeEvent (Pipe Created)\\t | \\tThis event generates when a named pipe is created. Malware often uses named pipes for interprocess communication.\\t |\\n| \\t18\\t | \\tPipeEvent (Pipe Connected)\\t | \\tThis event logs when a named pipe connection is made between a client and a server.\\t |\\n| \\t19\\t | \\tWmiEvent (WmiEventFilter activity detected)\\t | \\tWhen a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.\\t |\\n| \\t20\\t | \\tWmiEvent (WmiEventConsumer activity detected)\\t | \\tThis event logs the registration of WMI consumers, recording the consumer name, log, and destination.\\t |\\n| \\t21\\t | \\tWmiEvent (WmiEventConsumerToFilter activity detected)\\t | \\tWhen a consumer binds to a filter, this event logs the consumer name and filter path.\\t |\\n| \\t22\\t | \\tDNSEvent (DNS query)\\t | \\tThis event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.\\t |\\n| \\t23\\t | \\tFileDelete (A file delete was detected)\\t | \\tA file was deleted.\\t |\\n| \\t24\\t | \\tClipboardChange (New content in the clipboard)\\t | \\tThis event is generated when the system clipboard contents change.\\t |\\n| \\t25\\t | \\tProcessTampering (Process image change)\\t | \\tThis event is generated when a process image is changed from an external source, such as a different process.\\t |\\n| \\t255\\t | \\tError\\t | \\tThis event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the Sysinternals forum or over Twitter (@markrussinovich).\\t |\\n\\nFor more information see *https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"title\":\"vis_sd_sysmon_event_code_reference\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"7d3955e0-e9b6-11e9-92c4-d918939a618e","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzI0MSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_events_by_computer_timelion","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_events_by_computer_timelion\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(q=winlog.provider_name:Microsoft-Windows-Sysmon, index=winlogbeat-*, split=winlog.computer_name:40).label(\\\"$1\\\",\\\"^.* > winlog.computer_name:(\\\\S+) > .*\\\").title(\\\"Sysmon events by computer\\\").legend(position=nw).yaxis(label=\\\"Number of events\\\")\",\"interval\":\"auto\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"35500920-eb66-11e9-875d-ef4cb6c5875d","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzI0MiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T12:04:55.244Z","version":"WzMwMSwxXQ=="} -{"attributes":{"description":"Summarizes collected Sysmon event data","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":24,\"h\":13,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Total number of Sysmon events found\",\"panelRefName\":\"panel_2\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":3,\"w\":24,\"h\":13,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"title\":\"Percentage of Sysmon events by event code\",\"panelRefName\":\"panel_3\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":16,\"w\":24,\"h\":18,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Count of Sysmon events by event code\",\"panelRefName\":\"panel_4\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":16,\"w\":24,\"h\":18,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"asc\"}}},\"enhancements\":{}},\"title\":\"Top 10 hosts generating the most Sysmon data\",\"panelRefName\":\"panel_5\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":34,\"w\":48,\"h\":21,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon event code reference\",\"panelRefName\":\"panel_7\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":55,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon events\",\"panelRefName\":\"panel_8\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"76bd58e2-b637-4a48-ae79-4ca8abeab308\"},\"panelIndex\":\"76bd58e2-b637-4a48-ae79-4ca8abeab308\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_76bd58e2-b637-4a48-ae79-4ca8abeab308\"}]","timeRestore":false,"title":"Sysmon Summary","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:15.791Z","id":"d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed","managed":false,"references":[{"id":"6bae6b40-e5cd-11e9-8f1d-73a2ea4cc3ed","name":"2:panel_2","type":"visualization"},{"id":"8fcbbf80-e5ca-11e9-8f1d-73a2ea4cc3ed","name":"3:panel_3","type":"visualization"},{"id":"fb34c760-e5cc-11e9-8f1d-73a2ea4cc3ed","name":"4:panel_4","type":"visualization"},{"id":"4ff18f60-e5d0-11e9-8f1d-73a2ea4cc3ed","name":"5:panel_5","type":"visualization"},{"id":"7d3955e0-e9b6-11e9-92c4-d918939a618e","name":"7:panel_7","type":"visualization"},{"id":"35500920-eb66-11e9-875d-ef4cb6c5875d","name":"8:panel_8","type":"visualization"},{"id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","name":"76bd58e2-b637-4a48-ae79-4ca8abeab308:panel_76bd58e2-b637-4a48-ae79-4ca8abeab308","type":"visualization"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-08-13T11:59:15.791Z","version":"WzI0NCwxXQ=="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":10,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboard_refactor/needs_refactoring/user_hr.ndjson b/dashboard_refactor/needs_refactoring/user_hr.ndjson deleted file mode 100644 index 0fa94ad2..00000000 --- a/dashboard_refactor/needs_refactoring/user_hr.ndjson +++ /dev/null @@ -1,10 +0,0 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T12:04:55.244Z","version":"WzMwMSwxXQ=="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"winlogbeat-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"68a051a0-1d7f-11e9-9fc5-a91039822035","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1NSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.event_data.TargetDomainName\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.event_data.TargetUserName\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"control_0_index_pattern","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1NiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - User activity title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - User activity title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## All user activity\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:16.817Z","id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:16.817Z","version":"WzI0OCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - Logon title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Logon title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Logon / Logoff events\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:16.817Z","id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:16.817Z","version":"WzI0OSwxXQ=="} -{"attributes":{"columns":["winlog.event_data.SubjectDomainName","winlog.event_data.TargetUserName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"user.name":{"width":193},"winlog.event_data.SubjectDomainName":{"width":193}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4624\\\" and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_data.LogonType\",\"value\":[\"2\",\"10\",\"11\",\"7\"],\"params\":[\"2\",\"10\",\"11\",\"7\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_data.LogonType\":\"2\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"10\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"11\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"7\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Interactive Logon search","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:16.817Z","id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:16.817Z","version":"WzI1MCwxXQ=="} -{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"winlog.event_data.TargetDomainName":{"width":241},"winlog.event_data.TargetUserName":{"width":241}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:\\\"4634\\\" OR event.code:\\\"4647\\\" ) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:16.817Z","id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:16.817Z","version":"WzI1MSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"HR - Interactive v Remote pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Interactive v Remote pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"label\":\"filters\",\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"segment\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_data.LogonType:2\",\"language\":\"lucene\"},\"label\":\"Interactive\"},{\"input\":{\"query\":\"winlog.event_data.LogonType:10\",\"language\":\"lucene\"},\"label\":\"RemoteInteractive\"}]}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:16.817Z","id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:16.817Z","version":"WzI1MiwxXQ=="} -{"attributes":{"description":"Overview of user activity for Human Resources\n","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"46f5e2d0-544b-4159-bf78-a44737a093cb\"},\"panelIndex\":\"46f5e2d0-544b-4159-bf78-a44737a093cb\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_46f5e2d0-544b-4159-bf78-a44737a093cb\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":16,\"h\":12,\"i\":\"bf3efd15-6e7c-4a6e-bb30-e7b759306282\"},\"panelIndex\":\"bf3efd15-6e7c-4a6e-bb30-e7b759306282\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select domain(s) and username(s)\",\"panelRefName\":\"panel_bf3efd15-6e7c-4a6e-bb30-e7b759306282\"},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":3,\"w\":15,\"h\":12,\"i\":\"9401acd4-64d2-484d-a0dc-2647cc626e56\"},\"panelIndex\":\"9401acd4-64d2-484d-a0dc-2647cc626e56\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"68a051a0-1d7f-11e9-9fc5-a91039822035\",\"name\":\"indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"accessors\":[\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"splitAccessor\":\"fc23a029-309e-40a7-aeca-309fd8423ced\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\":{\"columns\":{\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\":{\"label\":\"Top 5 values of winlog.event_data.SubjectDomainName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.SubjectDomainName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"fc23a029-309e-40a7-aeca-309fd8423ced\":{\"label\":\"Top 3 values of winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5a238afa-9ffa-4568-8a43-6167c0a76b67\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"fc23a029-309e-40a7-aeca-309fd8423ced\",\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Users\"},{\"type\":\"lens\",\"gridData\":{\"x\":31,\"y\":3,\"w\":17,\"h\":12,\"i\":\"84db1c16-9a85-4d7a-a4bb-7ee0eaa25c5c\"},\"panelIndex\":\"84db1c16-9a85-4d7a-a4bb-7ee0eaa25c5c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"68a051a0-1d7f-11e9-9fc5-a91039822035\",\"name\":\"indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"accessors\":[\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"position\":\"top\",\"seriesType\":\"bar\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"22b4e313-2858-411e-a90b-911198fa34fe\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\":{\"columns\":{\"22b4e313-2858-411e-a90b-911198fa34fe\":{\"label\":\"Top 5 values of winlog.computer_name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.computer_name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"22b4e313-2858-411e-a90b-911198fa34fe\",\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Computers\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":15,\"w\":48,\"h\":4,\"i\":\"04b8ad89-b259-4d40-a6f7-40bd85498ee5\"},\"panelIndex\":\"04b8ad89-b259-4d40-a6f7-40bd85498ee5\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_04b8ad89-b259-4d40-a6f7-40bd85498ee5\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":19,\"w\":24,\"h\":15,\"i\":\"bf9f9a7e-eced-42ad-9d72-193778290f71\"},\"panelIndex\":\"bf9f9a7e-eced-42ad-9d72-193778290f71\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"68a051a0-1d7f-11e9-9fc5-a91039822035\",\"name\":\"indexpattern-datasource-layer-6bfbd839-8497-464d-a473-26c01d5ba342\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"6bfbd839-8497-464d-a473-26c01d5ba342\",\"accessors\":[\"71b8b420-12e4-4dc5-bf20-933b0f4eb4e9\",\"bca165fa-40a3-4e7a-86bd-24ac4bbf6474\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6bfbd839-8497-464d-a473-26c01d5ba342\":{\"columns\":{\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"71b8b420-12e4-4dc5-bf20-933b0f4eb4e9\":{\"label\":\"Median of day_of_week\",\"dataType\":\"number\",\"operationType\":\"median\",\"sourceField\":\"day_of_week\",\"isBucketed\":false,\"scale\":\"ratio\",\"params\":{\"emptyAsNull\":true}},\"bca165fa-40a3-4e7a-86bd-24ac4bbf6474\":{\"label\":\"Median of hour_of_day\",\"dataType\":\"number\",\"operationType\":\"median\",\"sourceField\":\"hour_of_day\",\"isBucketed\":false,\"scale\":\"ratio\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\",\"71b8b420-12e4-4dc5-bf20-933b0f4eb4e9\",\"bca165fa-40a3-4e7a-86bd-24ac4bbf6474\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"All User Events by Day of Week, Hour of Day\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":19,\"w\":24,\"h\":15,\"i\":\"cbb939c6-5de5-478a-813f-fa5aabff530a\"},\"panelIndex\":\"cbb939c6-5de5-478a-813f-fa5aabff530a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"68a051a0-1d7f-11e9-9fc5-a91039822035\",\"name\":\"indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f46d1729-4bd5-4219-9973-01913c208fef\",\"accessors\":[\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f46d1729-4bd5-4219-9973-01913c208fef\":{\"columns\":{\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"800c3857-3c9c-4fc5-a403-3fcbede05599\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\",\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Timestamps by Count\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":34,\"w\":48,\"h\":4,\"i\":\"110dc89e-1139-438c-88a9-1914a7b12725\"},\"panelIndex\":\"110dc89e-1139-438c-88a9-1914a7b12725\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_110dc89e-1139-438c-88a9-1914a7b12725\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":38,\"w\":24,\"h\":15,\"i\":\"c28b411d-3dc3-472a-acd9-05ad0a1964b7\"},\"panelIndex\":\"c28b411d-3dc3-472a-acd9-05ad0a1964b7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logon events (filter by LogonId)\",\"panelRefName\":\"panel_c28b411d-3dc3-472a-acd9-05ad0a1964b7\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":38,\"w\":24,\"h\":15,\"i\":\"c3bc3c62-3c16-482c-b377-ecc40a21bc0a\"},\"panelIndex\":\"c3bc3c62-3c16-482c-b377-ecc40a21bc0a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logoff events (correlate to logon events)\",\"panelRefName\":\"panel_c3bc3c62-3c16-482c-b377-ecc40a21bc0a\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":53,\"w\":24,\"h\":15,\"i\":\"d40424ec-2e13-4d8c-a942-95652715c75f\"},\"panelIndex\":\"d40424ec-2e13-4d8c-a942-95652715c75f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"In person vs Remote logons\",\"panelRefName\":\"panel_d40424ec-2e13-4d8c-a942-95652715c75f\"}]","timeRestore":false,"title":"User HR","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T12:06:59.480Z","id":"618bc5d0-84f8-11ee-9838-ff0db128d8b2","managed":false,"references":[{"id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","name":"46f5e2d0-544b-4159-bf78-a44737a093cb:panel_46f5e2d0-544b-4159-bf78-a44737a093cb","type":"visualization"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"bf3efd15-6e7c-4a6e-bb30-e7b759306282:panel_bf3efd15-6e7c-4a6e-bb30-e7b759306282","type":"visualization"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"9401acd4-64d2-484d-a0dc-2647cc626e56:indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"84db1c16-9a85-4d7a-a4bb-7ee0eaa25c5c:indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2","type":"index-pattern"},{"id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","name":"04b8ad89-b259-4d40-a6f7-40bd85498ee5:panel_04b8ad89-b259-4d40-a6f7-40bd85498ee5","type":"visualization"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"bf9f9a7e-eced-42ad-9d72-193778290f71:indexpattern-datasource-layer-6bfbd839-8497-464d-a473-26c01d5ba342","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"cbb939c6-5de5-478a-813f-fa5aabff530a:indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef","type":"index-pattern"},{"id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","name":"110dc89e-1139-438c-88a9-1914a7b12725:panel_110dc89e-1139-438c-88a9-1914a7b12725","type":"visualization"},{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"c28b411d-3dc3-472a-acd9-05ad0a1964b7:panel_c28b411d-3dc3-472a-acd9-05ad0a1964b7","type":"search"},{"id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","name":"c3bc3c62-3c16-482c-b377-ecc40a21bc0a:panel_c3bc3c62-3c16-482c-b377-ecc40a21bc0a","type":"search"},{"id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","name":"d40424ec-2e13-4d8c-a942-95652715c75f:panel_d40424ec-2e13-4d8c-a942-95652715c75f","type":"visualization"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-08-13T12:06:59.480Z","version":"WzMxMSwxXQ=="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":9,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboard_refactor/needs_refactoring/user_security_logs_test.ndjson b/dashboard_refactor/needs_refactoring/user_security_logs_test.ndjson deleted file mode 100644 index bdee3273..00000000 --- a/dashboard_refactor/needs_refactoring/user_security_logs_test.ndjson +++ /dev/null @@ -1,39 +0,0 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T12:04:55.244Z","version":"WzMwMSwxXQ=="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"68a051a0-1d7f-11e9-9fc5-a91039822035","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1NSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.event_data.TargetDomainName\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.event_data.TargetUserName\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"control_0_index_pattern","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1NiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - Filter Hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Filter Hosts\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Event count\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Host name\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"8b7ff050-8ed4-11ea-904c-391ecaa2f2f4","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1NywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"Security - Select Host","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select Host\",\"type\":\"input_control_vis\",\"params\":{\"controls\":[{\"id\":\"1588685297382\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"53b65290-8ed4-11ea-904c-391ecaa2f2f4","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1OCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Logons Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logons Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Logons\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"d58b0380-8540-11ea-b6c5-5d9149593ce4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI1OSwxXQ=="} -{"attributes":{"columns":["_source"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":\"NT AUTHORITY, Window Manager, Font Driver Host\",\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"sort":[["@timestamp","desc"]],"title":"Human User Logon Events","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"dc42fc40-84a1-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2MCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon attempts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon attempts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Login attempts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"22170f50-853c-11ea-b6c5-5d9149593ce4","managed":false,"references":[{"id":"dc42fc40-84a1-11ea-b7fb-01bea49d9239","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2MSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon events over time","uiStateJSON":"{\"vis\":{\"colors\":{\"Failed attempts\":\"#BF1B00\",\"Successful atempts\":\"#629E51\"}}}","version":1,"visState":"{\"title\":\"Security - Logon events over time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":1,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-23T08:41:59.000Z\",\"max\":\"2020-04-23T08:56:59.000Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"event.code:4625\",\"language\":\"lucene\"},\"label\":\"Failed attempts\"},{\"input\":{\"query\":\"event.code:4624\",\"language\":\"lucene\"},\"label\":\"Successful atempts\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15m\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"c0c8b560-84a9-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"dc42fc40-84a1-11ea-b7fb-01bea49d9239","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2MiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4,624, 4,625\",\"params\":[\"4624\",\"4625\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}},{\"match_phrase\":{\"event.code\":\"4625\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Computers\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computer\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"489f7350-853d-11ea-b6c5-5d9149593ce4","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"dc42fc40-84a1-11ea-b7fb-01bea49d9239","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2MywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"a179afa0-853c-11ea-b6c5-5d9149593ce4","managed":false,"references":[{"id":"dc42fc40-84a1-11ea-b7fb-01bea49d9239","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2NCwxXQ=="} -{"attributes":{"columns":["event.code","host.name","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.IpAddress","event.action","event.outcome","winlog.event_data.LogonType"],"description":"","grid":{"columns":{"user.domain":{"width":119},"user.name":{"width":134}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human Logon & Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"2325be20-8616-11ea-a720-c7a0431f179d","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2NSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Network Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Network Connections\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"a1229110-860f-11ea-a720-c7a0431f179d","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2NiwxXQ=="} -{"attributes":{"columns":["_source"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id : \\\"3\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[]}"},"sort":[["@timestamp","desc"]],"title":"All network activity ","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"d1a74ce0-8641-11ea-907a-33d103156187","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2NywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Activity Line","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Activity Line\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Connections\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Connections\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Connections\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-24T15:29:10.918Z\",\"max\":\"2020-04-24T15:44:10.918Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"ec7ad2d0-8641-11ea-907a-33d103156187","managed":false,"references":[{"id":"d1a74ce0-8641-11ea-907a-33d103156187","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2OCwxXQ=="} -{"attributes":{"columns":["winlog.event_data.DestinationHostname","destination.ip","winlog.event_data.DestinationIsIpv6","network.","process.executable","winlog.event_data.DestinationPort","winlog.event_data.Protocol","winlog.user.name","winlog.user.type","source.ip","winlog.event_data.SourceIsIpv6","source.port","network.protocol"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[]}"},"sort":[["@timestamp","desc"]],"title":"srch_sd_non_browsers_connection","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"a0f75d50-e5e8-11e9-8f1d-73a2ea4cc3ed","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI2OSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Process List","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Network Process List\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.DestinationIp\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Destination IP\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":false,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logged on user\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":4,\"direction\":\"asc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"date\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"31a7d490-e677-11e9-8be5-cd86dcca33f3","managed":false,"references":[{"id":"a0f75d50-e5e8-11e9-8f1d-73a2ea4cc3ed","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3MCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network connections area ","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network connections area \",\"type\":\"area\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":false,\"type\":\"terms\",\"params\":{\"field\":\"network.protocol\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"labels\":{},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"3fb9dfd0-8887-11ea-99ef-bd4d29afe41e","managed":false,"references":[{"id":"a0f75d50-e5e8-11e9-8f1d-73a2ea4cc3ed","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3MSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Overview - Processes with unusual network activity","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Overview - Processes with unusual network activity\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"size\":10,\"include\":\"\",\"json\":\"\",\"customLabel\":\"Process\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"string\"},\"params\":{},\"label\":\"Process\",\"aggType\":\"significant_terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"245778d0-8641-11ea-907a-33d103156187","managed":false,"references":[{"id":"a0f75d50-e5e8-11e9-8f1d-73a2ea4cc3ed","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3MiwxXQ=="} -{"attributes":{"columns":["host.name","winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{"columns":{"winlog.event_data.SubjectDomainName":{"width":216}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_non_private_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"027102a0-e69f-11e9-8be5-cd86dcca33f3","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3MywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Processes Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Processes Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Processes & Powershell\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"813d18f0-8869-11ea-99ef-bd4d29afe41e","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3NCwxXQ=="} -{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.User","winlog.event_data.ProcessId","winlog.event_data.ProcessName","winlog.event_data.Hashes","process.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawns","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"ca56a030-8899-11ea-99ef-bd4d29afe41e","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3NSwxXQ=="} -{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.command_line","process.parent.executable","process.parent.command_line","file.path","event.code"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\" OR process.command_line.text:\\\"powershell\\\" OR parent.process.command_line.text:\\\"powershell\\\"\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[]}"},"sort":[["@timestamp","desc"]],"title":"srch_sd_powershell_run","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"2e276480-ec16-11e9-befc-81397a291157","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3NiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell Run Count","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Security - Powershell Run Count\",\"type\":\"metric\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"60553d40-ec18-11e9-befc-81397a291157","managed":false,"references":[{"id":"2e276480-ec16-11e9-befc-81397a291157","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3NywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell runs over time","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now/w\",\"to\":\"now/w\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}],\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\"},\"title\":\"Security - Powershell runs over time\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"bc2e06f0-8930-11ea-9bd8-f3fed1ec2140","managed":false,"references":[{"id":"2e276480-ec16-11e9-befc-81397a291157","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3OCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Power shell hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"title\":\"Security - Power shell hosts pie\",\"type\":\"pie\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"2b71e9f0-8931-11ea-9bd8-f3fed1ec2140","managed":false,"references":[{"id":"2e276480-ec16-11e9-befc-81397a291157","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI3OSwxXQ=="} -{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.args","process.parent.executable","process.parent.args"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND process.command_line.text:(\\\"invoke\\\" or \\\"bypass\\\" or \\\"iex\\\" or \\\"ex\\\" or \\\"icm\\\" or \\\"new-object\\\" or \\\"set\\\" or \\\"get\\\" or \\\"write\\\" or \\\"out\\\" or \\\"download\\\" or \\\"encoded\\\")\",\"language\":\"kuery\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[]}"},"sort":[["@timestamp","desc"]],"title":"Potentially Suspicious Powershell","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"ff5a53b0-ebf7-11e9-befc-81397a291157","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4MCwxXQ=="} -{"attributes":{"columns":["user.domain","user.name","host.name","destination.domain","destination.ip"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND (process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[]}"},"sort":[["@timestamp","desc"]],"title":"srch_uds_powershell_network","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"c97a71f0-8952-11ea-9bd8-f3fed1ec2140","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4MSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Files title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Files title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Files\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"404f6e60-895e-11ea-9bd8-f3fed1ec2140","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4MiwxXQ=="} -{"attributes":{"columns":["_source"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"file.path.text: \\\"tmp\\\" OR file.path.text:\\\"temp\\\"\",\"language\":\"kuery\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"file.path\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"exists\":{\"field\":\"file.path\"},\"$state\":{\"store\":\"appState\"}}]}"},"sort":[["@timestamp","desc"]],"title":"TEMP & %TEMP%","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"fbbf01c0-e697-11e9-8be5-cd86dcca33f3","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4MywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"TEMP & %TEMP%","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target File\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":30,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Hostname\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"TEMP & %TEMP%\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"1a0c4520-e698-11e9-8be5-cd86dcca33f3","managed":false,"references":[{"id":"fbbf01c0-e697-11e9-8be5-cd86dcca33f3","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4NCwxXQ=="} -{"attributes":{"columns":["@timestamp","user.domain","user.name","host.name","process.executable","winlog.event_data.ProcessId"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: \\\"9\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[]}"},"sort":[["@timestamp","desc"]],"title":"Raw Access Events","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"6b97d600-8960-11ea-9bd8-f3fed1ec2140","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4NSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Windows Defender Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Windows Defender Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Windows Defender\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"ebbab910-8960-11ea-9bd8-f3fed1ec2140","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4NiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:(1006 or 1007 or 1008 or 1009 or 1116 or 1117 or 1118 or 1119)\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - AV Events Count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - AV Events Count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Windows AV Events\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"4d08ec30-e5c1-11e9-ac01-d5832a8a14d8","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4NywxXQ=="} -{"attributes":{"columns":["_source"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_id\",\"value\":\"1,006, 1,007, 1,008, 1,009, 1,116, 1,117, 1,118, 1,119\",\"params\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"negate\":false,\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_id\":\"1006\"}},{\"match_phrase\":{\"winlog.event_id\":\"1007\"}},{\"match_phrase\":{\"winlog.event_id\":\"1008\"}},{\"match_phrase\":{\"winlog.event_id\":\"1009\"}},{\"match_phrase\":{\"winlog.event_id\":\"1116\"}},{\"match_phrase\":{\"winlog.event_id\":\"1117\"}},{\"match_phrase\":{\"winlog.event_id\":\"1118\"}},{\"match_phrase\":{\"winlog.event_id\":\"1119\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"title":"AV Detection event","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"3c3bc850-7bc7-11e9-b45c-ad49d0e60b5a","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4OCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"AV Hits (Count)","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"AV Hits (Count)\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"AV Detection hits\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"45277cd0-7bdf-11e9-b45c-ad49d0e60b5a","managed":false,"references":[{"id":"3c3bc850-7bc7-11e9-b45c-ad49d0e60b5a","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI4OSwxXQ=="} -{"attributes":{"columns":["winlog.event_data.Detection User","host.name","winlog.event_data.Path","winlog.event_data.FWLink"],"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: 1116\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[{\"meta\":{\"negate\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"Microsoft-Windows-Windows Defender\"},\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.provider\":{\"query\":\"Microsoft-Windows-Windows Defender\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}]}"},"sort":[["@timestamp","desc"]],"title":"Defender AV Detections","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"854e4470-8966-11ea-9bd8-f3fed1ec2140","managed":false,"references":[{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI5MCwxXQ=="} -{"attributes":{"description":"User Security overview, filtered by Domain / Username or hostname","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"cb956d23-9d5b-4af8-becf-a2d2d108b5f7\"},\"panelIndex\":\"cb956d23-9d5b-4af8-becf-a2d2d108b5f7\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_cb956d23-9d5b-4af8-becf-a2d2d108b5f7\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":23,\"h\":7,\"i\":\"d962c0d4-f80a-426c-9a1b-43e2fb6296f2\"},\"panelIndex\":\"d962c0d4-f80a-426c-9a1b-43e2fb6296f2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search users\",\"panelRefName\":\"panel_d962c0d4-f80a-426c-9a1b-43e2fb6296f2\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":23,\"y\":3,\"w\":25,\"h\":7,\"i\":\"b5483ec3-77b5-4e4c-b532-32ce796aa1de\"},\"panelIndex\":\"b5483ec3-77b5-4e4c-b532-32ce796aa1de\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Filter hosts\",\"panelRefName\":\"panel_b5483ec3-77b5-4e4c-b532-32ce796aa1de\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":10,\"w\":23,\"h\":7,\"i\":\"669e458b-ac6a-41d1-b3e2-945a0c8571bd\"},\"panelIndex\":\"669e458b-ac6a-41d1-b3e2-945a0c8571bd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search hosts\",\"panelRefName\":\"panel_669e458b-ac6a-41d1-b3e2-945a0c8571bd\"},{\"version\":\"8.9.0\",\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":10,\"w\":25,\"h\":7,\"i\":\"b693e539-d72a-496c-bbaf-31c22eeb78c2\"},\"panelIndex\":\"b693e539-d72a-496c-bbaf-31c22eeb78c2\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"68a051a0-1d7f-11e9-9fc5-a91039822035\",\"name\":\"indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\",\"isTransposed\":false},{\"columnId\":\"26752485-2aa5-4908-b400-504d6e7ef451\",\"isTransposed\":false}],\"layerId\":\"d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"layerType\":\"data\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d123adeb-fd39-4176-b3c9-69c88d2852d5\":{\"columns\":{\"6f33ff19-9959-4c43-b791-939582a0b3d2\":{\"label\":\"Event Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"26752485-2aa5-4908-b400-504d6e7ef451\":{\"label\":\"winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"26752485-2aa5-4908-b400-504d6e7ef451\",\"6f33ff19-9959-4c43-b791-939582a0b3d2\"],\"sampling\":1,\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{},\"type\":\"lens\"},\"title\":\"Filter users\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":17,\"w\":48,\"h\":4,\"i\":\"0eb6fcd2-cd91-4c3e-b652-4f06922da3ae\"},\"panelIndex\":\"0eb6fcd2-cd91-4c3e-b652-4f06922da3ae\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0eb6fcd2-cd91-4c3e-b652-4f06922da3ae\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":9,\"h\":7,\"i\":\"2281ee7a-a6bd-4d4e-8ced-3c594acfdd3f\"},\"panelIndex\":\"2281ee7a-a6bd-4d4e-8ced-3c594acfdd3f\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_2281ee7a-a6bd-4d4e-8ced-3c594acfdd3f\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":9,\"y\":21,\"w\":20,\"h\":14,\"i\":\"13240516-125d-434d-8929-d9a334308aa6\"},\"panelIndex\":\"13240516-125d-434d-8929-d9a334308aa6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logon attempts\",\"panelRefName\":\"panel_13240516-125d-434d-8929-d9a334308aa6\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":29,\"y\":21,\"w\":19,\"h\":14,\"i\":\"4b488bfa-a881-46c9-933b-ed762dfb6884\"},\"panelIndex\":\"4b488bfa-a881-46c9-933b-ed762dfb6884\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logged on computers\",\"panelRefName\":\"panel_4b488bfa-a881-46c9-933b-ed762dfb6884\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":28,\"w\":9,\"h\":7,\"i\":\"1d6bc214-21e6-4f94-b4df-94585768f0d1\"},\"panelIndex\":\"1d6bc214-21e6-4f94-b4df-94585768f0d1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_1d6bc214-21e6-4f94-b4df-94585768f0d1\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":17,\"i\":\"5db1345f-28a0-43fd-9cd2-d51e9349cfad\"},\"panelIndex\":\"5db1345f-28a0-43fd-9cd2-d51e9349cfad\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User Logon & Logoff Events\",\"panelRefName\":\"panel_5db1345f-28a0-43fd-9cd2-d51e9349cfad\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":52,\"w\":48,\"h\":4,\"i\":\"dc8de60f-b44b-4e88-9f4c-603ebc8be78b\"},\"panelIndex\":\"dc8de60f-b44b-4e88-9f4c-603ebc8be78b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_dc8de60f-b44b-4e88-9f4c-603ebc8be78b\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":56,\"w\":48,\"h\":14,\"i\":\"3b38696a-cc17-47fb-91f4-96884a7262de\"},\"panelIndex\":\"3b38696a-cc17-47fb-91f4-96884a7262de\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"All network connections\",\"panelRefName\":\"panel_3b38696a-cc17-47fb-91f4-96884a7262de\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":70,\"w\":24,\"h\":15,\"i\":\"85d08841-be8d-45e6-8d57-e79d3e63b315\"},\"panelIndex\":\"85d08841-be8d-45e6-8d57-e79d3e63b315\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}},\"enhancements\":{}},\"title\":\"Network connections from non-browser processes\",\"panelRefName\":\"panel_85d08841-be8d-45e6-8d57-e79d3e63b315\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":70,\"w\":24,\"h\":15,\"i\":\"8053a0e5-33e4-46d0-adcc-5baa505a07e4\"},\"panelIndex\":\"8053a0e5-33e4-46d0-adcc-5baa505a07e4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network connection by protocol\",\"panelRefName\":\"panel_8053a0e5-33e4-46d0-adcc-5baa505a07e4\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":85,\"w\":48,\"h\":15,\"i\":\"d6e81b2b-664b-480d-9e79-0146110b5b40\"},\"panelIndex\":\"d6e81b2b-664b-480d-9e79-0146110b5b40\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Unusual network connections from non-browser processes\",\"panelRefName\":\"panel_d6e81b2b-664b-480d-9e79-0146110b5b40\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":100,\"w\":48,\"h\":10,\"i\":\"cf6d87aa-3642-443d-8535-ffc445bb0de8\"},\"panelIndex\":\"cf6d87aa-3642-443d-8535-ffc445bb0de8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network Connection Events (Sysmon ID 3)\",\"panelRefName\":\"panel_cf6d87aa-3642-443d-8535-ffc445bb0de8\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":110,\"w\":48,\"h\":4,\"i\":\"e7d0f621-25db-4fc2-b342-de3356d27d22\"},\"panelIndex\":\"e7d0f621-25db-4fc2-b342-de3356d27d22\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_e7d0f621-25db-4fc2-b342-de3356d27d22\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":114,\"w\":48,\"h\":14,\"i\":\"8dba12cb-b13b-4885-be71-4f0b80b741a1\"},\"panelIndex\":\"8dba12cb-b13b-4885-be71-4f0b80b741a1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Spawned Processes\",\"panelRefName\":\"panel_8dba12cb-b13b-4885-be71-4f0b80b741a1\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":128,\"w\":10,\"h\":15,\"i\":\"d91877f5-6b32-4f10-b31c-a7dfc609b37e\"},\"panelIndex\":\"d91877f5-6b32-4f10-b31c-a7dfc609b37e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell Events\",\"panelRefName\":\"panel_d91877f5-6b32-4f10-b31c-a7dfc609b37e\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":10,\"y\":128,\"w\":20,\"h\":15,\"i\":\"57e03c45-07da-4b09-84ad-8f536cbdbb58\"},\"panelIndex\":\"57e03c45-07da-4b09-84ad-8f536cbdbb58\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events over time\",\"panelRefName\":\"panel_57e03c45-07da-4b09-84ad-8f536cbdbb58\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":30,\"y\":128,\"w\":18,\"h\":15,\"i\":\"6286154f-2b14-43a6-a3a5-9e85cf465162\"},\"panelIndex\":\"6286154f-2b14-43a6-a3a5-9e85cf465162\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events by computer\",\"panelRefName\":\"panel_6286154f-2b14-43a6-a3a5-9e85cf465162\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":143,\"w\":25,\"h\":16,\"i\":\"376ac409-1f80-4cc4-a94f-71431233ffc1\"},\"panelIndex\":\"376ac409-1f80-4cc4-a94f-71431233ffc1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Potentially suspicious powershell\",\"panelRefName\":\"panel_376ac409-1f80-4cc4-a94f-71431233ffc1\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":25,\"y\":143,\"w\":23,\"h\":16,\"i\":\"570dff9d-ac96-4d3b-a4f3-a81e09fce159\"},\"panelIndex\":\"570dff9d-ac96-4d3b-a4f3-a81e09fce159\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell network connections\",\"panelRefName\":\"panel_570dff9d-ac96-4d3b-a4f3-a81e09fce159\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":159,\"w\":48,\"h\":4,\"i\":\"fb24e6b0-f665-4798-8540-31d38b4b78cb\"},\"panelIndex\":\"fb24e6b0-f665-4798-8540-31d38b4b78cb\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_fb24e6b0-f665-4798-8540-31d38b4b78cb\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":163,\"w\":24,\"h\":15,\"i\":\"f0f11bc0-5607-4a3b-b4a4-4d8500c62c0a\"},\"panelIndex\":\"f0f11bc0-5607-4a3b-b4a4-4d8500c62c0a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"References to temporary files\",\"panelRefName\":\"panel_f0f11bc0-5607-4a3b-b4a4-4d8500c62c0a\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":163,\"w\":24,\"h\":15,\"i\":\"5b06e280-9804-408b-b8c5-c75f21bb7d00\"},\"panelIndex\":\"5b06e280-9804-408b-b8c5-c75f21bb7d00\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"RawAccessRead (Sysmon Event 9)\",\"panelRefName\":\"panel_5b06e280-9804-408b-b8c5-c75f21bb7d00\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":178,\"w\":48,\"h\":4,\"i\":\"05382728-1306-4e59-b08e-d899afdf22b3\"},\"panelIndex\":\"05382728-1306-4e59-b08e-d899afdf22b3\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_05382728-1306-4e59-b08e-d899afdf22b3\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":182,\"w\":12,\"h\":14,\"i\":\"ba231616-e45f-4299-87a6-56f785c53354\"},\"panelIndex\":\"ba231616-e45f-4299-87a6-56f785c53354\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Defender event count\",\"panelRefName\":\"panel_ba231616-e45f-4299-87a6-56f785c53354\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":12,\"y\":182,\"w\":12,\"h\":14,\"i\":\"9d149e7a-8cd7-4a4e-bbed-e4d2ca6e2931\"},\"panelIndex\":\"9d149e7a-8cd7-4a4e-bbed-e4d2ca6e2931\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_9d149e7a-8cd7-4a4e-bbed-e4d2ca6e2931\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":182,\"w\":24,\"h\":14,\"i\":\"af3a8a33-8efa-422f-b024-f2c4a158586f\"},\"panelIndex\":\"af3a8a33-8efa-422f-b024-f2c4a158586f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"AV Detections (Event 1116)\",\"panelRefName\":\"panel_af3a8a33-8efa-422f-b024-f2c4a158586f\"}]","timeRestore":false,"title":"User Security","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-08-13T11:59:17.815Z","id":"e5f203f0-6182-11ee-b035-d5f231e90733","managed":false,"references":[{"id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","name":"cb956d23-9d5b-4af8-becf-a2d2d108b5f7:panel_cb956d23-9d5b-4af8-becf-a2d2d108b5f7","type":"visualization"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"d962c0d4-f80a-426c-9a1b-43e2fb6296f2:panel_d962c0d4-f80a-426c-9a1b-43e2fb6296f2","type":"visualization"},{"id":"8b7ff050-8ed4-11ea-904c-391ecaa2f2f4","name":"b5483ec3-77b5-4e4c-b532-32ce796aa1de:panel_b5483ec3-77b5-4e4c-b532-32ce796aa1de","type":"visualization"},{"id":"53b65290-8ed4-11ea-904c-391ecaa2f2f4","name":"669e458b-ac6a-41d1-b3e2-945a0c8571bd:panel_669e458b-ac6a-41d1-b3e2-945a0c8571bd","type":"visualization"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"b693e539-d72a-496c-bbaf-31c22eeb78c2:indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5","type":"index-pattern"},{"id":"d58b0380-8540-11ea-b6c5-5d9149593ce4","name":"0eb6fcd2-cd91-4c3e-b652-4f06922da3ae:panel_0eb6fcd2-cd91-4c3e-b652-4f06922da3ae","type":"visualization"},{"id":"22170f50-853c-11ea-b6c5-5d9149593ce4","name":"2281ee7a-a6bd-4d4e-8ced-3c594acfdd3f:panel_2281ee7a-a6bd-4d4e-8ced-3c594acfdd3f","type":"visualization"},{"id":"c0c8b560-84a9-11ea-b7fb-01bea49d9239","name":"13240516-125d-434d-8929-d9a334308aa6:panel_13240516-125d-434d-8929-d9a334308aa6","type":"visualization"},{"id":"489f7350-853d-11ea-b6c5-5d9149593ce4","name":"4b488bfa-a881-46c9-933b-ed762dfb6884:panel_4b488bfa-a881-46c9-933b-ed762dfb6884","type":"visualization"},{"id":"a179afa0-853c-11ea-b6c5-5d9149593ce4","name":"1d6bc214-21e6-4f94-b4df-94585768f0d1:panel_1d6bc214-21e6-4f94-b4df-94585768f0d1","type":"visualization"},{"id":"2325be20-8616-11ea-a720-c7a0431f179d","name":"5db1345f-28a0-43fd-9cd2-d51e9349cfad:panel_5db1345f-28a0-43fd-9cd2-d51e9349cfad","type":"search"},{"id":"a1229110-860f-11ea-a720-c7a0431f179d","name":"dc8de60f-b44b-4e88-9f4c-603ebc8be78b:panel_dc8de60f-b44b-4e88-9f4c-603ebc8be78b","type":"visualization"},{"id":"ec7ad2d0-8641-11ea-907a-33d103156187","name":"3b38696a-cc17-47fb-91f4-96884a7262de:panel_3b38696a-cc17-47fb-91f4-96884a7262de","type":"visualization"},{"id":"31a7d490-e677-11e9-8be5-cd86dcca33f3","name":"85d08841-be8d-45e6-8d57-e79d3e63b315:panel_85d08841-be8d-45e6-8d57-e79d3e63b315","type":"visualization"},{"id":"3fb9dfd0-8887-11ea-99ef-bd4d29afe41e","name":"8053a0e5-33e4-46d0-adcc-5baa505a07e4:panel_8053a0e5-33e4-46d0-adcc-5baa505a07e4","type":"visualization"},{"id":"245778d0-8641-11ea-907a-33d103156187","name":"d6e81b2b-664b-480d-9e79-0146110b5b40:panel_d6e81b2b-664b-480d-9e79-0146110b5b40","type":"visualization"},{"id":"027102a0-e69f-11e9-8be5-cd86dcca33f3","name":"cf6d87aa-3642-443d-8535-ffc445bb0de8:panel_cf6d87aa-3642-443d-8535-ffc445bb0de8","type":"search"},{"id":"813d18f0-8869-11ea-99ef-bd4d29afe41e","name":"e7d0f621-25db-4fc2-b342-de3356d27d22:panel_e7d0f621-25db-4fc2-b342-de3356d27d22","type":"visualization"},{"id":"ca56a030-8899-11ea-99ef-bd4d29afe41e","name":"8dba12cb-b13b-4885-be71-4f0b80b741a1:panel_8dba12cb-b13b-4885-be71-4f0b80b741a1","type":"search"},{"id":"60553d40-ec18-11e9-befc-81397a291157","name":"d91877f5-6b32-4f10-b31c-a7dfc609b37e:panel_d91877f5-6b32-4f10-b31c-a7dfc609b37e","type":"visualization"},{"id":"bc2e06f0-8930-11ea-9bd8-f3fed1ec2140","name":"57e03c45-07da-4b09-84ad-8f536cbdbb58:panel_57e03c45-07da-4b09-84ad-8f536cbdbb58","type":"visualization"},{"id":"2b71e9f0-8931-11ea-9bd8-f3fed1ec2140","name":"6286154f-2b14-43a6-a3a5-9e85cf465162:panel_6286154f-2b14-43a6-a3a5-9e85cf465162","type":"visualization"},{"id":"ff5a53b0-ebf7-11e9-befc-81397a291157","name":"376ac409-1f80-4cc4-a94f-71431233ffc1:panel_376ac409-1f80-4cc4-a94f-71431233ffc1","type":"search"},{"id":"c97a71f0-8952-11ea-9bd8-f3fed1ec2140","name":"570dff9d-ac96-4d3b-a4f3-a81e09fce159:panel_570dff9d-ac96-4d3b-a4f3-a81e09fce159","type":"search"},{"id":"404f6e60-895e-11ea-9bd8-f3fed1ec2140","name":"fb24e6b0-f665-4798-8540-31d38b4b78cb:panel_fb24e6b0-f665-4798-8540-31d38b4b78cb","type":"visualization"},{"id":"1a0c4520-e698-11e9-8be5-cd86dcca33f3","name":"f0f11bc0-5607-4a3b-b4a4-4d8500c62c0a:panel_f0f11bc0-5607-4a3b-b4a4-4d8500c62c0a","type":"visualization"},{"id":"6b97d600-8960-11ea-9bd8-f3fed1ec2140","name":"5b06e280-9804-408b-b8c5-c75f21bb7d00:panel_5b06e280-9804-408b-b8c5-c75f21bb7d00","type":"search"},{"id":"ebbab910-8960-11ea-9bd8-f3fed1ec2140","name":"05382728-1306-4e59-b08e-d899afdf22b3:panel_05382728-1306-4e59-b08e-d899afdf22b3","type":"visualization"},{"id":"4d08ec30-e5c1-11e9-ac01-d5832a8a14d8","name":"ba231616-e45f-4299-87a6-56f785c53354:panel_ba231616-e45f-4299-87a6-56f785c53354","type":"visualization"},{"id":"45277cd0-7bdf-11e9-b45c-ad49d0e60b5a","name":"9d149e7a-8cd7-4a4e-bbed-e4d2ca6e2931:panel_9d149e7a-8cd7-4a4e-bbed-e4d2ca6e2931","type":"visualization"},{"id":"854e4470-8966-11ea-9bd8-f3fed1ec2140","name":"af3a8a33-8efa-422f-b024-f2c4a158586f:panel_af3a8a33-8efa-422f-b024-f2c4a158586f","type":"search"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-08-13T11:59:17.815Z","version":"WzI5MSwxXQ=="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":38,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboard_refactor/refactored/Alerting Dashboard 2.0.ndjson b/dashboard_refactor/refactored/Alerting Dashboard 2.0.ndjson deleted file mode 100644 index 58f3d83a..00000000 --- a/dashboard_refactor/refactored/Alerting Dashboard 2.0.ndjson +++ /dev/null @@ -1,22 +0,0 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:11:26.658Z","id":"5eea1399-b3f9-4413-9790-7bd5f75ed5f1","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T15:11:26.658Z","version":"WzI0ODgsMV0="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:11:26.658Z","id":"c25323e4-7499-4278-b64f-842597921b1e","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T15:11:26.658Z","version":"WzI0ODksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Tags Controls","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Tags Controls\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588260438304\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Tags\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:11:26.658Z","id":"52e59d99-4f20-4784-8bcc-00eee6b867f5","managed":false,"references":[{"id":"c25323e4-7499-4278-b64f-842597921b1e","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T15:11:26.658Z","version":"WzI0OTAsMV0="} -{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable.text\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name.text\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","runtimeFieldMap":"{\"Column1\":{\"type\":\"keyword\",\"script\":{\"source\":\"if(doc['signal.status'].size() != 0) { if(doc['signal.status'].value.equals(\\\"open\\\")) { if(doc['event.code'].size() != 0) { if(doc['event.code'].value.equals(Integer.toString(1))) { if (doc['process.pid'].size() != 0) { emit (doc['process.pid'].value.toString()) } } else if(doc['event.code'].value.equals(Integer.toString(3))) { if (doc['destination.address'].size() != 0) { emit (doc['destination.address'].value.toString()) } } } emit (\\\"No Data\\\") } } emit (\\\"Signal Closed\\\")\"}},\"Column2\":{\"type\":\"keyword\",\"script\":{\"source\":\"if(doc['signal.status'].size() != 0) { if(doc['signal.status'].value.equals(\\\"open\\\")) { if(doc['event.code'].size() != 0) { if(doc['event.code'].value.equals(Integer.toString(1))) { def args = \\\"\\\"; if (doc['process.args'].size() != 0) { for(int i=0; i winlog.computer_name:(\\\\S+) > .*\\\").title(\\\"Sysmon events by computer\\\").legend(position=nw).yaxis(label=\\\"Number of events\\\")\",\"interval\":\"auto\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"c1138577-9732-431b-8584-fbf5a7e333cf","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NDksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"21ac13ec-ac49-42f0-94ab-1075ca23e3e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NTAsMV0="} -{"attributes":{"description":"Summarizes collected Sysmon event data","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":24,\"h\":13,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Total number of Sysmon events found\",\"panelRefName\":\"panel_2\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":3,\"w\":24,\"h\":13,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"title\":\"Percentage of Sysmon events by event code\",\"panelRefName\":\"panel_3\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":16,\"w\":24,\"h\":18,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Count of Sysmon events by event code\",\"panelRefName\":\"panel_4\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":16,\"w\":24,\"h\":18,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"asc\"}}},\"enhancements\":{}},\"title\":\"Top 10 hosts generating the most Sysmon data\",\"panelRefName\":\"panel_5\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":34,\"w\":48,\"h\":21,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon event code reference\",\"panelRefName\":\"panel_7\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":55,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon events\",\"panelRefName\":\"panel_8\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"76bd58e2-b637-4a48-ae79-4ca8abeab308\"},\"panelIndex\":\"76bd58e2-b637-4a48-ae79-4ca8abeab308\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_76bd58e2-b637-4a48-ae79-4ca8abeab308\"}]","timeRestore":false,"title":"Sysmon Summary","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"newdashboard","managed":false,"references":[{"id":"b7fe57cb-6119-4ba8-b169-63cdf51d8d31","name":"2:panel_2","type":"visualization"},{"id":"7c60b9ca-af8f-4563-8719-099c16c0020a","name":"3:panel_3","type":"visualization"},{"id":"875432d0-510b-4d4c-a77d-563e1bd70a62","name":"4:panel_4","type":"visualization"},{"id":"34250ab9-39e2-4601-8aa5-3d047b43c632","name":"5:panel_5","type":"visualization"},{"id":"2f1ca8e2-75c0-4f84-b0f1-192d2bff49c0","name":"7:panel_7","type":"visualization"},{"id":"c1138577-9732-431b-8584-fbf5a7e333cf","name":"8:panel_8","type":"visualization"},{"id":"21ac13ec-ac49-42f0-94ab-1075ca23e3e5","name":"76bd58e2-b637-4a48-ae79-4ca8abeab308:panel_76bd58e2-b637-4a48-ae79-4ca8abeab308","type":"visualization"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NTEsMV0="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":10,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboard_refactor/refactored/User HR 2.0.ndjson b/dashboard_refactor/refactored/User HR 2.0.ndjson deleted file mode 100644 index 1da0f9c7..00000000 --- a/dashboard_refactor/refactored/User HR 2.0.ndjson +++ /dev/null @@ -1,14 +0,0 @@ -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"72f39161-3f69-49a4-b39a-b0168b88856a","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyMiwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyMSwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"user.name\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"72f39161-3f69-49a4-b39a-b0168b88856a","name":"control_0_index_pattern","type":"index-pattern"},{"id":"72f39161-3f69-49a4-b39a-b0168b88856a","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-24T18:06:06.245Z","version":"WzQ4MSwyXQ=="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"252e4f32-a2c6-483d-a289-5d658410df17","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyNCwyXQ=="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"e3f24157-721c-4741-ac8f-8be48c22d612","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyNSwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - User activity title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - User activity title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## All user activity\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyNiwyXQ=="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"logs-*","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyNywyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - Logon title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Logon title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Logon / Logoff events\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyOCwyXQ=="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"winlogbeat-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"68a051a0-1d7f-11e9-9fc5-a91039822035","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMyOSwyXQ=="} -{"attributes":{"columns":["winlog.event_data.SubjectDomainName","winlog.event_data.TargetUserName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"user.name":{"width":193},"winlog.event_data.SubjectDomainName":{"width":193}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4624\\\" and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_data.LogonType\",\"value\":[\"2\",\"10\",\"11\",\"7\"],\"params\":[\"2\",\"10\",\"11\",\"7\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_data.LogonType\":\"2\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"10\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"11\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"7\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Interactive Logon search","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMzMCwyXQ=="} -{"attributes":{"columns":[],"description":"","grid":{"columns":{"winlog.event_data.TargetDomainName":{"width":241},"winlog.event_data.TargetUserName":{"width":241}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:\\\"4634\\\" OR event.code:\\\"4647\\\" ) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMzMSwyXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"HR - Interactive v Remote pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Interactive v Remote pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"label\":\"filters\",\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"segment\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_data.LogonType:2\",\"language\":\"lucene\"},\"label\":\"Interactive\"},{\"input\":{\"query\":\"winlog.event_data.LogonType:10\",\"language\":\"lucene\"},\"label\":\"RemoteInteractive\"}]}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T14:22:55.477Z","id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-24T14:22:55.477Z","version":"WzMzMiwyXQ=="} -{"attributes":{"description":"Overview of user activity for Human Resources\n","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"key\":\"user.name\",\"controlledBy\":\"1587713561601\",\"type\":\"phrase\",\"params\":{\"query\":\"lme-user\"},\"disabled\":false,\"negate\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"user.name\":\"lme-user\"}},\"$state\":{\"store\":\"appState\"}}]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"a6335da9-2093-46ac-bd39-f1c5e5fe8825\"},\"panelIndex\":\"a6335da9-2093-46ac-bd39-f1c5e5fe8825\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a6335da9-2093-46ac-bd39-f1c5e5fe8825\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":16,\"h\":12,\"i\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},\"panelIndex\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select domain(s) and username(s)\",\"panelRefName\":\"panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":3,\"w\":15,\"h\":12,\"i\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\"},\"panelIndex\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"252e4f32-a2c6-483d-a289-5d658410df17\",\"name\":\"indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"accessors\":[\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"splitAccessor\":\"fc23a029-309e-40a7-aeca-309fd8423ced\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\":{\"columns\":{\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\":{\"label\":\"Top 5 values of winlog.event_data.SubjectDomainName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.SubjectDomainName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"fc23a029-309e-40a7-aeca-309fd8423ced\":{\"label\":\"Top 3 values of winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5a238afa-9ffa-4568-8a43-6167c0a76b67\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"fc23a029-309e-40a7-aeca-309fd8423ced\",\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Users\"},{\"type\":\"lens\",\"gridData\":{\"x\":31,\"y\":3,\"w\":17,\"h\":12,\"i\":\"69771c75-8536-49b2-a835-c134ada8cd8d\"},\"panelIndex\":\"69771c75-8536-49b2-a835-c134ada8cd8d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"e3f24157-721c-4741-ac8f-8be48c22d612\",\"name\":\"indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"accessors\":[\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"position\":\"top\",\"seriesType\":\"bar\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"22b4e313-2858-411e-a90b-911198fa34fe\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\":{\"columns\":{\"22b4e313-2858-411e-a90b-911198fa34fe\":{\"label\":\"Top 5 values of winlog.computer_name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.computer_name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"22b4e313-2858-411e-a90b-911198fa34fe\",\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Computers\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":15,\"w\":48,\"h\":4,\"i\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\"},\"panelIndex\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_f2f654b0-42ef-403c-bee2-7e26499f809a\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":19,\"w\":24,\"h\":15,\"i\":\"4b306ffa-7af9-461d-b7aa-966f67b4ed57\"},\"panelIndex\":\"4b306ffa-7af9-461d-b7aa-966f67b4ed57\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-6bfbd839-8497-464d-a473-26c01d5ba342\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"6bfbd839-8497-464d-a473-26c01d5ba342\",\"accessors\":[\"959a5347-48f5-488a-96c4-381f5a7474d4\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6bfbd839-8497-464d-a473-26c01d5ba342\":{\"columns\":{\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"959a5347-48f5-488a-96c4-381f5a7474d4\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"percent\",\"params\":{\"decimals\":2}}}}},\"columnOrder\":[\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\",\"959a5347-48f5-488a-96c4-381f5a7474d4\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"All User Events by Day of Week, Hour of Day\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":19,\"w\":24,\"h\":15,\"i\":\"e40e6077-f799-4c66-9bf8-1664121d8069\"},\"panelIndex\":\"e40e6077-f799-4c66-9bf8-1664121d8069\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f46d1729-4bd5-4219-9973-01913c208fef\",\"accessors\":[\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f46d1729-4bd5-4219-9973-01913c208fef\":{\"columns\":{\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"800c3857-3c9c-4fc5-a403-3fcbede05599\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\",\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Timestamps by Count\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":34,\"w\":48,\"h\":4,\"i\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},\"panelIndex\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":38,\"w\":24,\"h\":15,\"i\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},\"panelIndex\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logon events (filter by LogonId)\",\"panelRefName\":\"panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":38,\"w\":24,\"h\":15,\"i\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\"},\"panelIndex\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logoff events (correlate to logon events)\",\"panelRefName\":\"panel_bb42b25e-f934-485b-854c-440cc1b3ebee\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":53,\"w\":24,\"h\":15,\"i\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"},\"panelIndex\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"In person vs Remote logons\",\"panelRefName\":\"panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"}]","timeRestore":false,"title":"User HR 2.0","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-24T18:06:50.721Z","id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","managed":false,"references":[{"id":"72f39161-3f69-49a4-b39a-b0168b88856a","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","name":"a6335da9-2093-46ac-bd39-f1c5e5fe8825:panel_a6335da9-2093-46ac-bd39-f1c5e5fe8825","type":"visualization"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"ab726ae4-6c98-4f26-8cd3-07bf2808b704:panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704","type":"visualization"},{"id":"252e4f32-a2c6-483d-a289-5d658410df17","name":"c8d3e871-1f5d-40bd-a0f9-5441a58cad32:indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093","type":"index-pattern"},{"id":"e3f24157-721c-4741-ac8f-8be48c22d612","name":"69771c75-8536-49b2-a835-c134ada8cd8d:indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2","type":"index-pattern"},{"id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","name":"f2f654b0-42ef-403c-bee2-7e26499f809a:panel_f2f654b0-42ef-403c-bee2-7e26499f809a","type":"visualization"},{"id":"logs-*","name":"4b306ffa-7af9-461d-b7aa-966f67b4ed57:indexpattern-datasource-layer-6bfbd839-8497-464d-a473-26c01d5ba342","type":"index-pattern"},{"id":"logs-*","name":"e40e6077-f799-4c66-9bf8-1664121d8069:indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef","type":"index-pattern"},{"id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","name":"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e:panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e","type":"visualization"},{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"755f30aa-d6ad-46d9-b2c3-7425c02ed03e:panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e","type":"search"},{"id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","name":"bb42b25e-f934-485b-854c-440cc1b3ebee:panel_bb42b25e-f934-485b-854c-440cc1b3ebee","type":"search"},{"id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","name":"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f:panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f","type":"visualization"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-24T18:06:50.721Z","version":"WzQ4NywyXQ=="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":13,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboard_refactor/refactored/User Security 2.0.ndjson b/dashboard_refactor/refactored/User Security 2.0.ndjson deleted file mode 100644 index ce1e6e72..00000000 --- a/dashboard_refactor/refactored/User Security 2.0.ndjson +++ /dev/null @@ -1,43 +0,0 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"dec45d9f-11a2-4e39-ae58-4fc7885ce7dd","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMDksMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"4a675166-ce19-4836-9567-eda4ab46b3d5","managed":false,"references":[{"id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","name":"control_0_index_pattern","type":"index-pattern"},{"id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTEsMV0="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"25aa14ff-d525-4751-a29d-290859861006","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - Filter Hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Filter Hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Event count\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"8d476795-134d-4689-9050-a24b57adaa90","managed":false,"references":[{"id":"25aa14ff-d525-4751-a29d-290859861006","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTMsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security - Select Host","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select Host\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588685297382\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","managed":false,"references":[{"id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTQsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"e3f24157-721c-4741-ac8f-8be48c22d612","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNjksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Logons Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logons Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Logons\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"4eccff45-c97a-480f-b593-4744922893e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTYsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"64c636e6-00f6-469a-9315-1b8ae52c344f","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTcsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"winlogbeat-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTgsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human User Logon Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon attempts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon attempts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Login attempts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"3f7d1f53-6b70-4235-879a-f149d98c9063","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon events over time","uiStateJSON":"{\"vis\":{\"colors\":{\"Failed attempts\":\"#BF1B00\",\"Successful atempts\":\"#629E51\"}}}","version":1,"visState":"{\"title\":\"Security - Logon events over time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":1,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-23T08:41:59.000Z\",\"max\":\"2020-04-23T08:56:59.000Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"event.code:4625\",\"language\":\"lucene\"},\"label\":\"Failed attempts\"},{\"input\":{\"query\":\"event.code:4624\",\"language\":\"lucene\"},\"label\":\"Successful atempts\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15m\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"42ae3f23-386c-4ceb-bb84-98879107338b","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjEsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4,624, 4,625\",\"params\":[\"4624\",\"4625\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}},{\"match_phrase\":{\"event.code\":\"4625\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Computers\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","managed":false,"references":[{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjMsMV0="} -{"attributes":{"columns":["event.code","host.name","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.IpAddress","event.action","event.outcome","winlog.event_data.LogonType"],"description":"","grid":{"columns":{"user.domain":{"width":119},"user.name":{"width":134}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human Logon & Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Network Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Network Connections\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"80b03097-c117-44d0-8413-3c932d0886a2","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjUsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id : \\\"3\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"All network activity ","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"f02a3c3d-eb39-4347-91f7-d62bece13128","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjYsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Activity Line","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Activity Line\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Connections\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Connections\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Connections\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-24T15:29:10.918Z\",\"max\":\"2020-04-24T15:44:10.918Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"aa741894-2140-4529-a488-6d34ed57abef","managed":false,"references":[{"id":"f02a3c3d-eb39-4347-91f7-d62bece13128","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjcsMV0="} -{"attributes":{"columns":["winlog.event_data.DestinationHostname","destination.ip","winlog.event_data.DestinationIsIpv6","network.","process.executable","winlog.event_data.DestinationPort","winlog.event_data.Protocol","winlog.user.name","winlog.user.type","source.ip","winlog.event_data.SourceIsIpv6","source.port","network.protocol"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_non_browsers_connection","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"50b150ad-5aff-4706-9229-d9bcb38255ef","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T15:24:04.448Z","version":"WzI1MzksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Process List","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Network Process List\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.DestinationIp\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Destination IP\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":false,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logged on user\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":4,\"direction\":\"asc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"date\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"e45875a5-d1ae-4c92-9683-86392f740aae","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network connections area ","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network connections area \",\"type\":\"area\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":false,\"type\":\"terms\",\"params\":{\"field\":\"network.protocol\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"labels\":{},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"48405764-dc21-463c-bef1-3c0da9a0e42a","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Overview - Processes with unusual network activity","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Overview - Processes with unusual network activity\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"size\":10,\"include\":\"\",\"json\":\"\",\"customLabel\":\"Process\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"string\"},\"params\":{},\"label\":\"Process\",\"aggType\":\"significant_terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzEsMV0="} -{"attributes":{"columns":["host.name","winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{"columns":{"winlog.event_data.SubjectDomainName":{"width":216}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_non_private_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","managed":false,"references":[{"id":"25aa14ff-d525-4751-a29d-290859861006","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Processes Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Processes Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Processes & Powershell\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzMsMV0="} -{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.User","winlog.event_data.ProcessId","winlog.event_data.ProcessName","winlog.event_data.Hashes","process.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawns","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzQsMV0="} -{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.command_line","process.parent.executable","process.parent.command_line","file.path","event.code"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\" OR process.command_line.text:\\\"powershell\\\" OR parent.process.command_line.text:\\\"powershell\\\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_powershell_run","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell Run Count","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Security - Powershell Run Count\",\"type\":\"metric\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzYsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell runs over time","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now/w\",\"to\":\"now/w\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}],\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\"},\"title\":\"Security - Powershell runs over time\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Power shell hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"title\":\"Security - Power shell hosts pie\",\"type\":\"pie\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzgsMV0="} -{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.args","process.parent.executable","process.parent.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND process.command_line.text:(\\\"invoke\\\" or \\\"bypass\\\" or \\\"iex\\\" or \\\"ex\\\" or \\\"icm\\\" or \\\"new-object\\\" or \\\"set\\\" or \\\"get\\\" or \\\"write\\\" or \\\"out\\\" or \\\"download\\\" or \\\"encoded\\\")\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Potentially Suspicious Powershell","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzksMV0="} -{"attributes":{"columns":["user.domain","user.name","host.name","destination.domain","destination.ip"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND (process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_powershell_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"04c60a34-98a9-4073-8538-97996e80855f","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Files title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Files title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Files\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDEsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"file.path.text: \\\"tmp\\\" OR file.path.text:\\\"temp\\\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"file.path\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"exists\":{\"field\":\"file.path\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"TEMP & %TEMP%","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"d3792434-6184-44ed-bad4-830249085d68","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"TEMP & %TEMP%","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target File\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":30,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Hostname\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"TEMP & %TEMP%\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","managed":false,"references":[{"id":"d3792434-6184-44ed-bad4-830249085d68","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDMsMV0="} -{"attributes":{"columns":["@timestamp","user.domain","user.name","host.name","process.executable","winlog.event_data.ProcessId"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: \\\"9\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Raw Access Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Windows Defender Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Windows Defender Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Windows Defender\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"a2cdbce1-9070-4851-909f-774a80d2875a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:(1006 or 1007 or 1008 or 1009 or 1116 or 1117 or 1118 or 1119)\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - AV Events Count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - AV Events Count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Windows AV Events\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"6ac9a9da-1772-483c-8c32-b049f0273186","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDYsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_id\",\"value\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"params\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"negate\":false,\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_id\":\"1006\"}},{\"match_phrase\":{\"winlog.event_id\":\"1007\"}},{\"match_phrase\":{\"winlog.event_id\":\"1008\"}},{\"match_phrase\":{\"winlog.event_id\":\"1009\"}},{\"match_phrase\":{\"winlog.event_id\":\"1116\"}},{\"match_phrase\":{\"winlog.event_id\":\"1117\"}},{\"match_phrase\":{\"winlog.event_id\":\"1118\"}},{\"match_phrase\":{\"winlog.event_id\":\"1119\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"AV Detection event","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"AV Hits (Count)","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"AV Hits (Count)\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"AV Detection hits\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"fe86395f-474e-43a1-a772-34d1306373e0","managed":false,"references":[{"id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDgsMV0="} -{"attributes":{"columns":["winlog.event_data.Detection User","host.name","winlog.event_data.Path","winlog.event_data.FWLink"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: 1116\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"Microsoft-Windows-Windows Defender\"},\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"match_phrase\":{\"event.provider\":{\"query\":\"Microsoft-Windows-Windows Defender\"}}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Defender AV Detections","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDksMV0="} -{"attributes":{"description":"User Security overview, filtered by Domain / Username or hostname","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"bd9e6265-dae7-493b-88b0-e3dee8508541\"},\"panelIndex\":\"bd9e6265-dae7-493b-88b0-e3dee8508541\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_bd9e6265-dae7-493b-88b0-e3dee8508541\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":23,\"h\":7,\"i\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},\"panelIndex\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search users\",\"panelRefName\":\"panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},{\"type\":\"visualization\",\"gridData\":{\"x\":23,\"y\":3,\"w\":25,\"h\":7,\"i\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\"},\"panelIndex\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Filter hosts\",\"panelRefName\":\"panel_62ea04ec-0776-46c0-9b8c-cf2915600337\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":10,\"w\":23,\"h\":7,\"i\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\"},\"panelIndex\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search hosts\",\"panelRefName\":\"panel_45ac8571-ae44-4bb5-a237-cd230ede51d5\"},{\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":10,\"w\":25,\"h\":7,\"i\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\"},\"panelIndex\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"e3f24157-721c-4741-ac8f-8be48c22d612\",\"name\":\"indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\",\"isTransposed\":false},{\"columnId\":\"26752485-2aa5-4908-b400-504d6e7ef451\",\"isTransposed\":false},{\"columnId\":\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"layerType\":\"data\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d123adeb-fd39-4176-b3c9-69c88d2852d5\":{\"columns\":{\"6f33ff19-9959-4c43-b791-939582a0b3d2\":{\"label\":\"Event Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"26752485-2aa5-4908-b400-504d6e7ef451\":{\"label\":\"Filters\",\"dataType\":\"string\",\"operationType\":\"filters\",\"scale\":\"ordinal\",\"isBucketed\":true,\"params\":{\"filters\":[{\"label\":\"\",\"input\":{\"query\":\"\\\"log\\\" : *\",\"language\":\"kuery\"}}]}},\"cc4e45f6-be3a-4de0-a416-e21043b601bb\":{\"label\":\"Top 3 values of user.domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"user.domain\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"26752485-2aa5-4908-b400-504d6e7ef451\",\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"6f33ff19-9959-4c43-b791-939582a0b3d2\"],\"sampling\":1,\"indexPatternId\":\"a2ce5204-8ea0-4af2-a2d7-daf564ce2841\",\"incompleteColumns\":{}}},\"currentIndexPatternId\":\"a2ce5204-8ea0-4af2-a2d7-daf564ce2841\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter users\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":17,\"w\":48,\"h\":4,\"i\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},\"panelIndex\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":9,\"h\":7,\"i\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\"},\"panelIndex\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_e5de9fc4-5863-470c-8246-0a86f5af897e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":9,\"y\":21,\"w\":20,\"h\":14,\"i\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},\"panelIndex\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logon attempts\",\"panelRefName\":\"panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},{\"type\":\"visualization\",\"gridData\":{\"x\":29,\"y\":21,\"w\":19,\"h\":14,\"i\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},\"panelIndex\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logged on computers\",\"panelRefName\":\"panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":28,\"w\":9,\"h\":7,\"i\":\"0d1c0533-598a-4304-80be-c22047edcbe1\"},\"panelIndex\":\"0d1c0533-598a-4304-80be-c22047edcbe1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0d1c0533-598a-4304-80be-c22047edcbe1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":17,\"i\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},\"panelIndex\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User Logon & Logoff Events\",\"panelRefName\":\"panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":52,\"w\":48,\"h\":4,\"i\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\"},\"panelIndex\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0fab3d76-5411-46e4-982f-4d4626c977b8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":56,\"w\":48,\"h\":14,\"i\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},\"panelIndex\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"All network connections\",\"panelRefName\":\"panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":70,\"w\":24,\"h\":15,\"i\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},\"panelIndex\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}},\"enhancements\":{}},\"title\":\"Network connections from non-browser processes\",\"panelRefName\":\"panel_f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":70,\"w\":24,\"h\":15,\"i\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},\"panelIndex\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network connection by protocol\",\"panelRefName\":\"panel_6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":85,\"w\":48,\"h\":15,\"i\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},\"panelIndex\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Unusual network connections from non-browser processes\",\"panelRefName\":\"panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":100,\"w\":48,\"h\":10,\"i\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\"},\"panelIndex\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network Connection Events (Sysmon ID 3)\",\"panelRefName\":\"panel_ea6ad677-7322-4c5c-8946-cac4dd983b26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":110,\"w\":48,\"h\":4,\"i\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\"},\"panelIndex\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_43b61744-5553-4fd1-894c-6e91a799f4a2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":114,\"w\":48,\"h\":14,\"i\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\"},\"panelIndex\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Spawned Processes\",\"panelRefName\":\"panel_9a522603-8d31-4ad6-ac4f-130a814f54fa\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":128,\"w\":10,\"h\":15,\"i\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},\"panelIndex\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell Events\",\"panelRefName\":\"panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":10,\"y\":128,\"w\":20,\"h\":15,\"i\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},\"panelIndex\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events over time\",\"panelRefName\":\"panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":30,\"y\":128,\"w\":18,\"h\":15,\"i\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\"},\"panelIndex\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events by computer\",\"panelRefName\":\"panel_ed7a59ea-caa7-4396-89b7-90c6b8363800\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":143,\"w\":25,\"h\":16,\"i\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},\"panelIndex\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Potentially suspicious powershell\",\"panelRefName\":\"panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},{\"type\":\"search\",\"gridData\":{\"x\":25,\"y\":143,\"w\":23,\"h\":16,\"i\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\"},\"panelIndex\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell network connections\",\"panelRefName\":\"panel_9587ef7f-3554-4886-be6a-fae4648e87dd\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":159,\"w\":48,\"h\":4,\"i\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},\"panelIndex\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":163,\"w\":24,\"h\":15,\"i\":\"4988f659-a275-4317-b071-8a350087a4e6\"},\"panelIndex\":\"4988f659-a275-4317-b071-8a350087a4e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"References to temporary files\",\"panelRefName\":\"panel_4988f659-a275-4317-b071-8a350087a4e6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":163,\"w\":24,\"h\":15,\"i\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},\"panelIndex\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"RawAccessRead (Sysmon Event 9)\",\"panelRefName\":\"panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":178,\"w\":48,\"h\":4,\"i\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},\"panelIndex\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":182,\"w\":12,\"h\":14,\"i\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},\"panelIndex\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Defender event count\",\"panelRefName\":\"panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},{\"type\":\"visualization\",\"gridData\":{\"x\":12,\"y\":182,\"w\":12,\"h\":14,\"i\":\"30454a55-0210-43d2-af3d-822c5b519033\"},\"panelIndex\":\"30454a55-0210-43d2-af3d-822c5b519033\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_30454a55-0210-43d2-af3d-822c5b519033\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":182,\"w\":24,\"h\":14,\"i\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"},\"panelIndex\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"AV Detections (Event 1116)\",\"panelRefName\":\"panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"}]","timeRestore":false,"title":"User Security 2.0","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:24:54.858Z","id":"2fc36188-8461-4927-932e-0e452b7dc3ac","managed":false,"references":[{"id":"dec45d9f-11a2-4e39-ae58-4fc7885ce7dd","name":"bd9e6265-dae7-493b-88b0-e3dee8508541:panel_bd9e6265-dae7-493b-88b0-e3dee8508541","type":"visualization"},{"id":"4a675166-ce19-4836-9567-eda4ab46b3d5","name":"956d6ef1-5d6b-4ccc-a123-fa66805c15db:panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db","type":"visualization"},{"id":"8d476795-134d-4689-9050-a24b57adaa90","name":"62ea04ec-0776-46c0-9b8c-cf2915600337:panel_62ea04ec-0776-46c0-9b8c-cf2915600337","type":"visualization"},{"id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","name":"45ac8571-ae44-4bb5-a237-cd230ede51d5:panel_45ac8571-ae44-4bb5-a237-cd230ede51d5","type":"visualization"},{"id":"e3f24157-721c-4741-ac8f-8be48c22d612","name":"1324f39e-f215-45e9-b679-05b06e4fcb9d:indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5","type":"index-pattern"},{"id":"4eccff45-c97a-480f-b593-4744922893e5","name":"b453a1df-c025-430b-84e3-d6dc7a8c48f1:panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1","type":"visualization"},{"id":"3f7d1f53-6b70-4235-879a-f149d98c9063","name":"e5de9fc4-5863-470c-8246-0a86f5af897e:panel_e5de9fc4-5863-470c-8246-0a86f5af897e","type":"visualization"},{"id":"42ae3f23-386c-4ceb-bb84-98879107338b","name":"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48:panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48","type":"visualization"},{"id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","name":"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2:panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2","type":"visualization"},{"id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","name":"0d1c0533-598a-4304-80be-c22047edcbe1:panel_0d1c0533-598a-4304-80be-c22047edcbe1","type":"visualization"},{"id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","name":"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396:panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396","type":"search"},{"id":"80b03097-c117-44d0-8413-3c932d0886a2","name":"0fab3d76-5411-46e4-982f-4d4626c977b8:panel_0fab3d76-5411-46e4-982f-4d4626c977b8","type":"visualization"},{"id":"aa741894-2140-4529-a488-6d34ed57abef","name":"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305:panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305","type":"visualization"},{"id":"e45875a5-d1ae-4c92-9683-86392f740aae","name":"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c:panel_f068f3e0-1c90-4f9d-93ca-a7e7c96df39c","type":"visualization"},{"id":"48405764-dc21-463c-bef1-3c0da9a0e42a","name":"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b:panel_6da7d5e7-a679-42d4-b2f7-bb3c958ab16b","type":"visualization"},{"id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","name":"6d5d4b74-133b-4fef-8ae5-14d2e7037a78:panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78","type":"visualization"},{"id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","name":"ea6ad677-7322-4c5c-8946-cac4dd983b26:panel_ea6ad677-7322-4c5c-8946-cac4dd983b26","type":"search"},{"id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","name":"43b61744-5553-4fd1-894c-6e91a799f4a2:panel_43b61744-5553-4fd1-894c-6e91a799f4a2","type":"visualization"},{"id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","name":"9a522603-8d31-4ad6-ac4f-130a814f54fa:panel_9a522603-8d31-4ad6-ac4f-130a814f54fa","type":"search"},{"id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","name":"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6:panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6","type":"visualization"},{"id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","name":"68d75f76-3806-4d15-81e9-d0dcfa34c9b9:panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9","type":"visualization"},{"id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","name":"ed7a59ea-caa7-4396-89b7-90c6b8363800:panel_ed7a59ea-caa7-4396-89b7-90c6b8363800","type":"visualization"},{"id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","name":"cfe390f9-80a7-4a11-9a8c-7d599e41e38a:panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a","type":"search"},{"id":"04c60a34-98a9-4073-8538-97996e80855f","name":"9587ef7f-3554-4886-be6a-fae4648e87dd:panel_9587ef7f-3554-4886-be6a-fae4648e87dd","type":"search"},{"id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","name":"7cfff19f-bf9d-4101-be63-4d9b8ea78e26:panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26","type":"visualization"},{"id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","name":"4988f659-a275-4317-b071-8a350087a4e6:panel_4988f659-a275-4317-b071-8a350087a4e6","type":"visualization"},{"id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","name":"bfae12f4-b2fd-471f-a111-daf49cd25ed3:panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3","type":"search"},{"id":"a2cdbce1-9070-4851-909f-774a80d2875a","name":"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b:panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b","type":"visualization"},{"id":"6ac9a9da-1772-483c-8c32-b049f0273186","name":"e8c5ac63-42b4-4081-85e3-378c85c0b4cb:panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb","type":"visualization"},{"id":"fe86395f-474e-43a1-a772-34d1306373e0","name":"30454a55-0210-43d2-af3d-822c5b519033:panel_30454a55-0210-43d2-af3d-822c5b519033","type":"visualization"},{"id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","name":"6ff4d4db-16b6-4c80-8bb6-95e009803d1d:panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d","type":"search"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-23T15:24:54.858Z","version":"WzI1NDIsMV0="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":42,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboard_refactor/requirements.txt b/dashboard_refactor/requirements.txt deleted file mode 100644 index 345bc273..00000000 --- a/dashboard_refactor/requirements.txt +++ /dev/null @@ -1,2 +0,0 @@ -requests -urllib3 \ No newline at end of file diff --git a/dashboards/Readme.md b/dashboards/Readme.md index 054932ba..7dc33b16 100644 --- a/dashboards/Readme.md +++ b/dashboards/Readme.md @@ -2,7 +2,7 @@ ## Wazuh Dashboards: For more info on these dashboards see wazuh's documentation: [LINK](https://documentation.wazuh.com/current/integrations-guide/elastic-stack/index.html) -This is the dashboard URL: +This is the dashboard URL that inspired the current Wazuh dashboards: ```bash https://packages.wazuh.com/integrations/elastic/4.x-8.x/dashboards/wz-es-4.x-8.x-dashboards.ndjson ``` @@ -10,6 +10,8 @@ https://packages.wazuh.com/integrations/elastic/4.x-8.x/dashboards/wz-es-4.x-8.x ## How to update dashboards Currently you need to run `ansible-playbook post_install_local.yml` to upload the current LME dashboards. +If you need to reupload them, you can delete the `INSTALLED` file in the appropriate `/opt/lme/dashboards` directory and re-run the `post install` script. + ## Updating to new dashboards and removing old ones (Starting with 1.1.0) Browse to `Kibana->Stack Management` then select `Saved Objects`. On the Saved Objects page, you can filter by dashboards. @@ -20,7 +22,7 @@ Select the filter `Type` and select `dashboard`. You can delete all of the dashboards before importing the new ones. -### Exporting dashboards: *TODO test this* +### Exporting dashboards: It is recommended that you export your dashboards before updating them, especially if you have customized them or created new ones. To export the dashboards use the `export_dashboards.py`. It is easiest to export them from the ubuntu machine where you have installed the ELK stack because the @@ -30,16 +32,24 @@ on your initial install. ##### The files will be exported to `./exported` #### Running on Ubuntu - +To get your password you can run: +```bash +cd ~/LME #OR YOUR CLONE DIRECTORY +source ./scripts/extract_secrets ``` -./export_dashboards.py -u elastic -p YOURUNIQUEPASS + +Then you can use the following command to export dashboards: +```bash +./export_dashboards.py -u elastic -p "$elastic" ``` The modules should already be installed on Ubuntu, but If the script complains about missing modules: -``` +```bash pip install -r requirements.txt ``` +The dashboards will be exported to: `~/LME/dashboards/exported` + #### Running on Windows You must have python and the modules installed. (You can install python 3 from the Microsoft Store). Then install the requirements: ``` diff --git a/dashboards/elastic/alerting_dashboard_2_0.ndjson b/dashboards/elastic/alerting_dashboard_2_0.ndjson index 58f3d83a..3a2a780c 100644 --- a/dashboards/elastic/alerting_dashboard_2_0.ndjson +++ b/dashboards/elastic/alerting_dashboard_2_0.ndjson @@ -1,22 +1,124 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:11:26.658Z","id":"5eea1399-b3f9-4413-9790-7bd5f75ed5f1","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T15:11:26.658Z","version":"WzI0ODgsMV0="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:11:26.658Z","id":"c25323e4-7499-4278-b64f-842597921b1e","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T15:11:26.658Z","version":"WzI0ODksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Tags Controls","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Tags Controls\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588260438304\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Tags\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:11:26.658Z","id":"52e59d99-4f20-4784-8bcc-00eee6b867f5","managed":false,"references":[{"id":"c25323e4-7499-4278-b64f-842597921b1e","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T15:11:26.658Z","version":"WzI0OTAsMV0="} -{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable.text\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name.text\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","runtimeFieldMap":"{\"Column1\":{\"type\":\"keyword\",\"script\":{\"source\":\"if(doc['signal.status'].size() != 0) { if(doc['signal.status'].value.equals(\\\"open\\\")) { if(doc['event.code'].size() != 0) { if(doc['event.code'].value.equals(Integer.toString(1))) { if (doc['process.pid'].size() != 0) { emit (doc['process.pid'].value.toString()) } } else if(doc['event.code'].value.equals(Integer.toString(3))) { if (doc['destination.address'].size() != 0) { emit (doc['destination.address'].value.toString()) } } } emit (\\\"No Data\\\") } } emit (\\\"Signal Closed\\\")\"}},\"Column2\":{\"type\":\"keyword\",\"script\":{\"source\":\"if(doc['signal.status'].size() != 0) { if(doc['signal.status'].value.equals(\\\"open\\\")) { if(doc['event.code'].size() != 0) { if(doc['event.code'].value.equals(Integer.toString(1))) { def args = \\\"\\\"; if (doc['process.args'].size() != 0) { for(int i=0; i winlog.computer_name:(\\\\S+) > .*\\\").legend(position=ne)\",\"interval\":\"auto\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"04d761f8-31da-4fa6-b411-492982bffcb7","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:32:23.746Z","version":"WzI2MjcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_types_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_types_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"|Logon Type|Logon Title|Description|\\n| :-: | :- | :- |\\n| 2 | Interactive | A user logged on to this computer. |\\n| 3 | Network | A user or computer logged on to this computer from the network. |\\n| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |\\n| 5 | Service | A service was started by the Service Control Manager. |\\n| 7 | Unlock | This workstation was unlocked. |\\n| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |\\n| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |\\n| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |\\n| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"7b7addff-313c-4305-a681-0e73e4fab8a5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T19:34:03.463Z","version":"WzEzOTMsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_status_codes_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_codes_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.LogonType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.Status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.SubStatus\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"e241d441-f788-45f7-8f78-cb67ab880af7","managed":false,"references":[{"id":"69b1e834-ded8-4e8b-8d0d-8b870dcbdaf3","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T19:34:03.463Z","version":"WzEzOTQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_status_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| Code | Description |\\n| :- | :- |\\n| 0XC000005E | There are currently no logon servers available to service the logon request. |\\n| 0xC0000064 | User logon with misspelled or bad user account |\\n| 0xC000006A | User logon with misspelled or bad password |\\n| 0XC000006D | This is either due to a bad username or authentication information |\\n| 0XC000006E | Unknown user name or bad password. |\\n| 0xC000006F | User logon outside authorized hours |\\n| 0xC0000070 | User logon from unauthorized workstation |\\n| 0xC0000071 | User logon with expired password |\\n| 0xC0000072 | User logon to account disabled by administrator |\\n| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |\\n| 0XC0000133 | Clocks between DC and other computer too far out of sync |\\n| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |\\n| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |\\n| 0XC0000192 | An attempt was made to logon, but the Netlogon service was not started. |\\n| 0xC0000193 | User logon with expired account |\\n| 0XC0000224 | User is required to change password at next logon |\\n| 0XC0000225 | Evidently a bug in Windows and not a risk |\\n| 0xC0000234 | User logon with account locked |\\n| 0XC00002EE | Failure Reason: An Error occurred during Logon |\\n| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |\\n| 0x0 | Status OK. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"4b319ad8-e537-441c-88ee-15058cbf346b","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T20:08:20.649Z","version":"WzE0MjgsMV0="} -{"attributes":{"columns":["host.name","winlog.event_data.SubjectUserName","winlog.event_data.TargetUserName","winlog.event_data.TargetServerName","winlog.event_data.SubjectDomainName","winlog.event_data.TargetDomainName","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4648 \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4648_logon_explicit_creds_running_as_different_user","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"c3113842-6bb9-484f-8110-72a8652cfe4c","managed":false,"references":[{"id":"ee32517b-85a4-448d-b063-ef0c0e1d5887","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-21T21:56:47.529Z","version":"WzE0OTMsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_logs_computernames_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Logged events\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"filters\",\"schema\":\"bucket\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_id : 4624\",\"language\":\"kuery\"},\"label\":\"EventID 4624\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":1000,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computername\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"vis_sd_security_logs_computernames_datatable\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"5e135bcd-9c31-4c84-aff7-ea6fbb6ce752","managed":false,"references":[{"id":"4d4fcf30-df17-4a78-b6ac-890b383e8e2a","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T19:34:03.463Z","version":"WzEzOTcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"e885d176-bb6f-444a-abbc-6ce6fbf14f74","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T19:34:03.463Z","version":"WzEzOTgsMV0="} -{"attributes":{"description":"Security log related events","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":24,\"h\":15,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security logs events\",\"panelRefName\":\"panel_1\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":134,\"w\":48,\"h\":17,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Process creation - event ID 4688\",\"panelRefName\":\"panel_2\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":109,\"w\":48,\"h\":8,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Log Cleared - event ID 1102 or 104\",\"panelRefName\":\"panel_3\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":151,\"w\":48,\"h\":18,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logon created - Logon type 2\",\"panelRefName\":\"panel_6\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":3,\"w\":24,\"h\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select a computer to filter the below results. Leave blank for all\",\"panelRefName\":\"panel_7\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":169,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - network logon created - Logon type 3\",\"panelRefName\":\"panel_8\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":117,\"w\":48,\"h\":17,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log events - Detail\",\"panelRefName\":\"panel_9\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":184,\"w\":48,\"h\":17,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - logon as a service - Logon type 5\",\"panelRefName\":\"panel_10\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":201,\"w\":48,\"h\":15,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Credential sent as clear text - Logon type 8\",\"panelRefName\":\"panel_11\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":18,\"w\":24,\"h\":15,\"i\":\"15\"},\"panelIndex\":\"15\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon attempts\",\"panelRefName\":\"panel_15\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":216,\"w\":48,\"h\":18,\"i\":\"19\"},\"panelIndex\":\"19\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logons with special privileges assigned - event ID 4672\",\"panelRefName\":\"panel_19\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":18,\"w\":24,\"h\":15,\"i\":\"20\"},\"panelIndex\":\"20\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Computers showing failed login attempts - 10 maximum shown\",\"panelRefName\":\"panel_20\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":33,\"w\":48,\"h\":18,\"i\":\"21\"},\"panelIndex\":\"21\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon type codes\",\"panelRefName\":\"panel_21\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":16,\"i\":\"22\"},\"panelIndex\":\"22\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon and reason (status code)\",\"panelRefName\":\"panel_22\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":83,\"w\":48,\"h\":26,\"i\":\"23\"},\"panelIndex\":\"23\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon status codes\",\"panelRefName\":\"panel_23\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":234,\"w\":48,\"h\":15,\"i\":\"28\"},\"panelIndex\":\"28\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"title\":\"Security log - Process started with different credentials- event ID 4648 [could be RUNAS, scheduled tasks]\",\"panelRefName\":\"panel_28\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":11,\"w\":24,\"h\":7,\"i\":\"30\"},\"panelIndex\":\"30\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"title\":\"Select a computername to filter\",\"panelRefName\":\"panel_30\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"b71dba65-ed1c-4917-9fc7-54923511ad2d\"},\"panelIndex\":\"b71dba65-ed1c-4917-9fc7-54923511ad2d\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b71dba65-ed1c-4917-9fc7-54923511ad2d\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":67,\"w\":48,\"h\":16,\"i\":\"96010259-5ae8-4632-bcce-34078573b1cd\"},\"panelIndex\":\"96010259-5ae8-4632-bcce-34078573b1cd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed Logons\",\"panelRefName\":\"panel_96010259-5ae8-4632-bcce-34078573b1cd\"}]","timeRestore":false,"title":"Security Dashboard - Security Log","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:34:03.463Z","id":"49c57924-3cac-4bf6-89d6-0a4505d2a808","managed":false,"references":[{"id":"c5dc23e1-4a54-44c6-b354-223faa728800","name":"1:panel_1","type":"visualization"},{"id":"d10da8a4-38ff-4703-b91c-ce984850f9c3","name":"2:panel_2","type":"search"},{"id":"7e46da37-24db-4262-b778-7111ec268295","name":"3:panel_3","type":"search"},{"id":"eac15a4a-439f-4d5f-976d-99de3f19788f","name":"6:panel_6","type":"visualization"},{"id":"47abcb6b-0a7e-492b-a7b1-40d506194862","name":"7:panel_7","type":"visualization"},{"id":"c988e6c0-e97e-476e-a8d9-de7a5ea87e37","name":"8:panel_8","type":"visualization"},{"id":"4d4fcf30-df17-4a78-b6ac-890b383e8e2a","name":"9:panel_9","type":"search"},{"id":"3192dfcc-b197-4b42-9b53-fadfb83eff73","name":"10:panel_10","type":"visualization"},{"id":"b3c5391e-bd30-4432-a281-b60c8a3fa81a","name":"11:panel_11","type":"visualization"},{"id":"5b0cff9f-8556-4428-b34f-13fe889001b2","name":"15:panel_15","type":"visualization"},{"id":"fa60dca2-de2c-4f2b-b441-edacc3489600","name":"19:panel_19","type":"visualization"},{"id":"04d761f8-31da-4fa6-b411-492982bffcb7","name":"20:panel_20","type":"visualization"},{"id":"7b7addff-313c-4305-a681-0e73e4fab8a5","name":"21:panel_21","type":"visualization"},{"id":"e241d441-f788-45f7-8f78-cb67ab880af7","name":"22:panel_22","type":"visualization"},{"id":"4b319ad8-e537-441c-88ee-15058cbf346b","name":"23:panel_23","type":"visualization"},{"id":"c3113842-6bb9-484f-8110-72a8652cfe4c","name":"28:panel_28","type":"search"},{"id":"5e135bcd-9c31-4c84-aff7-ea6fbb6ce752","name":"30:panel_30","type":"visualization"},{"id":"e885d176-bb6f-444a-abbc-6ce6fbf14f74","name":"b71dba65-ed1c-4917-9fc7-54923511ad2d:panel_b71dba65-ed1c-4917-9fc7-54923511ad2d","type":"visualization"},{"id":"69b1e834-ded8-4e8b-8d0d-8b870dcbdaf3","name":"96010259-5ae8-4632-bcce-34078573b1cd:panel_96010259-5ae8-4632-bcce-34078573b1cd","type":"search"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-21T19:34:03.463Z","version":"WzEzOTksMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"ed7abce5-3005-4a1f-bead-55d2c5c05971","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MjgsMV0="} -{"attributes":{"columns":["event.code","event.action","winlog.logon.type","host.name","winlog.event_data.LogonProcessName","winlog.logon.id","winlog.event_data.SubjectUserName","winlog.event_data.IpAddress","winlog.event_data.TargetDomainName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","managed":false,"references":[{"id":"ed7abce5-3005-4a1f-bead-55d2c5c05971","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MjksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Vis_sd_security_log_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Vis_sd_security_log_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Count\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"1005636a-f473-4a39-a905-ec18aa855ce1","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzAsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"696a9992-8ed1-4ca4-88f8-f075d7d7f377","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzEsMV0="} -{"attributes":{"columns":["host.name","winlog.event_id","winlog.event_data.TokenElevationType","winlog.event_data.MandatoryLabel","winlog.event_data.ProcessId","winlog.event_data.ProcessName","process.parent.executable","process.executable"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code: \\\"4688\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4688_process_creation","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","managed":false,"references":[{"id":"696a9992-8ed1-4ca4-88f8-f075d7d7f377","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzIsMV0="} -{"attributes":{"columns":["winlog.user_data.SubjectDomainName","winlog.user_data.SubjectUserName","host.name","event.code","winlog.user_data.Channel","event.module"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1102\\\" OR event.code:\\\"104\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_1102_security_log_cleared","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","managed":false,"references":[{"id":"696a9992-8ed1-4ca4-88f8-f075d7d7f377","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzMsMV0="} -{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:2\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_2","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"92562206-3ca8-4227-8dc3-c69d56598302","managed":false,"references":[{"id":"696a9992-8ed1-4ca4-88f8-f075d7d7f377","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_2_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_2_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"logon created locally\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","managed":false,"references":[{"id":"92562206-3ca8-4227-8dc3-c69d56598302","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzUsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"winlogbeat-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"b642bbb8-f3d0-4c00-83c7-4f28909ebd13","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzYsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"302f5e0c-0fe9-423a-a108-6d154e1158a9","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"winlog.channel\",\"negate\":false,\"params\":{\"query\":\"Security\"},\"type\":\"phrase\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"winlog.channel\":{\"query\":\"Security\"}}}}]}"},"title":"vis_sd_security_4624_picker","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_picker\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1570446686972\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Computername\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"21038ddc-61bb-4709-9a06-e9d399ada64a","managed":false,"references":[{"id":"b642bbb8-f3d0-4c00-83c7-4f28909ebd13","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"302f5e0c-0fe9-423a-a108-6d154e1158a9","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzgsMV0="} -{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:3\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_3","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"0d2b506b-85b9-4624-924c-a588072e5ad7","managed":false,"references":[{"id":"ed7abce5-3005-4a1f-bead-55d2c5c05971","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2MzksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"not user.name:*$\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_3_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_3_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Network logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"network logon by user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","managed":false,"references":[{"id":"0d2b506b-85b9-4624-924c-a588072e5ad7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDAsMV0="} -{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:5\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_5","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"08f51fba-7f74-4724-a424-d90fd6f433e6","managed":false,"references":[{"id":"ed7abce5-3005-4a1f-bead-55d2c5c05971","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDEsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_5_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_5_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Service account used\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon as service with user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":16,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"4752d143-4f0a-4685-b890-7a19e29a0efa","managed":false,"references":[{"id":"08f51fba-7f74-4724-a424-d90fd6f433e6","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDIsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"66c72467-6323-44b1-b788-7e7d6f5ddec5","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDMsMV0="} -{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:8\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_8","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"bbed4a2c-015d-44db-ad34-de2173a81668","managed":false,"references":[{"id":"66c72467-6323-44b1-b788-7e7d6f5ddec5","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_8_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_8_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Credentials sent in clear text\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"a7c34827-8829-4c45-81ad-26ffff747efe","managed":false,"references":[{"id":"bbed4a2c-015d-44db-ad34-de2173a81668","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDUsMV0="} -{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.WorkstationName","winlog.event_data.TargetUserName","winlog.event_data.LogonType","winlog.event_data.IpAddress","winlog.event_data.Status","winlog.event_data.SubStatus"],"description":"New settings test 9/29/2023 16:44","grid":{"columns":{"winlog.event_data.Status":{"width":221}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4625\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4625_failed_logon","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"2fc86684-4065-45c3-9847-2d4c241ec544","managed":false,"references":[{"id":"ed7abce5-3005-4a1f-bead-55d2c5c05971","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDYsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"3f754ea3-d5cc-4060-8b99-c330f973d797","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDcsMV0="} -{"attributes":{"columns":["winlog.event_data.SubjectUserName","winlog.computer_name","winlog.task","winlog.event_id","winlog.event_data.PrivilegeList"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4672\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4672_special_privileges_assigned","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","managed":false,"references":[{"id":"ed7abce5-3005-4a1f-bead-55d2c5c05971","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDgsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":\"NT AUTHORITY, Window Manager, Font Driver Host\",\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4672_special_privileges_assigned_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4672_special_privileges_assigned_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computername\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges logged on\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","managed":false,"references":[{"id":"b642bbb8-f3d0-4c00-83c7-4f28909ebd13","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NDksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_timelion","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_timelion\",\"type\":\"timelion\",\"aggs\":[],\"params\":{\"expression\":\".es(q=winlog.event_id:4625, index=logs-*,, split=winlog.computer_name:10).label(\\\"$1\\\",\\\"^.* > winlog.computer_name:(\\\\S+) > .*\\\").legend(position=ne)\",\"interval\":\"auto\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"984414eb-a284-4630-907a-db530e5cc399","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_types_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_types_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"|Logon Type|Logon Title|Description|\\n| :-: | :- | :- |\\n| 2 | Interactive | A user logged on to this computer. |\\n| 3 | Network | A user or computer logged on to this computer from the network. |\\n| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |\\n| 5 | Service | A service was started by the Service Control Manager. |\\n| 7 | Unlock | This workstation was unlocked. |\\n| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |\\n| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |\\n| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |\\n| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTEsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_status_codes_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_codes_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.LogonType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.Status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.SubStatus\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_status_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| Code | Description |\\n| :- | :- |\\n| 0XC000005E | There are currently no logon servers available to service the logon request. |\\n| 0xC0000064 | User logon with misspelled or bad user account |\\n| 0xC000006A | User logon with misspelled or bad password |\\n| 0XC000006D | This is either due to a bad username or authentication information |\\n| 0XC000006E | Unknown user name or bad password. |\\n| 0xC000006F | User logon outside authorized hours |\\n| 0xC0000070 | User logon from unauthorized workstation |\\n| 0xC0000071 | User logon with expired password |\\n| 0xC0000072 | User logon to account disabled by administrator |\\n| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |\\n| 0XC0000133 | Clocks between DC and other computer too far out of sync |\\n| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |\\n| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |\\n| 0XC0000192 | An attempt was made to logon, but the Netlogon service was not started. |\\n| 0xC0000193 | User logon with expired account |\\n| 0XC0000224 | User is required to change password at next logon |\\n| 0XC0000225 | Evidently a bug in Windows and not a risk |\\n| 0xC0000234 | User logon with account locked |\\n| 0XC00002EE | Failure Reason: An Error occurred during Logon |\\n| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |\\n| 0x0 | Status OK. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTMsMV0="} -{"attributes":{"columns":["host.name","winlog.event_data.SubjectUserName","winlog.event_data.TargetUserName","winlog.event_data.TargetServerName","winlog.event_data.SubjectDomainName","winlog.event_data.TargetDomainName","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4648 \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4648_logon_explicit_creds_running_as_different_user","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","managed":false,"references":[{"id":"696a9992-8ed1-4ca4-88f8-f075d7d7f377","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_logs_computernames_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Logged events\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"filters\",\"schema\":\"bucket\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_id : 4624\",\"language\":\"kuery\"},\"label\":\"EventID 4624\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":1000,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computername\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"vis_sd_security_logs_computernames_datatable\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"a7410752-98c4-4145-adb4-1c39506f58ca","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"a1aba1fc-12c2-48d6-8bc9-0a6af60d8abd","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTYsMV0="} -{"attributes":{"description":"Security log related events","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":24,\"h\":15,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security logs events\",\"panelRefName\":\"panel_1\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":134,\"w\":48,\"h\":17,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Process creation - event ID 4688\",\"panelRefName\":\"panel_2\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":109,\"w\":48,\"h\":8,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Log Cleared - event ID 1102 or 104\",\"panelRefName\":\"panel_3\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":151,\"w\":48,\"h\":18,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logon created - Logon type 2\",\"panelRefName\":\"panel_6\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":3,\"w\":24,\"h\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select a computer to filter the below results. Leave blank for all\",\"panelRefName\":\"panel_7\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":169,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - network logon created - Logon type 3\",\"panelRefName\":\"panel_8\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":117,\"w\":48,\"h\":17,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log events - Detail\",\"panelRefName\":\"panel_9\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":184,\"w\":48,\"h\":17,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - logon as a service - Logon type 5\",\"panelRefName\":\"panel_10\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":201,\"w\":48,\"h\":15,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Credential sent as clear text - Logon type 8\",\"panelRefName\":\"panel_11\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":18,\"w\":24,\"h\":15,\"i\":\"15\"},\"panelIndex\":\"15\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon attempts\",\"panelRefName\":\"panel_15\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":216,\"w\":48,\"h\":18,\"i\":\"19\"},\"panelIndex\":\"19\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logons with special privileges assigned - event ID 4672\",\"panelRefName\":\"panel_19\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":18,\"w\":24,\"h\":15,\"i\":\"20\"},\"panelIndex\":\"20\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Computers showing failed login attempts - 10 maximum shown\",\"panelRefName\":\"panel_20\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":33,\"w\":48,\"h\":18,\"i\":\"21\"},\"panelIndex\":\"21\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon type codes\",\"panelRefName\":\"panel_21\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":16,\"i\":\"22\"},\"panelIndex\":\"22\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon and reason (status code)\",\"panelRefName\":\"panel_22\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":83,\"w\":48,\"h\":26,\"i\":\"23\"},\"panelIndex\":\"23\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon status codes\",\"panelRefName\":\"panel_23\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":234,\"w\":48,\"h\":15,\"i\":\"28\"},\"panelIndex\":\"28\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"title\":\"Security log - Process started with different credentials- event ID 4648 [could be RUNAS, scheduled tasks]\",\"panelRefName\":\"panel_28\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":11,\"w\":24,\"h\":7,\"i\":\"30\"},\"panelIndex\":\"30\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"title\":\"Select a computername to filter\",\"panelRefName\":\"panel_30\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"b71dba65-ed1c-4917-9fc7-54923511ad2d\"},\"panelIndex\":\"b71dba65-ed1c-4917-9fc7-54923511ad2d\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b71dba65-ed1c-4917-9fc7-54923511ad2d\"},{\"version\":\"8.7.1\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":67,\"w\":48,\"h\":16,\"i\":\"96010259-5ae8-4632-bcce-34078573b1cd\"},\"panelIndex\":\"96010259-5ae8-4632-bcce-34078573b1cd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed Logons\",\"panelRefName\":\"panel_96010259-5ae8-4632-bcce-34078573b1cd\"}]","timeRestore":false,"title":"Security Dashboard - Security Log.2.0","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T17:35:04.094Z","id":"beeeb066-d497-4b2a-99d3-44d741238bd1","managed":false,"references":[{"id":"1005636a-f473-4a39-a905-ec18aa855ce1","name":"1:panel_1","type":"visualization"},{"id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","name":"2:panel_2","type":"search"},{"id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","name":"3:panel_3","type":"search"},{"id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","name":"6:panel_6","type":"visualization"},{"id":"21038ddc-61bb-4709-9a06-e9d399ada64a","name":"7:panel_7","type":"visualization"},{"id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","name":"8:panel_8","type":"visualization"},{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"9:panel_9","type":"search"},{"id":"4752d143-4f0a-4685-b890-7a19e29a0efa","name":"10:panel_10","type":"visualization"},{"id":"a7c34827-8829-4c45-81ad-26ffff747efe","name":"11:panel_11","type":"visualization"},{"id":"3f754ea3-d5cc-4060-8b99-c330f973d797","name":"15:panel_15","type":"visualization"},{"id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","name":"19:panel_19","type":"visualization"},{"id":"984414eb-a284-4630-907a-db530e5cc399","name":"20:panel_20","type":"visualization"},{"id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","name":"21:panel_21","type":"visualization"},{"id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","name":"22:panel_22","type":"visualization"},{"id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","name":"23:panel_23","type":"visualization"},{"id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","name":"28:panel_28","type":"search"},{"id":"a7410752-98c4-4145-adb4-1c39506f58ca","name":"30:panel_30","type":"visualization"},{"id":"a1aba1fc-12c2-48d6-8bc9-0a6af60d8abd","name":"b71dba65-ed1c-4917-9fc7-54923511ad2d:panel_b71dba65-ed1c-4917-9fc7-54923511ad2d","type":"visualization"},{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"96010259-5ae8-4632-bcce-34078573b1cd:panel_96010259-5ae8-4632-bcce-34078573b1cd","type":"search"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-23T17:35:04.094Z","version":"WzI2NTcsMV0="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":60,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file +{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{\"event.action\":{\"count\":2},\"process.name\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.KeyFilePath\":{\"count\":2},\"file.path\":{\"count\":1},\"event.code\":{\"count\":1},\"event.provider\":{\"count\":1}}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:37.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"logs-*","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:37.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzEzNiwxXQ=="} +{"attributes":{"columns":["event.code","event.action","winlog.logon.type","host.name","winlog.event_data.LogonProcessName","winlog.logon.id","winlog.event_data.SubjectUserName","winlog.event_data.IpAddress","winlog.event_data.TargetDomainName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Vis_sd_security_log_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Vis_sd_security_log_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Count\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1005636a-f473-4a39-a905-ec18aa855ce1","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_id","winlog.event_data.TokenElevationType","winlog.event_data.MandatoryLabel","winlog.event_data.ProcessId","winlog.event_data.ProcessName","process.parent.executable","process.executable"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code: \\\"4688\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4688_process_creation","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOCwxXQ=="} +{"attributes":{"columns":["winlog.user_data.SubjectDomainName","winlog.user_data.SubjectUserName","host.name","event.code","winlog.user_data.Channel","event.module"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1102\\\" OR event.code:\\\"104\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_1102_security_log_cleared","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:2\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_2","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"92562206-3ca8-4227-8dc3-c69d56598302","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_2_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_2_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"logon created locally\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","managed":false,"references":[{"id":"92562206-3ca8-4227-8dc3-c69d56598302","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"winlog.channel\",\"negate\":false,\"params\":{\"query\":\"Security\"},\"type\":\"phrase\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"winlog.channel\":{\"query\":\"Security\"}}}}]}"},"title":"vis_sd_security_4624_picker","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_picker\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1570446686972\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Computername\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"21038ddc-61bb-4709-9a06-e9d399ada64a","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMiwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:3\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_3","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"0d2b506b-85b9-4624-924c-a588072e5ad7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"not user.name:*$\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_3_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_3_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Network logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"network logon by user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","managed":false,"references":[{"id":"0d2b506b-85b9-4624-924c-a588072e5ad7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:5\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_5","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"08f51fba-7f74-4724-a424-d90fd6f433e6","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_5_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_5_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Service account used\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon as service with user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":16,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4752d143-4f0a-4685-b890-7a19e29a0efa","managed":false,"references":[{"id":"08f51fba-7f74-4724-a424-d90fd6f433e6","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:8\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_8","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bbed4a2c-015d-44db-ad34-de2173a81668","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_8_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_8_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Credentials sent in clear text\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7c34827-8829-4c45-81ad-26ffff747efe","managed":false,"references":[{"id":"bbed4a2c-015d-44db-ad34-de2173a81668","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.WorkstationName","winlog.event_data.TargetUserName","winlog.event_data.LogonType","winlog.event_data.IpAddress","winlog.event_data.Status","winlog.event_data.SubStatus"],"description":"New settings test 9/29/2023 16:44","grid":{"columns":{"winlog.event_data.Status":{"width":221}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4625\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4625_failed_logon","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc86684-4065-45c3-9847-2d4c241ec544","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f754ea3-d5cc-4060-8b99-c330f973d797","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectUserName","winlog.computer_name","winlog.task","winlog.event_id","winlog.event_data.PrivilegeList"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4672\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4672_special_privileges_assigned","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":\"NT AUTHORITY, Window Manager, Font Driver Host\",\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4672_special_privileges_assigned_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4672_special_privileges_assigned_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computername\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges logged on\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_types_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_types_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"|Logon Type|Logon Title|Description|\\n| :-: | :- | :- |\\n| 2 | Interactive | A user logged on to this computer. |\\n| 3 | Network | A user or computer logged on to this computer from the network. |\\n| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |\\n| 5 | Service | A service was started by the Service Control Manager. |\\n| 7 | Unlock | This workstation was unlocked. |\\n| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |\\n| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |\\n| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |\\n| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_status_codes_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_codes_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.LogonType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.Status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.SubStatus\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":true,\"truncateLegend\":true,\"maxLegendLines\":5,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_status_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| Code | Description |\\n| :- | :- |\\n| 0XC000005E | There are currently no logon servers available to service the logon request. |\\n| 0xC0000064 | User logon with misspelled or bad user account |\\n| 0xC000006A | User logon with misspelled or bad password |\\n| 0XC000006D | This is either due to a bad username or authentication information |\\n| 0XC000006E | Unknown user name or bad password. |\\n| 0xC000006F | User logon outside authorized hours |\\n| 0xC0000070 | User logon from unauthorized workstation |\\n| 0xC0000071 | User logon with expired password |\\n| 0xC0000072 | User logon to account disabled by administrator |\\n| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |\\n| 0XC0000133 | Clocks between DC and other computer too far out of sync |\\n| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |\\n| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |\\n| 0XC0000192 | An attempt was made to logon, but the Netlogon service was not started. |\\n| 0xC0000193 | User logon with expired account |\\n| 0XC0000224 | User is required to change password at next logon |\\n| 0XC0000225 | Evidently a bug in Windows and not a risk |\\n| 0xC0000234 | User logon with account locked |\\n| 0XC00002EE | Failure Reason: An Error occurred during Logon |\\n| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |\\n| 0x0 | Status OK. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SubjectUserName","winlog.event_data.TargetUserName","winlog.event_data.TargetServerName","winlog.event_data.SubjectDomainName","winlog.event_data.TargetDomainName","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4648 \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4648_logon_explicit_creds_running_as_different_user","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_logs_computernames_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Logged events\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"filters\",\"schema\":\"bucket\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_id : 4624\",\"language\":\"kuery\"},\"label\":\"EventID 4624\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":1000,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computername\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"vis_sd_security_logs_computernames_datatable\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7410752-98c4-4145-adb4-1c39506f58ca","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - MITRE Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - MITRE Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### MITRE ATT&CK Technique\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"63587a03-5f00-4678-b1fa-99b31a719c25","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"high\\\" or signal.rule.severity : \\\"critical\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Critical Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"133f677c-628d-4684-af5f-0c906e4101cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Mitre Technique Table2","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Mitre Technique Table2\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"MITRE ID\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.reference\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Reference\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":true,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1993dc60-efe8-46ec-952d-cc4d513cee72","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"medium\\\" or signal.rule.severity : \\\"low\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Suspicious Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Signals Overview","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signals Overview\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Suspicious Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","managed":false,"references":[{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Signal guage","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signal guage\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signal Gauge\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Signals Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Signals Overview\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Signals Data Table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Signals Data Table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":105,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Rule Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.tactic.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":500,\"otherBucket\":false,\"otherBucketLabel\":\"Uncatergorised\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Tactic\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.severity\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Severity\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":11,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Rule Name\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Uncatergorised\",\"otherBucketLabel\":\"Uncatergorised\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Tactic\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Severity\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Technique\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"Alerting - Signals Details","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Details\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signals Details \\n[View alerts dashboard](/app/security/alerts)\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Further Signals Info","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Further Signals Info\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":250,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\".\"},\"schema\":\"split\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"event.created\",\"timeRange\":{\"from\":\"now-24h\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30m\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No host data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Hostname\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No User Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"1\"},\"schema\":\"bucket\"},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column2\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"2\"},\"schema\":\"bucket\"},{\"id\":\"8\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column3\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"3\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":1,\"aggType\":\"date_histogram\",\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm\"}},\"label\":\"event.created per 30 minutes\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No host data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"Hostname\",\"params\":{}},{\"accessor\":3,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No User Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"User\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"1\",\"params\":{}},{\"accessor\":5,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"2\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"3\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}],\"splitRow\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\".\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"row\":true,\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Event Log Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Event Log Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Full Event Logs\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MCwxXQ=="} +{"attributes":{"color":"#e5e289","description":"Logging Made Easy Custom Dashboards","name":"Logging Made Easy"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"05484269-a438-43a1-8114-4f32479f51c4","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2MywxXQ=="} +{"attributes":{"description":"Alerting Overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":false,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":true}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":28,\"i\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},\"panelIndex\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":0,\"w\":10,\"h\":4,\"i\":\"02fa17ed-1419-415c-9a27-f90684d5645f\"},\"panelIndex\":\"02fa17ed-1419-415c-9a27-f90684d5645f\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Critical Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":0,\"w\":27,\"h\":5,\"i\":\"3832099d-1166-44f0-a766-270f65ae20c3\"},\"panelIndex\":\"3832099d-1166-44f0-a766-270f65ae20c3\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_3832099d-1166-44f0-a766-270f65ae20c3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":4,\"w\":10,\"h\":21,\"i\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\"},\"panelIndex\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"uiState\":{},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Critical Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"enhancements\":{},\"hidePanelTitles\":false,\"description\":\"This panel shows critical signals\"},\"title\":\"Signals Overview\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":5,\"w\":27,\"h\":17,\"i\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},\"panelIndex\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":28,\"w\":11,\"h\":4,\"i\":\"8459632e-bab5-491a-aad4-d40a09d9589e\"},\"panelIndex\":\"8459632e-bab5-491a-aad4-d40a09d9589e\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Suspicious Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":32,\"w\":11,\"h\":21,\"i\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\"},\"panelIndex\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_543e736d-1e0e-4096-a02d-a00b7a145ad8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":22,\"w\":27,\"h\":4,\"i\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\"},\"panelIndex\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_1688fd32-5aa8-4358-8587-d46f4e11613e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":26,\"w\":27,\"h\":25,\"i\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\"},\"panelIndex\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"gauge\",\"params\":{\"type\":\"gauge\",\"addTooltip\":true,\"addLegend\":true,\"isDisplayWarning\":false,\"gauge\":{\"alignment\":\"automatic\",\"extendRange\":true,\"percentageMode\":false,\"gaugeType\":\"Arc\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"Labels\",\"colorsRange\":[{\"from\":0,\"to\":50},{\"from\":50,\"to\":75},{\"from\":75,\"to\":100}],\"invertColors\":false,\"labels\":{\"show\":true,\"color\":\"black\"},\"scale\":{\"show\":true,\"labels\":false,\"color\":\"rgba(105,112,125,0.2)\"},\"type\":\"meter\",\"style\":{\"bgWidth\":0.9,\"width\":0.9,\"mask\":false,\"bgMask\":false,\"maskBars\":50,\"bgFill\":\"rgba(105,112,125,0.2)\",\"bgColor\":true,\"subText\":\"\",\"fontSize\":60}}},\"uiState\":{\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"}}},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{}}},\"hidePanelTitles\":false,\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"},\"legendOpen\":false}},\"title\":\"Alert Gauge\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":53,\"w\":21,\"h\":5,\"i\":\"93136da7-3849-4932-92f2-a443350636f2\"},\"panelIndex\":\"93136da7-3849-4932-92f2-a443350636f2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_93136da7-3849-4932-92f2-a443350636f2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":58,\"w\":21,\"h\":17,\"i\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\"},\"panelIndex\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_aa385ced-e59f-4096-8b49-ad0014c0087c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":75,\"w\":48,\"h\":8,\"i\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},\"panelIndex\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":83,\"w\":48,\"h\":21,\"i\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\"},\"panelIndex\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"asc\"}}},\"enhancements\":{}},\"panelRefName\":\"panel_a7f758eb-65c6-4202-86a3-b8b4a169845c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":104,\"w\":48,\"h\":6,\"i\":\"25f49696-70e2-472e-9992-287665c7db7d\"},\"panelIndex\":\"25f49696-70e2-472e-9992-287665c7db7d\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_25f49696-70e2-472e-9992-287665c7db7d\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":110,\"w\":48,\"h\":28,\"i\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\"},\"panelIndex\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"panelRefName\":\"panel_38cb573e-5533-48f8-874d-5cfd5929d68a\"}]","refreshInterval":{"pause":true,"value":0},"timeFrom":"now-7d/d","timeRestore":true,"timeTo":"now","title":"Alerting Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"baa4f981-0c75-43da-b96e-1107f171dfaa","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0:panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0","type":"links"},{"id":"63587a03-5f00-4678-b1fa-99b31a719c25","name":"3832099d-1166-44f0-a766-270f65ae20c3:panel_3832099d-1166-44f0-a766-270f65ae20c3","type":"visualization"},{"id":"133f677c-628d-4684-af5f-0c906e4101cb","name":"33d73051-f4d8-4ca0-826c-3d7060fa75da:search_0","type":"search"},{"id":"1993dc60-efe8-46ec-952d-cc4d513cee72","name":"2ab0a53c-c5c7-4116-afff-e0d119aeefa9:panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9","type":"visualization"},{"id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","name":"543e736d-1e0e-4096-a02d-a00b7a145ad8:panel_543e736d-1e0e-4096-a02d-a00b7a145ad8","type":"visualization"},{"id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","name":"1688fd32-5aa8-4358-8587-d46f4e11613e:panel_1688fd32-5aa8-4358-8587-d46f4e11613e","type":"visualization"},{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"739bc01e-ec0f-4565-92e3-1af95510fc60:search_0","type":"search"},{"id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","name":"93136da7-3849-4932-92f2-a443350636f2:panel_93136da7-3849-4932-92f2-a443350636f2","type":"visualization"},{"id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","name":"aa385ced-e59f-4096-8b49-ad0014c0087c:panel_aa385ced-e59f-4096-8b49-ad0014c0087c","type":"visualization"},{"id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","name":"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b:panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b","type":"visualization"},{"id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","name":"a7f758eb-65c6-4202-86a3-b8b4a169845c:panel_a7f758eb-65c6-4202-86a3-b8b4a169845c","type":"visualization"},{"id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","name":"25f49696-70e2-472e-9992-287665c7db7d:panel_25f49696-70e2-472e-9992-287665c7db7d","type":"visualization"},{"id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","name":"38cb573e-5533-48f8-874d-5cfd5929d68a:panel_38cb573e-5533-48f8-874d-5cfd5929d68a","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_host_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_chc_host_count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_filter_hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_filter_hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Events\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"Host name\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ae4d4888-b29b-459a-a369-ece810d70325","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"title_chc_software","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"title_chc_software\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Software\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"65c534a3-beee-4140-83ef-d511662e9ffa","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.param1","winlog.event_data.param11","winlog.event_data.param12","winlog.provider_name"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1000 or event.code:1002\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_proc_crash","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6c264739-59d8-4fd3-af36-27332178d08f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_proc_crashes","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_proc_crashes\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"0ms\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{},\"customLabel\":\"Date\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"interpolate\":\"linear\",\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_chc_crash_table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_crash_table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user_data.param1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Application\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"winlog.event_data.param1: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3cf72536-3546-4c88-9b4b-46cede29474f","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SourceImage","winlog.event_data.TargetImage"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:8 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_chc_create_remote_thread","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OCwxXQ=="} +{"attributes":{"description":"Shows software running on hosts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":21,\"i\":\"23406828-78ea-414f-b7eb-b1c76db1a992\"},\"panelIndex\":\"23406828-78ea-414f-b7eb-b1c76db1a992\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_23406828-78ea-414f-b7eb-b1c76db1a992\"},{\"type\":\"visualization\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":21,\"i\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\"},\"panelIndex\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Host Count\",\"panelRefName\":\"panel_67acd3d3-1fe1-4027-8e0d-17369b15986f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":21,\"i\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\"},\"panelIndex\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Filter Hosts\",\"panelRefName\":\"panel_bde0ab63-0219-412e-90b3-029fc58aa2df\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":4,\"i\":\"974eebf8-3870-403f-b4b8-0151e57408e1\"},\"panelIndex\":\"974eebf8-3870-403f-b4b8-0151e57408e1\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":true},\"panelRefName\":\"panel_974eebf8-3870-403f-b4b8-0151e57408e1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":25,\"w\":24,\"h\":15,\"i\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},\"panelIndex\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging\",\"panelRefName\":\"panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":25,\"w\":24,\"h\":15,\"i\":\"06f203bf-d632-4f1a-b024-67ec7373873b\"},\"panelIndex\":\"06f203bf-d632-4f1a-b024-67ec7373873b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging Count\",\"panelRefName\":\"panel_06f203bf-d632-4f1a-b024-67ec7373873b\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":56,\"w\":48,\"h\":15,\"i\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},\"panelIndex\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"CreateRemoteThread events\",\"panelRefName\":\"panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":16,\"i\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\"},\"panelIndex\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273\"}],\"state\":{\"visualization\":{\"layerId\":\"f9c66ef1-e443-4a34-950c-5c9556714273\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"isTransposed\":false,\"isMetric\":false},{\"isTransposed\":false,\"columnId\":\"1b266c97-5508-45bb-bb55-40f392f3de3c\"},{\"isTransposed\":false,\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"}]},\"query\":{\"query\":\"event.code: \\\"1\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f9c66ef1-e443-4a34-950c-5c9556714273\":{\"columns\":{\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":100,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1b266c97-5508-45bb-bb55-40f392f3de3c\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"1b266c97-5508-45bb-bb55-40f392f3de3c\",\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"],\"sampling\":1,\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Processes\"}]","timeRestore":false,"title":"Computer Software Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"23406828-78ea-414f-b7eb-b1c76db1a992:panel_23406828-78ea-414f-b7eb-b1c76db1a992","type":"links"},{"id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","name":"67acd3d3-1fe1-4027-8e0d-17369b15986f:panel_67acd3d3-1fe1-4027-8e0d-17369b15986f","type":"visualization"},{"id":"ae4d4888-b29b-459a-a369-ece810d70325","name":"bde0ab63-0219-412e-90b3-029fc58aa2df:panel_bde0ab63-0219-412e-90b3-029fc58aa2df","type":"visualization"},{"id":"65c534a3-beee-4140-83ef-d511662e9ffa","name":"974eebf8-3870-403f-b4b8-0151e57408e1:panel_974eebf8-3870-403f-b4b8-0151e57408e1","type":"visualization"},{"id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","name":"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f:panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f","type":"visualization"},{"id":"3cf72536-3546-4c88-9b4b-46cede29474f","name":"06f203bf-d632-4f1a-b024-67ec7373873b:panel_06f203bf-d632-4f1a-b024-67ec7373873b","type":"visualization"},{"id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","name":"9f671b0e-5ffb-46b6-af00-9dbc4d241121:panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121","type":"search"},{"id":"logs-*","name":"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f:indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1bb35497-6257-4b29-95fa-579306bda91a\"},\"panelIndex\":\"1bb35497-6257-4b29-95fa-579306bda91a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1bb35497-6257-4b29-95fa-579306bda91a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\"},\"panelIndex\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\",\"embeddableConfig\":{\"enhancements\":{},\"attributes\":{\"title\":\"Audit logons\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b\"}],\"state\":{\"visualization\":{\"layers\":[{\"categoryDisplay\":\"default\",\"layerId\":\"9da2d10b-4d81-4f9b-abbc-d950139a209b\",\"layerType\":\"data\",\"legendDisplay\":\"default\",\"metrics\":[\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"nestedLegend\":false,\"numberDisplay\":\"percent\",\"primaryGroups\":[\"2609b197-b493-4da4-9526-21b71512702a\"]}],\"shape\":\"donut\"},\"query\":{\"language\":\"kuery\",\"query\":\"4624\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9da2d10b-4d81-4f9b-abbc-d950139a209b\":{\"columnOrder\":[\"2609b197-b493-4da4-9526-21b71512702a\",\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"columns\":{\"2609b197-b493-4da4-9526-21b71512702a\":{\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"Top 5 values of host.name\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"ca9653b4-9247-4c13-98e0-beeb95821de0\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"host.name\"},\"ca9653b4-9247-4c13-98e0-beeb95821de0\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"}},\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":15,\"i\":\"6c884475-eba9-42bb-bcb7-145a5be31420\"},\"panelIndex\":\"6c884475-eba9-42bb-bcb7-145a5be31420\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos ticket - Failed attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"a40bb6e7-f754-425d-92c6-f94e9601af3c\",\"seriesType\":\"line\",\"xAccessor\":\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"splitAccessor\":\"fa882916-213f-40d3-b79e-216a43c16a72\",\"accessors\":[\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4769\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a40bb6e7-f754-425d-92c6-f94e9601af3c\":{\"columns\":{\"fa882916-213f-40d3-b79e-216a43c16a72\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"cb6cedeb-8521-4443-8bbc-c372817d75d7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fa882916-213f-40d3-b79e-216a43c16a72\",\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":15,\"w\":24,\"h\":7,\"i\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\"},\"panelIndex\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Account lockout -attempts\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1\"}],\"state\":{\"visualization\":{\"layerId\":\"42d33e36-7a47-4658-9792-5eff5f4918d1\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"ee31adc4-0bbd-40e0-86de-df6578c560b9\"},{\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4625\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"42d33e36-7a47-4658-9792-5eff5f4918d1\":{\"columns\":{\"ee31adc4-0bbd-40e0-86de-df6578c560b9\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ee31adc4-0bbd-40e0-86de-df6578c560b9\",\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":7,\"i\":\"17865857-b6e0-4e72-bf28-44b64f154df7\"},\"panelIndex\":\"17865857-b6e0-4e72-bf28-44b64f154df7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Special logon-attempts\",\"description\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707\"}],\"state\":{\"visualization\":{\"layerId\":\"67cdda05-ae7c-41b9-8a85-1e49828e9707\",\"layerType\":\"data\",\"metricAccessor\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\",\"breakdownByAccessor\":\"83a5ad17-791e-4869-bbb3-1a7465716837\"},\"query\":{\"language\":\"kuery\",\"query\":\"4672\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67cdda05-ae7c-41b9-8a85-1e49828e9707\":{\"columns\":{\"83a5ad17-791e-4869-bbb3-1a7465716837\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"83a5ad17-791e-4869-bbb3-1a7465716837\",\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":22,\"w\":24,\"h\":12,\"i\":\"face26df-a171-4753-8cda-79dea7b83ab6\"},\"panelIndex\":\"face26df-a171-4753-8cda-79dea7b83ab6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos auth request\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"d29fda24-60a4-4ddd-bf19-67175ef85af2\",\"primaryGroups\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\"],\"metrics\":[\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"default\",\"legendDisplay\":\"default\",\"nestedLegend\":false,\"layerType\":\"data\"}]},\"query\":{\"query\":\"4768\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d29fda24-60a4-4ddd-bf19-67175ef85af2\":{\"columns\":{\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a20bff59-6317-4758-ab4f-0bec099cd004\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"a20bff59-6317-4758-ab4f-0bec099cd004\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\",\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":24,\"h\":12,\"i\":\"29494e18-b33e-457b-9a07-664463eaf1e6\"},\"panelIndex\":\"29494e18-b33e-457b-9a07-664463eaf1e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Other logon /logoff-Disconnection attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"splitAccessor\":\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"accessors\":[\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4779\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\":{\"columns\":{\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":34,\"w\":24,\"h\":15,\"i\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\"},\"panelIndex\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Credential validation- attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"79c23cfd-619e-4bc7-bbca-d2564165f04b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"splitAccessor\":\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"accessors\":[\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4776\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"79c23cfd-619e-4bc7-bbca-d2564165f04b\":{\"columns\":{\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c4de01ed-8a99-4230-9cc5-6889447a60b6\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":24,\"h\":15,\"i\":\"b819c130-6164-41e4-8188-984964e44e39\"},\"panelIndex\":\"b819c130-6164-41e4-8188-984964e44e39\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon attempts by hosts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_horizontal_stacked\",\"layers\":[{\"layerId\":\"d8138ff4-5996-4544-9b28-98739cc15747\",\"seriesType\":\"bar_horizontal_stacked\",\"xAccessor\":\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"accessors\":[\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4624\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d8138ff4-5996-4544-9b28-98739cc15747\":{\"columns\":{\"d0dd77ee-78c7-457b-ad0d-ebe327215549\":{\"label\":\" host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":55,\"w\":24,\"h\":15,\"i\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\"},\"panelIndex\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon-using explicit credential attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"accessors\":[\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\",\"color\":\"#6092c0\"}]}]},\"query\":{\"query\":\"4648\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\":{\"columns\":{\"c19cba52-bfca-46e4-9ff9-e46579e4d378\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"},\"orderDirection\":\"asc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}}]","timeRestore":false,"title":"Credential Access logs Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e4d7b207-99aa-4410-8a2e-03487222bda1","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1bb35497-6257-4b29-95fa-579306bda91a:panel_1bb35497-6257-4b29-95fa-579306bda91a","type":"links"},{"id":"logs-*","name":"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2:indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b","type":"index-pattern"},{"id":"logs-*","name":"6c884475-eba9-42bb-bcb7-145a5be31420:indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c","type":"index-pattern"},{"id":"logs-*","name":"62e638ae-d23f-47dd-834b-bdcb2902f527:indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1","type":"index-pattern"},{"id":"logs-*","name":"17865857-b6e0-4e72-bf28-44b64f154df7:indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707","type":"index-pattern"},{"id":"logs-*","name":"face26df-a171-4753-8cda-79dea7b83ab6:indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2","type":"index-pattern"},{"id":"logs-*","name":"29494e18-b33e-457b-9a07-664463eaf1e6:indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317","type":"index-pattern"},{"id":"logs-*","name":"f2c86900-93cc-4480-bd84-f63f0cb0ac79:indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b","type":"index-pattern"},{"id":"logs-*","name":"b819c130-6164-41e4-8188-984964e44e39:indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747","type":"index-pattern"},{"id":"logs-*","name":"0d81bae9-3b04-4344-98f0-49202a2258ce:indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alpha - Health Check - Total Hosts - Metric","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alpha - Health Check - Total Hosts - Metric\",\"type\":\"metric\",\"aggs\":[{\"id\":\"3\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Total Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f0e888d4-b9e1-402f-8481-4195773d8a82","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Events by machine","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Events by machine\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Number of events seen\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"segment\"}],\"params\":{\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"62711d6d-17f8-4c2d-aa37-b11717455e53","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Users seen","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Users seen\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"winlog.user.name\",\"customLabel\":\"Users seen (total)\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8c34636f-01f4-4b46-b519-3120e5fe1731","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Unexpected Power Off","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Unexpected shutdowns","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Unexpected shutdowns\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":50,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","managed":false,"references":[{"id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNSwxXQ=="} +{"attributes":{"description":"Health Check overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},\"panelIndex\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":11,\"i\":\"ba924baf-3793-418e-a1de-ff805560f85b\"},\"panelIndex\":\"ba924baf-3793-418e-a1de-ff805560f85b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Total Hosts\",\"panelRefName\":\"panel_ba924baf-3793-418e-a1de-ff805560f85b\"},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":12,\"h\":21,\"i\":\"2b349db3-6677-43de-99ff-111253bee020\"},\"panelIndex\":\"2b349db3-6677-43de-99ff-111253bee020\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Alpha - Health Check - Number of Admins - Metric (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\",\"shouldTruncate\":true,\"maxLines\":5,\"legendStats\":[\"currentAndLastValue\"]},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"bf39875d-159e-4950-8c3d-803a61d82313\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"accessors\":[\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"winlog.event_id:1 and winlog.event_data.IntegrityLevel : \\\"High\\\" and not \\\"NT VIRTUAL MACHINE\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"1aab2c4b-51a1-4b7a-8173-1d0c9fb242a5\",\"key\":\"winlog.user.name\",\"field\":\"winlog.user.name\",\"type\":\"exists\"},\"query\":{\"exists\":{\"field\":\"winlog.user.name\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bf39875d-159e-4950-8c3d-803a61d82313\":{\"columns\":{\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"cf94e195-c66f-4040-9aee-44a0c719091a\":{\"label\":\"Unique Count of Admin Users\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}}},\"customLabel\":true}},\"columnOrder\":[\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Number of Admins\"},{\"type\":\"visualization\",\"gridData\":{\"x\":28,\"y\":0,\"w\":17,\"h\":21,\"i\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},\"panelIndex\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":8,\"h\":10,\"i\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},\"panelIndex\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":45,\"h\":12,\"i\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"},\"panelIndex\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"panelRefName\":\"panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"}]","timeRestore":false,"title":"HealthCheck Dashboard - Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fff78bfe-2758-4fa1-939f-362380fc607d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a:panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a","type":"links"},{"id":"f0e888d4-b9e1-402f-8481-4195773d8a82","name":"ba924baf-3793-418e-a1de-ff805560f85b:panel_ba924baf-3793-418e-a1de-ff805560f85b","type":"visualization"},{"id":"logs-*","name":"2b349db3-6677-43de-99ff-111253bee020:indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313","type":"index-pattern"},{"id":"62711d6d-17f8-4c2d-aa37-b11717455e53","name":"9479b8b7-fd3b-4160-8d3a-d7e4685c5819:panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819","type":"visualization"},{"id":"8c34636f-01f4-4b46-b519-3120e5fe1731","name":"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118:panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118","type":"visualization"},{"id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","name":"c4bcdc99-aaf7-4555-8ed0-d99f701396f2:panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"password_resets_and_changes logs","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"user_lockouts","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:1502\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_default_domain_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},\"panelIndex\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":28,\"h\":21,\"i\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\"},\"panelIndex\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\",\"accessors\":[\"40ece351-d270-400e-8da5-c469d428770f\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\"}]},\"query\":{\"query\":\"winlog.event_id:4657\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\":{\"columns\":{\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"40ece351-d270-400e-8da5-c469d428770f\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\",\"40ece351-d270-400e-8da5-c469d428770f\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Registry Object Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":36,\"y\":0,\"w\":12,\"h\":21,\"i\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\"},\"panelIndex\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df\"}],\"state\":{\"visualization\":{\"layerId\":\"8d620430-5405-4088-949e-1c7c369784df\",\"accessor\":\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4698\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8d620430-5405-4088-949e-1c7c369784df\":{\"columns\":{\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\":{\"label\":\"New Scheduled Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"winlog.event_id\",\"params\":{\"emptyAsNull\":false},\"customLabel\":true}},\"columnOrder\":[\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"New Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"c4767fa6-123a-4f2c-958f-504253babada\"},\"panelIndex\":\"c4767fa6-123a-4f2c-958f-504253babada\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Password Resets and Changes Logs\",\"panelRefName\":\"panel_c4767fa6-123a-4f2c-958f-504253babada\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\"},\"panelIndex\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2\"}],\"state\":{\"visualization\":{\"layerId\":\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\",\"accessor\":\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4702\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\":{\"columns\":{\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\":{\"label\":\"Updated Scheduler Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Updated Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":36,\"w\":24,\"h\":15,\"i\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},\"panelIndex\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"User Lockouts\",\"panelRefName\":\"panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":36,\"w\":24,\"h\":15,\"i\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\"},\"panelIndex\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\",\"accessors\":[\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"baf404fd-0f09-4df0-a861-2f15b539ca51\"}]},\"query\":{\"query\":\"winlog.event_id:4724 or winlog.event_id:4723\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\":{\"columns\":{\"baf404fd-0f09-4df0-a861-2f15b539ca51\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"51979016-6414-4ce0-aa1e-bb07e33110c0\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"baf404fd-0f09-4df0-a861-2f15b539ca51\",\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Resets and Changes\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":51,\"w\":24,\"h\":15,\"i\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\"},\"panelIndex\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\",\"accessors\":[\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"8e283438-d965-48a0-b803-cea59d83d093\"}]},\"query\":{\"query\":\"winlog.event_id:4782\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\":{\"columns\":{\"8e283438-d965-48a0-b803-cea59d83d093\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"96f3ed8f-397d-4947-ab3c-789a15fb329c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"8e283438-d965-48a0-b803-cea59d83d093\",\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Hash Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":51,\"w\":24,\"h\":15,\"i\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\"},\"panelIndex\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\",\"accessors\":[\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\"}]},\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\":{\"columns\":{\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\",\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"User Lockouts\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":66,\"w\":24,\"h\":15,\"i\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\"},\"panelIndex\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Changes to Default Domain Policy\",\"panelRefName\":\"panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9\"}]","timeRestore":false,"title":"Identity Access Management 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1fafa69c-12b3-49eb-b4dc-cd14591eb597:panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597","type":"links"},{"id":"logs-*","name":"68d682d0-f9a5-44c1-a0a0-9f731f970cd0:indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c","type":"index-pattern"},{"id":"logs-*","name":"d5d99e08-12e4-4f56-8a89-9b9e52b6a007:indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df","type":"index-pattern"},{"id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","name":"c4767fa6-123a-4f2c-958f-504253babada:panel_c4767fa6-123a-4f2c-958f-504253babada","type":"search"},{"id":"logs-*","name":"15b71263-a739-41f2-bc7c-38a5586aec9d:indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2","type":"index-pattern"},{"id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","name":"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81:panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81","type":"search"},{"id":"logs-*","name":"35f07da3-7a63-455b-b393-adf2032d5a7a:indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd","type":"index-pattern"},{"id":"logs-*","name":"ce9cad31-6b06-472c-b249-d0ad1efcb5cf:indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf","type":"index-pattern"},{"id":"logs-*","name":"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72:indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c","type":"index-pattern"},{"id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","name":"ac85c23f-b911-474e-b45e-cbbf1456c9a9:panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:\\\"4946\\\" or winlog.event_id:\\\"4947\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"new_or_modified_exception_list_rules","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4950\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_settings","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4954\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7b4c9843-87d7-42b9-935e-ff4713840de3","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5024 or winlog.event_id:5033\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned on","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5025 or winlog.event_id:5034\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned off","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"53b18c74-3370-4237-a524-90fd7489bf47","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4719\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_audit_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"26bac78a-07ef-4925-9473-4e2f60e5c151","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4713\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_kerberos","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},\"panelIndex\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":14,\"h\":21,\"i\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\"},\"panelIndex\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f\"}],\"state\":{\"visualization\":{\"layerId\":\"b64767f2-cf92-4fc3-b001-8e256e39314f\",\"accessor\":\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b64767f2-cf92-4fc3-b001-8e256e39314f\":{\"columns\":{\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\":{\"label\":\"RPC Connection Attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":2}}},\"customLabel\":true}},\"columnOrder\":[\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"RPC Connection Attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":14,\"h\":21,\"i\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\"},\"panelIndex\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee\"}],\"state\":{\"visualization\":{\"layerId\":\"44404bd2-1430-4712-9667-3fa30aed28ee\",\"accessor\":\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4946 or winlog.event_id:4947\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"44404bd2-1430-4712-9667-3fa30aed28ee\":{\"columns\":{\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\":{\"label\":\"Added or Updated Rules to Firewall Exception List\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":14,\"i\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\"},\"panelIndex\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"357c66cc-ad43-42ef-807c-5911c93ab357\",\"accessors\":[\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\"}]},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"357c66cc-ad43-42ef-807c-5911c93ab357\":{\"columns\":{\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"ecc638ab-21e8-4123-a662-cf612107dedd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\",\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"RPC Connections\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":15,\"i\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},\"panelIndex\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\",\"panelRefName\":\"panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":50,\"w\":24,\"h\":15,\"i\":\"955799aa-0778-4034-9624-2d258c7ee7d5\"},\"panelIndex\":\"955799aa-0778-4034-9624-2d258c7ee7d5\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Setting Changes\",\"panelRefName\":\"panel_955799aa-0778-4034-9624-2d258c7ee7d5\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":50,\"w\":24,\"h\":15,\"i\":\"73173146-a695-4da9-8760-f327c3d39b5f\"},\"panelIndex\":\"73173146-a695-4da9-8760-f327c3d39b5f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Policy Changes\",\"panelRefName\":\"panel_73173146-a695-4da9-8760-f327c3d39b5f\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":65,\"w\":24,\"h\":15,\"i\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},\"panelIndex\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned On\",\"panelRefName\":\"panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":65,\"w\":24,\"h\":15,\"i\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},\"panelIndex\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned Off\",\"panelRefName\":\"panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":80,\"w\":24,\"h\":15,\"i\":\"8ee424e6-e3df-4389-838c-4923da9036f6\"},\"panelIndex\":\"8ee424e6-e3df-4389-838c-4923da9036f6\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Audit Policy Changes\",\"panelRefName\":\"panel_8ee424e6-e3df-4389-838c-4923da9036f6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":80,\"w\":24,\"h\":15,\"i\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},\"panelIndex\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Kerberos Policy Changes\",\"panelRefName\":\"panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":95,\"w\":24,\"h\":15,\"i\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\"},\"panelIndex\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\",\"accessors\":[\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"c970c28f-4b0f-4560-be20-691ef6ff7722\"}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\":{\"columns\":{\"c970c28f-4b0f-4560-be20-691ef6ff7722\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c85c4fcc-e896-4607-bf76-4531ea13358e\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"c970c28f-4b0f-4560-be20-691ef6ff7722\",\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Start Up\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":95,\"w\":24,\"h\":15,\"i\":\"cde6896d-e694-4467-915c-a40f8a96e072\"},\"panelIndex\":\"cde6896d-e694-4467-915c-a40f8a96e072\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"646160c2-9253-4e43-b062-e99092afccb2\",\"accessors\":[\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"bc53a3ce-785a-48be-b77c-4f54950fd843\"}]},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"646160c2-9253-4e43-b062-e99092afccb2\":{\"columns\":{\"bc53a3ce-785a-48be-b77c-4f54950fd843\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18118859-447e-4ddc-aab9-7a6193e562f1\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc53a3ce-785a-48be-b77c-4f54950fd843\",\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shut Down\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":110,\"w\":24,\"h\":15,\"i\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\"},\"panelIndex\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c\"}],\"state\":{\"visualization\":{\"layerId\":\"b14413de-d521-4fae-9803-61bb7bb0481c\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\",\"isTransposed\":false},{\"columnId\":\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"isTransposed\":false}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b14413de-d521-4fae-9803-61bb7bb0481c\":{\"columns\":{\"26c59d98-b16d-4231-b7f0-9cf5738531ab\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"43a09ae6-c67c-41ab-a028-590677c0fbb0\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Startups\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":110,\"w\":24,\"h\":15,\"i\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\"},\"panelIndex\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"isTransposed\":false},{\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\",\"isTransposed\":false}],\"layerId\":\"a4076119-449b-4671-b641-1576ea6b1a4d\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a4076119-449b-4671-b641-1576ea6b1a4d\":{\"columns\":{\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"310e557f-37b5-406a-85e6-7eabac7c522b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"310e557f-37b5-406a-85e6-7eabac7c522b\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shutdowns\"}]","timeRestore":false,"title":"Policy Changes and System Activity 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"614a8392-17b5-49c4-9397-bc3cac526c61","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a:panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a","type":"links"},{"id":"logs-*","name":"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd:indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f","type":"index-pattern"},{"id":"logs-*","name":"638a3409-963c-41bf-b44c-5c84631ed0d5:indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee","type":"index-pattern"},{"id":"logs-*","name":"0c81b645-b5a7-4c63-a4df-34be3cd2bad3:indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357","type":"index-pattern"},{"id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","name":"ec3a6d47-cc36-440f-ad19-1482eb9f5b68:panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68","type":"search"},{"id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","name":"955799aa-0778-4034-9624-2d258c7ee7d5:panel_955799aa-0778-4034-9624-2d258c7ee7d5","type":"search"},{"id":"7b4c9843-87d7-42b9-935e-ff4713840de3","name":"73173146-a695-4da9-8760-f327c3d39b5f:panel_73173146-a695-4da9-8760-f327c3d39b5f","type":"search"},{"id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","name":"59995b8c-7f7f-4d12-998f-ae94ef27ed89:panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89","type":"search"},{"id":"53b18c74-3370-4237-a524-90fd7489bf47","name":"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8:panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8","type":"search"},{"id":"26bac78a-07ef-4925-9473-4e2f60e5c151","name":"8ee424e6-e3df-4389-838c-4923da9036f6:panel_8ee424e6-e3df-4389-838c-4923da9036f6","type":"search"},{"id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","name":"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e:panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e","type":"search"},{"id":"logs-*","name":"39bc0b92-1ba5-46a6-a527-094f749c86cf:indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb","type":"index-pattern"},{"id":"logs-*","name":"cde6896d-e694-4467-915c-a40f8a96e072:indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2","type":"index-pattern"},{"id":"logs-*","name":"95d5d91c-454a-477b-a2a2-c12df98091ab:indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c","type":"index-pattern"},{"id":"logs-*","name":"6f9bce5a-19c2-4f12-ba21-6066488a01c3:indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOCwxXQ=="} +{"attributes":{"columns":[],"description":"This dashboard will audit, privileged use and detailed tracking processes. ","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"refreshInterval":{"pause":true,"value":5000},"sort":[["@timestamp","desc"]],"timeRange":{"from":"now-30d/d","to":"now"},"timeRestore":true,"title":"Privileged Activity dashboard ","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":6,\"h\":25,\"i\":\"8048e972-d666-4403-ba50-805ec6552a2e\"},\"panelIndex\":\"8048e972-d666-4403-ba50-805ec6552a2e\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8048e972-d666-4403-ba50-805ec6552a2e\"},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":0,\"w\":21,\"h\":13,\"i\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\"},\"panelIndex\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"f8e3a2b3-9937-415f-b405-27363667b11e\",\"seriesType\":\"line\",\"xAccessor\":\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"accessors\":[\"ed03924f-84eb-434a-834b-1f074954b815\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4688\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f8e3a2b3-9937-415f-b405-27363667b11e\":{\"columns\":{\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"ed03924f-84eb-434a-834b-1f074954b815\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"ed03924f-84eb-434a-834b-1f074954b815\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"ed03924f-84eb-434a-834b-1f074954b815\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":0,\"w\":19,\"h\":13,\"i\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\"},\"panelIndex\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process termination\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873\"},{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"splitAccessor\":\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"accessors\":[\"8580666f-56c1-4af5-80fd-6178148354be\"],\"layerType\":\"data\"},{\"layerId\":\"3293242f-292b-4b40-9a26-d77cf1ae570c\",\"layerType\":\"data\",\"accessors\":[],\"seriesType\":\"bar_stacked\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4689\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\":{\"columns\":{\"57566510-cf0e-4e35-b01d-8b5821f389fc\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8580666f-56c1-4af5-80fd-6178148354be\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"e3910605-fe72-4ac8-9250-49d64f1cba7b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"8580666f-56c1-4af5-80fd-6178148354be\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"8580666f-56c1-4af5-80fd-6178148354be\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"},\"3293242f-292b-4b40-9a26-d77cf1ae570c\":{\"linkToLayers\":[],\"columns\":{},\"columnOrder\":[],\"sampling\":1,\"ignoreGlobalFilters\":false,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":13,\"w\":21,\"h\":12,\"i\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\"},\"panelIndex\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Audit Sensitive privilege Use\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"layers\":[{\"accessors\":[\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"layerId\":\"unifiedHistogram\",\"layerType\":\"data\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"date_column\"}],\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"preferredSeriesType\":\"bar_stacked\",\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\"},\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"date_column\",\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"columns\":{\"1ec9d305-2ddb-4c55-99db-549c767142a1\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"date_column\":{\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Privilege service attempts \"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":13,\"w\":19,\"h\":12,\"i\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\"},\"panelIndex\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Token assigned to process\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882\"}],\"state\":{\"visualization\":{\"layerId\":\"9ab8eb11-2529-4e5e-a153-834e29cc7882\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"aa267d47-4c05-4d62-9e91-523fd042b1d0\"},{\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"}]},\"query\":{\"query\":\"4696\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9ab8eb11-2529-4e5e-a153-834e29cc7882\":{\"columns\":{\"aa267d47-4c05-4d62-9e91-523fd042b1d0\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"feeda031-4d04-4512-bb90-f78038ef4666\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"aa267d47-4c05-4d62-9e91-523fd042b1d0\",\"feeda031-4d04-4512-bb90-f78038ef4666\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Assigned Token \"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":25,\"w\":27,\"h\":13,\"i\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\"},\"panelIndex\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Non-sensitive privilege event\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\"}],\"state\":{\"visualization\":{\"layerId\":\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\",\"accessor\":\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":2714.66},{\"color\":\"#d6bf57\",\"stop\":5429.33},{\"color\":\"#cc5642\",\"stop\":8144}],\"continuity\":\"above\",\"maxSteps\":5,\"colorStops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":2714.66},{\"color\":\"#cc5642\",\"stop\":5429.33}]}},\"textAlign\":\"center\",\"titlePosition\":\"bottom\",\"size\":\"l\"},\"query\":{\"query\":\"4674\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\":{\"columns\":{\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Non-sensitive privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":25,\"w\":19,\"h\":13,\"i\":\"f3f34099-a467-4343-9985-2b1fb741c78f\"},\"panelIndex\":\"f3f34099-a467-4343-9985-2b1fb741c78f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Edit visualization\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"layerId\":\"unifiedHistogram\",\"accessor\":\"count_column\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"type\":\"palette\",\"name\":\"status\",\"params\":{\"name\":\"status\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":1048.5,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":466},{\"color\":\"#cc5642\",\"stop\":932}],\"steps\":3,\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"l\",\"titlePosition\":\"bottom\"},\"query\":{\"language\":\"kuery\",\"query\":\"4674\"},\"filters\":[{\"meta\":{\"index\":\"c1678fe0-175c-4aa3-abcc-ee8260800574\",\"type\":\"exists\",\"key\":\"@timestamp\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"@timestamp\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"count_column\"],\"columns\":{\"count_column\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"@timestamp\",\"isBucketed\":false,\"params\":{\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}},\"emptyAsNull\":true},\"customLabel\":true}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Sensitive Privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":38,\"w\":27,\"h\":13,\"i\":\"7423841b-4470-4aee-ad93-a1a558c54d80\"},\"panelIndex\":\"7423841b-4470-4aee-ad93-a1a558c54d80\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"curveType\":\"LINEAR\",\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":false,\"yLeft\":false,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":-90},\"layers\":[{\"accessors\":[\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"isHistogram\":true,\"layerId\":\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\",\"layerType\":\"data\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"seriesType\":\"bar_stacked\",\"simpleView\":false,\"splitAccessor\":\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"xAccessor\":\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"xScaleType\":\"time\",\"yConfig\":[{\"axisMode\":\"left\",\"forAccessor\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"}]}],\"legend\":{\"isVisible\":true,\"legendSize\":\"auto\",\"maxLines\":1,\"position\":\"right\",\"shouldTruncate\":true,\"showSingleSeries\":true,\"legendStats\":[]},\"preferredSeriesType\":\"bar_stacked\",\"showCurrentTimeMarker\":false,\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\",\"yLeftExtent\":{\"enforce\":true,\"mode\":\"full\"},\"yLeftScale\":\"linear\",\"yRightScale\":\"linear\",\"yTitle\":\"Count\"},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\":{\"columnOrder\":[\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"columns\":{\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\":{\"customLabel\":true,\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\":{\"customLabel\":true,\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"winlog.event_data.User: Descending\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.User\"},\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\":{\"customLabel\":true,\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"dropPartials\":false,\"includeEmptyRows\":false,\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Process creation-Activities\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"4d293281-b115-4bf5-8143-be056b148c25\"},\"panelIndex\":\"4d293281-b115-4bf5-8143-be056b148c25\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Privilege Activity entry \",\"panelRefName\":\"panel_4d293281-b115-4bf5-8143-be056b148c25\"}]","timeRestore":false,"title":"Privileged Activity log Dashboards 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8048e972-d666-4403-ba50-805ec6552a2e:panel_8048e972-d666-4403-ba50-805ec6552a2e","type":"links"},{"id":"logs-*","name":"c98b5f54-1c52-4163-8cba-8e09e9765c61:indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c","type":"index-pattern"},{"id":"logs-*","name":"0a90ec8c-687d-4165-9ab1-327baf40fb82:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"8d4ac232-4cce-46b1-b1de-ffbbc839a958:indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882","type":"index-pattern"},{"id":"logs-*","name":"ace01c88-d563-4633-a8d3-b26ec8eca790:indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6","type":"index-pattern"},{"id":"logs-*","name":"f3f34099-a467-4343-9985-2b1fb741c78f:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"7423841b-4470-4aee-ad93-a1a558c54d80:indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743","type":"index-pattern"},{"id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","name":"4d293281-b115-4bf5-8143-be056b148c25:panel_4d293281-b115-4bf5-8143-be056b148c25","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Process - hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Total Processes\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"host.name: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOSwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.ProcessId","winlog.event_data.ParentProcessId","winlog.event_data.CommandLine","winlog.event_data.User","winlog.event_data.IntegrityLevel"],"description":"","grid":{"columns":{"host.name":{"width":202},"winlog.event_data.IntegrityLevel":{"width":238},"winlog.event_data.ParentProcessId":{"width":141},"winlog.event_data.ProcessId":{"width":116}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawn Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2a069ea5-946c-4c62-9e95-a4801299794d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Process - Spawned area ","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Spawned area \",\"type\":\"area\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15w\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"1d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"labels\":{},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD\"}},\"params\":{\"date\":true,\"interval\":\"P1D\",\"intervalESValue\":1,\"intervalESUnit\":\"d\",\"format\":\"YYYY-MM-DD\",\"bounds\":{\"min\":\"2020-01-22T16:30:25.973Z\",\"max\":\"2020-05-06T15:30:25.973Z\"}},\"label\":\"@timestamp per day\",\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","managed":false,"references":[{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - Users bar","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Users bar\",\"type\":\"histogram\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d/d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"12h\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"user.name: Descending\",\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\",\"radiusRatio\":0,\"truncateLegend\":true,\"maxLegendLines\":1}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMiwxXQ=="} +{"attributes":{"columns":["host.name","event.action","process.name","user.name","file.path"],"description":"","grid":{"columns":{"@timestamp":{"width":240},"event.code":{"width":148},"event.provider":{"width":260},"host.name":{"width":168},"winlog.event_data.TargetFilename":{"width":630}}},"hideChart":true,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"event.action: \\\"creation\\\" AND file.path.text: \\\"*\\\\\\\\Downloads\\\\\\\\*\\\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"rowHeight":1,"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Download Test 2","usesAdHocDataView":false,"viewMode":"documents"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.EventType","winlog.event_data.TargetObject","winlog.event_data.Details"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:12 or event.code:13 or event.code:14) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process - Registry events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8584f0da-88c3-478e-bd13-fff76a975897","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\"},\"panelIndex\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_429e5318-e2ae-4637-ac70-eb4a12f191e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":40,\"h\":21,\"i\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},\"panelIndex\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Hosts\",\"panelRefName\":\"panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},\"panelIndex\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Process spawns over time\",\"panelRefName\":\"panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\"},\"panelIndex\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Processes created by users over time\",\"panelRefName\":\"panel_b6b8e77e-67f7-42ce-a835-650ad795834f\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":15,\"i\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\"},\"panelIndex\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process - Users (converted)\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500\"}],\"state\":{\"visualization\":{\"layerId\":\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\",\"alignment\":\"left\",\"hidden\":true},{\"columnId\":\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"alignment\":\"left\"},{\"columnId\":\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"alignment\":\"left\"}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\":{\"columns\":{\"12f20e93-46d3-4931-926b-91fbf9177d4e\":{\"label\":\"Domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\":{\"label\":\"Username\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Users\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},\"panelIndex\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\",\"embeddableConfig\":{\"enhancements\":{},\"columns\":[\"@timestamp\",\"host.name\",\"winlog.event_data.CommandLine\",\"winlog.event_data.User\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ParentProcessId\"]},\"title\":\"Process spawn event logs (Sysmon ID 1)\",\"panelRefName\":\"panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":68,\"w\":48,\"h\":14,\"i\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},\"panelIndex\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\",\"embeddableConfig\":{\"hidePanelTitles\":false,\"description\":\"Shows all the files created in Downloads Directory.\",\"rowHeight\":1,\"enhancements\":{}},\"title\":\"Files created (in Downloads)\",\"panelRefName\":\"panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":82,\"w\":48,\"h\":15,\"i\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\"},\"panelIndex\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Registry events (Sysmon 12, 13, 14)\",\"panelRefName\":\"panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e\"}]","timeRestore":false,"title":"Process Explorer 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"429e5318-e2ae-4637-ac70-eb4a12f191e6:panel_429e5318-e2ae-4637-ac70-eb4a12f191e6","type":"links"},{"id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","name":"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f:panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f","type":"visualization"},{"id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","name":"2cb3c5a0-bf16-43b4-a69d-73012062f55b:panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b","type":"visualization"},{"id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","name":"b6b8e77e-67f7-42ce-a835-650ad795834f:panel_b6b8e77e-67f7-42ce-a835-650ad795834f","type":"visualization"},{"id":"logs-*","name":"9a28d907-c8ef-4815-8ebc-ac897b19ab48:indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500","type":"index-pattern"},{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd:panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd","type":"search"},{"id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","name":"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10:panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10","type":"search"},{"id":"8584f0da-88c3-478e-bd13-fff76a975897","name":"502494bd-c9c5-4f2a-a85f-ffc27cec088e:panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:\\\"Microsoft-Windows-Sysmon/Operational\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_sysmon_all_events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":false,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":0},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_datatable\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event code\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"90a5fcee-d3fb-4969-a336-869ab6808777","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_host_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_host_events_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Missing computer name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"split\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Missing computer name\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_event_code_reference","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| \\tEvent ID\\t | \\tEvent\\t | \\tDescription\\t |\\n| \\t:-:\\t | \\t:-\\t | \\t-\\t |\\n| \\t1\\t | \\tProcess creation\\t | \\tThe process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.\\t |\\n| \\t2\\t | \\tA process changed a file creation time\\t | \\tThe change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\\t |\\n| \\t3\\t | \\tNetwork connection\\t | \\tThe network connection event logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.\\t |\\n| \\t4\\t | \\tSysmon service state changed\\t | \\tThe service state change event reports the state of the Sysmon service (started or stopped).\\t |\\n| \\t5\\t | \\tProcess terminated\\t | \\tThe process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.\\t |\\n| \\t6\\t | \\tDriver loaded\\t | \\tThe driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.\\t |\\n| \\t7\\t | \\tImage loaded\\t | \\tThe image loaded event logs when a module is loaded in a specific process. This event is disabled by default and needs to be configured with the �l option. It indicates the process in which the module is loaded, hashes and signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading. This event should be configured carefully, as monitoring all image load events will generate a large number of events.\\t |\\n| \\t8\\t | \\tCreateRemoteThread\\t | \\tThe CreateRemoteThread event detects when a process creates a thread in another process. This technique is used by malware to inject code and hide in other processes. The event indicates the source and target process. It gives information on the code that will be run in the new thread: StartAddress, StartModule and StartFunction. Note that StartModule and StartFunction fields are inferred, they might be empty if the starting address is outside loaded modules or known exported functions.\\t |\\n| \\t9\\t | \\tRawAccessRead\\t | \\tThe RawAccessRead event detects when a process conducts reading operations from the drive using the \\\\\\\\\\\\\\\\.\\\\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.\\t |\\n| \\t10\\t | \\tProcessAccess\\t | \\tThe process accessed event reports when a process opens another process, an operation that�s often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks. Enabling it can generate significant amounts of logging if there are diagnostic utilities active that repeatedly open processes to query their state, so it generally should only be done so with filters that remove expected accesses.\\t |\\n| \\t11\\t | \\tFileCreate\\t | \\tFile create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.\\t |\\n| \\t12\\t | \\tRegistryEvent (Object create and delete)\\t | \\tRegistry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications. Sysmon uses abbreviated versions of Registry root key names, with the following mappings: |\\n|||**Key name**                                                                                          **Abbreviation**|\\n|||HKEY_LOCAL_MACHINE                                                                  HKLM|\\n|||HKEY_USERS                                                                                     HKU|\\n|||HKEY_LOCAL_MACHINE\\\\System\\\\ControlSet00x                          HKLM\\\\System\\\\CurrentControlSet|\\n|||HKEY_LOCAL_MACHINE\\\\Classes                                                    HKCR|\\n| \\t13\\t | \\tRegistryEvent (Value Set)\\t | \\tThis Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.\\t |\\n| \\t14\\t | \\tRegistryEvent (Key and Value Rename)\\t | \\tRegistry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.\\t |\\n| \\t15\\t | \\tFileCreateStreamHash\\t | \\tThis event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream. There are malware variants that drop their executables or configuration settings via browser downloads, and this event is aimed at capturing that based on the browser attaching a Zone.Identifier �mark of the web� stream.\\t |\\n| \\t16\\t | \\tServiceConfigurationChange\\t | \\tThis event logs changes in the Sysmon configuration - for example when the filtering rules are updated.\\t |\\n| \\t17\\t | \\tPipeEvent (Pipe Created)\\t | \\tThis event generates when a named pipe is created. Malware often uses named pipes for interprocess communication.\\t |\\n| \\t18\\t | \\tPipeEvent (Pipe Connected)\\t | \\tThis event logs when a named pipe connection is made between a client and a server.\\t |\\n| \\t19\\t | \\tWmiEvent (WmiEventFilter activity detected)\\t | \\tWhen a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.\\t |\\n| \\t20\\t | \\tWmiEvent (WmiEventConsumer activity detected)\\t | \\tThis event logs the registration of WMI consumers, recording the consumer name, log, and destination.\\t |\\n| \\t21\\t | \\tWmiEvent (WmiEventConsumerToFilter activity detected)\\t | \\tWhen a consumer binds to a filter, this event logs the consumer name and filter path.\\t |\\n| \\t22\\t | \\tDNSEvent (DNS query)\\t | \\tThis event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.\\t |\\n| \\t23\\t | \\tFileDelete (A file delete was detected)\\t | \\tA file was deleted.\\t |\\n| \\t24\\t | \\tClipboardChange (New content in the clipboard)\\t | \\tThis event is generated when the system clipboard contents change.\\t |\\n| \\t25\\t | \\tProcessTampering (Process image change)\\t | \\tThis event is generated when a process image is changed from an external source, such as a different process.\\t |\\n| \\t255\\t | \\tError\\t | \\tThis event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the Sysinternals forum or over Twitter (@markrussinovich).\\t |\\n\\nFor more information see *https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"title\":\"vis_sd_sysmon_event_code_reference\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"88efefcc-de0a-4a08-9a17-3d09423092e0","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MywxXQ=="} +{"attributes":{"description":"Summarizes collected Sysmon event data","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Total number of Sysmon events found\",\"panelRefName\":\"panel_2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":13,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"title\":\"Percentage of Sysmon events by event code\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":18,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Count of Sysmon events by event code\",\"panelRefName\":\"panel_4\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":13,\"w\":24,\"h\":18,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"asc\"}}},\"enhancements\":{}},\"title\":\"Top 10 hosts generating the most Sysmon data\",\"panelRefName\":\"panel_5\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":39,\"w\":48,\"h\":21,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon event code reference\",\"panelRefName\":\"panel_7\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\"},\"panelIndex\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550\"}]","timeRestore":false,"title":"Sysmon Summary 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","managed":false,"references":[{"id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","name":"2:panel_2","type":"visualization"},{"id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","name":"3:panel_3","type":"visualization"},{"id":"90a5fcee-d3fb-4969-a336-869ab6808777","name":"4:panel_4","type":"visualization"},{"id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","name":"5:panel_5","type":"visualization"},{"id":"88efefcc-de0a-4a08-9a17-3d09423092e0","name":"7:panel_7","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"4fb34c82-2e7f-43cb-88ca-54b304bc2550:panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550","type":"links"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - User activity title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - User activity title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## All user activity\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - Logon title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Logon title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Logon / Logoff events\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NywxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectDomainName","winlog.event_data.TargetUserName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"user.name":{"width":193},"winlog.event_data.SubjectDomainName":{"width":193}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4624\\\" and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_data.LogonType\",\"value\":[\"2\",\"10\",\"11\",\"7\"],\"params\":[\"2\",\"10\",\"11\",\"7\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_data.LogonType\":\"2\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"10\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"11\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"7\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Interactive Logon search","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{"columns":{"winlog.event_data.TargetDomainName":{"width":241},"winlog.event_data.TargetUserName":{"width":241}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:\\\"4634\\\" OR event.code:\\\"4647\\\" ) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"HR - Interactive v Remote pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Interactive v Remote pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"2\\\"\",\"language\":\"lucene\"},\"label\":\"Interactive\"},{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"10\\\"\\n\",\"language\":\"lucene\"},\"label\":\"RemoteInteractive\"}]},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"label\":\"filters\",\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MCwxXQ=="} +{"attributes":{"description":"Overview of user activity for Human Resources\n","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":24,\"i\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},\"panelIndex\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":20,\"h\":12,\"i\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\"},\"panelIndex\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"accessors\":[\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"splitAccessor\":\"fc23a029-309e-40a7-aeca-309fd8423ced\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\":{\"columns\":{\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\":{\"label\":\"Top 5 values of winlog.event_data.SubjectDomainName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.SubjectDomainName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"fc23a029-309e-40a7-aeca-309fd8423ced\":{\"label\":\"Top 3 values of winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5a238afa-9ffa-4568-8a43-6167c0a76b67\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"fc23a029-309e-40a7-aeca-309fd8423ced\",\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Users\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":20,\"h\":12,\"i\":\"69771c75-8536-49b2-a835-c134ada8cd8d\"},\"panelIndex\":\"69771c75-8536-49b2-a835-c134ada8cd8d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"accessors\":[\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"position\":\"top\",\"seriesType\":\"bar\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"22b4e313-2858-411e-a90b-911198fa34fe\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\":{\"columns\":{\"22b4e313-2858-411e-a90b-911198fa34fe\":{\"label\":\"Top 5 values of winlog.computer_name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.computer_name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"22b4e313-2858-411e-a90b-911198fa34fe\",\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Computers\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":12,\"w\":40,\"h\":12,\"i\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},\"panelIndex\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select domain(s) and username(s)\",\"panelRefName\":\"panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":24,\"w\":48,\"h\":4,\"i\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\"},\"panelIndex\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_f2f654b0-42ef-403c-bee2-7e26499f809a\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":48,\"h\":14,\"i\":\"e40e6077-f799-4c66-9bf8-1664121d8069\"},\"panelIndex\":\"e40e6077-f799-4c66-9bf8-1664121d8069\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f46d1729-4bd5-4219-9973-01913c208fef\",\"accessors\":[\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f46d1729-4bd5-4219-9973-01913c208fef\":{\"columns\":{\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"800c3857-3c9c-4fc5-a403-3fcbede05599\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\",\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events by Time\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":42,\"w\":48,\"h\":4,\"i\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},\"panelIndex\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":46,\"w\":24,\"h\":15,\"i\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},\"panelIndex\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logon events (filter by LogonId)\",\"panelRefName\":\"panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":46,\"w\":24,\"h\":15,\"i\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\"},\"panelIndex\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logoff events (correlate to logon events)\",\"panelRefName\":\"panel_bb42b25e-f934-485b-854c-440cc1b3ebee\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":24,\"h\":15,\"i\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"},\"panelIndex\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"In person vs Remote logons\",\"panelRefName\":\"panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"}]","timeRestore":false,"title":"User HR 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d:panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d","type":"links"},{"id":"logs-*","name":"c8d3e871-1f5d-40bd-a0f9-5441a58cad32:indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093","type":"index-pattern"},{"id":"logs-*","name":"69771c75-8536-49b2-a835-c134ada8cd8d:indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2","type":"index-pattern"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"ab726ae4-6c98-4f26-8cd3-07bf2808b704:panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704","type":"visualization"},{"id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","name":"f2f654b0-42ef-403c-bee2-7e26499f809a:panel_f2f654b0-42ef-403c-bee2-7e26499f809a","type":"visualization"},{"id":"logs-*","name":"e40e6077-f799-4c66-9bf8-1664121d8069:indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef","type":"index-pattern"},{"id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","name":"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e:panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e","type":"visualization"},{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"755f30aa-d6ad-46d9-b2c3-7425c02ed03e:panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e","type":"search"},{"id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","name":"bb42b25e-f934-485b-854c-440cc1b3ebee:panel_bb42b25e-f934-485b-854c-440cc1b3ebee","type":"search"},{"id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","name":"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f:panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"1587572089136\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4a675166-ce19-4836-9567-eda4ab46b3d5","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - Filter Hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Filter Hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Event count\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8d476795-134d-4689-9050-a24b57adaa90","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security - Select Host","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select Host\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588685297382\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Logons Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logons Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Logons\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4eccff45-c97a-480f-b593-4744922893e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human User Logon Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon attempts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon attempts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Login attempts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f7d1f53-6b70-4235-879a-f149d98c9063","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon events over time","uiStateJSON":"{\"vis\":{\"colors\":{\"Failed attempts\":\"#BF1B00\",\"Successful atempts\":\"#629E51\"}}}","version":1,"visState":"{\"title\":\"Security - Logon events over time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":1,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-23T08:41:59.000Z\",\"max\":\"2020-04-23T08:56:59.000Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"event.code:4625\",\"language\":\"lucene\"},\"label\":\"Failed attempts\"},{\"input\":{\"query\":\"event.code:4624\",\"language\":\"lucene\"},\"label\":\"Successful atempts\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15m\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"42ae3f23-386c-4ceb-bb84-98879107338b","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4,624, 4,625\",\"params\":[\"4624\",\"4625\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}},{\"match_phrase\":{\"event.code\":\"4625\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Computers\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MCwxXQ=="} +{"attributes":{"columns":["event.code","host.name","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.IpAddress","event.action","event.outcome","winlog.event_data.LogonType"],"description":"","grid":{"columns":{"user.domain":{"width":119},"user.name":{"width":134}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human Logon & Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Network Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Network Connections\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80b03097-c117-44d0-8413-3c932d0886a2","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id : \\\"3\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"All network activity ","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f02a3c3d-eb39-4347-91f7-d62bece13128","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Activity Line","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Activity Line\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Connections\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Connections\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Connections\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-24T15:29:10.918Z\",\"max\":\"2020-04-24T15:44:10.918Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"aa741894-2140-4529-a488-6d34ed57abef","managed":false,"references":[{"id":"f02a3c3d-eb39-4347-91f7-d62bece13128","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.DestinationHostname","destination.ip","winlog.event_data.DestinationIsIpv6","network.","process.executable","winlog.event_data.DestinationPort","winlog.event_data.Protocol","winlog.user.name","winlog.user.type","source.ip","winlog.event_data.SourceIsIpv6","source.port","network.protocol"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_non_browsers_connection","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50b150ad-5aff-4706-9229-d9bcb38255ef","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Overview - Processes with unusual network activity","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Overview - Processes with unusual network activity\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"params\":{\"field\":\"process.name\",\"size\":10,\"include\":\"\",\"json\":\"\",\"customLabel\":\"Process\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"string\"},\"params\":{},\"label\":\"Process\",\"aggType\":\"significant_terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NiwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{"columns":{"winlog.event_data.SubjectDomainName":{"width":216}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_non_private_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Processes Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Processes Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Processes & Powershell\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.User","winlog.event_data.ProcessId","winlog.event_data.ProcessName","winlog.event_data.Hashes","process.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawns","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OSwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.command_line","process.parent.executable","process.parent.command_line","file.path","event.code"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\" OR process.command_line.text:\\\"powershell\\\" OR parent.process.command_line.text:\\\"powershell\\\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_powershell_run","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell Run Count","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Security - Powershell Run Count\",\"type\":\"metric\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell runs over time","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now/w\",\"to\":\"now/w\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}],\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\"},\"title\":\"Security - Powershell runs over time\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Power shell hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"title\":\"Security - Power shell hosts pie\",\"type\":\"pie\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.args","process.parent.executable","process.parent.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND process.command_line.text:(\\\"invoke\\\" or \\\"bypass\\\" or \\\"iex\\\" or \\\"ex\\\" or \\\"icm\\\" or \\\"new-object\\\" or \\\"set\\\" or \\\"get\\\" or \\\"write\\\" or \\\"out\\\" or \\\"download\\\" or \\\"encoded\\\")\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Potentially Suspicious Powershell","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","destination.domain","destination.ip"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND (process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_powershell_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04c60a34-98a9-4073-8538-97996e80855f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Files title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Files title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Files\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"file.path.text: \\\"tmp\\\" OR file.path.text:\\\"temp\\\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"file.path\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"exists\":{\"field\":\"file.path\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"TEMP & %TEMP%","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d3792434-6184-44ed-bad4-830249085d68","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"TEMP & %TEMP%","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target File\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":30,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Hostname\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"TEMP & %TEMP%\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","managed":false,"references":[{"id":"d3792434-6184-44ed-bad4-830249085d68","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NSwxXQ=="} +{"attributes":{"columns":["@timestamp","user.domain","user.name","host.name","process.executable","winlog.event_data.ProcessId"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: \\\"9\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Raw Access Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Windows Defender Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Windows Defender Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Windows Defender\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a2cdbce1-9070-4851-909f-774a80d2875a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - AV Events Count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - AV Events Count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Windows AV Events\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ac9a9da-1772-483c-8c32-b049f0273186","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_id\",\"value\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"params\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"negate\":false,\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_id\":\"1006\"}},{\"match_phrase\":{\"winlog.event_id\":\"1007\"}},{\"match_phrase\":{\"winlog.event_id\":\"1008\"}},{\"match_phrase\":{\"winlog.event_id\":\"1009\"}},{\"match_phrase\":{\"winlog.event_id\":\"1116\"}},{\"match_phrase\":{\"winlog.event_id\":\"1117\"}},{\"match_phrase\":{\"winlog.event_id\":\"1118\"}},{\"match_phrase\":{\"winlog.event_id\":\"1119\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"AV Detection event","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"AV Hits (Count)","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"AV Hits (Count)\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"AV Detection hits\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fe86395f-474e-43a1-a772-34d1306373e0","managed":false,"references":[{"id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.Detection User","host.name","winlog.event_data.Path","winlog.event_data.FWLink"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: 1116\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"Microsoft-Windows-Windows Defender\"},\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"match_phrase\":{\"event.provider\":{\"query\":\"Microsoft-Windows-Windows Defender\"}}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Defender AV Detections","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MSwxXQ=="} +{"attributes":{"description":"User Security overview, filtered by Domain / Username or hostname","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},\"panelIndex\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":15,\"h\":11,\"i\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},\"panelIndex\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search users\",\"panelRefName\":\"panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},{\"type\":\"visualization\",\"gridData\":{\"x\":23,\"y\":0,\"w\":25,\"h\":11,\"i\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\"},\"panelIndex\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Filter hosts\",\"panelRefName\":\"panel_62ea04ec-0776-46c0-9b8c-cf2915600337\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":15,\"h\":10,\"i\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\"},\"panelIndex\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search hosts\",\"panelRefName\":\"panel_45ac8571-ae44-4bb5-a237-cd230ede51d5\"},{\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":11,\"w\":25,\"h\":10,\"i\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\"},\"panelIndex\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\",\"isTransposed\":false},{\"columnId\":\"26752485-2aa5-4908-b400-504d6e7ef451\",\"isTransposed\":false},{\"columnId\":\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"layerType\":\"data\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d123adeb-fd39-4176-b3c9-69c88d2852d5\":{\"columns\":{\"6f33ff19-9959-4c43-b791-939582a0b3d2\":{\"label\":\"Event Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"26752485-2aa5-4908-b400-504d6e7ef451\":{\"label\":\"Filters\",\"dataType\":\"string\",\"operationType\":\"filters\",\"scale\":\"ordinal\",\"isBucketed\":true,\"params\":{\"filters\":[{\"label\":\"\",\"input\":{\"query\":\"\\\"log\\\" : *\",\"language\":\"kuery\"}}]}},\"cc4e45f6-be3a-4de0-a416-e21043b601bb\":{\"label\":\"Top 3 values of user.domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"user.domain\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"26752485-2aa5-4908-b400-504d6e7ef451\",\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"6f33ff19-9959-4c43-b791-939582a0b3d2\"],\"sampling\":1,\"indexPatternId\":\"logs-*\",\"incompleteColumns\":{}}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter users\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":5,\"i\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},\"panelIndex\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":26,\"w\":9,\"h\":7,\"i\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\"},\"panelIndex\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_e5de9fc4-5863-470c-8246-0a86f5af897e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":9,\"y\":26,\"w\":20,\"h\":14,\"i\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},\"panelIndex\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logon attempts\",\"panelRefName\":\"panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},{\"type\":\"visualization\",\"gridData\":{\"x\":29,\"y\":26,\"w\":19,\"h\":14,\"i\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},\"panelIndex\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logged on computers\",\"panelRefName\":\"panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":33,\"w\":9,\"h\":7,\"i\":\"0d1c0533-598a-4304-80be-c22047edcbe1\"},\"panelIndex\":\"0d1c0533-598a-4304-80be-c22047edcbe1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0d1c0533-598a-4304-80be-c22047edcbe1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":17,\"i\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},\"panelIndex\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User Logon & Logoff Events\",\"panelRefName\":\"panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":57,\"w\":48,\"h\":4,\"i\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\"},\"panelIndex\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0fab3d76-5411-46e4-982f-4d4626c977b8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":48,\"h\":14,\"i\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},\"panelIndex\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"All network connections\",\"panelRefName\":\"panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":75,\"w\":24,\"h\":15,\"i\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},\"panelIndex\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network Process List (converted)\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\"}],\"state\":{\"visualization\":{\"layerId\":\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\",\"alignment\":\"left\"},{\"columnId\":\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"alignment\":\"left\"},{\"columnId\":\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"alignment\":\"left\"},{\"columnId\":\"f467badb-5f40-4b21-bdaf-f378db834902\",\"isTransposed\":false,\"isMetric\":false}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\":{\"ignoreGlobalFilters\":false,\"columns\":{\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\":{\"label\":\"Destination IP\",\"dataType\":\"ip\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"destination.ip\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\":{\"label\":\"Computer\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5330e606-7244-4d38-a5a3-d94d5c6412c2\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"f467badb-5f40-4b21-bdaf-f378db834902\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"f467badb-5f40-4b21-bdaf-f378db834902\",\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network Process List\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":75,\"w\":24,\"h\":15,\"i\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},\"panelIndex\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network connections area (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\",\"seriesType\":\"bar\",\"xAccessor\":\"70a3abae-7040-4287-97d3-550088410400\",\"accessors\":[\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"layerType\":\"data\",\"colorMapping\":{\"assignments\":[],\"specialAssignments\":[{\"rule\":{\"type\":\"other\"},\"color\":{\"type\":\"loop\"},\"touched\":false}],\"paletteId\":\"eui_amsterdam_color_blind\",\"colorMode\":{\"type\":\"categorical\"}}}]},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\":{\"ignoreGlobalFilters\":false,\"columns\":{\"70a3abae-7040-4287-97d3-550088410400\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0fbfe911-4334-4e6f-8256-b72f2a280259\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"0fbfe911-4334-4e6f-8256-b72f2a280259\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"70a3abae-7040-4287-97d3-550088410400\",\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network connections area\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":90,\"w\":48,\"h\":15,\"i\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},\"panelIndex\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Unusual network connections from non-browser processes\",\"panelRefName\":\"panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":105,\"w\":48,\"h\":10,\"i\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\"},\"panelIndex\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network Connection Events (Sysmon ID 3)\",\"panelRefName\":\"panel_ea6ad677-7322-4c5c-8946-cac4dd983b26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":115,\"w\":48,\"h\":4,\"i\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\"},\"panelIndex\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_43b61744-5553-4fd1-894c-6e91a799f4a2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":119,\"w\":48,\"h\":14,\"i\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\"},\"panelIndex\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Spawned Processes\",\"panelRefName\":\"panel_9a522603-8d31-4ad6-ac4f-130a814f54fa\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":133,\"w\":10,\"h\":15,\"i\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},\"panelIndex\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell Events\",\"panelRefName\":\"panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":10,\"y\":133,\"w\":20,\"h\":15,\"i\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},\"panelIndex\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events over time\",\"panelRefName\":\"panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":30,\"y\":133,\"w\":18,\"h\":15,\"i\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\"},\"panelIndex\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events by computer\",\"panelRefName\":\"panel_ed7a59ea-caa7-4396-89b7-90c6b8363800\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":148,\"w\":25,\"h\":16,\"i\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},\"panelIndex\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Potentially suspicious powershell\",\"panelRefName\":\"panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},{\"type\":\"search\",\"gridData\":{\"x\":25,\"y\":148,\"w\":23,\"h\":16,\"i\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\"},\"panelIndex\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell network connections\",\"panelRefName\":\"panel_9587ef7f-3554-4886-be6a-fae4648e87dd\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":164,\"w\":48,\"h\":4,\"i\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},\"panelIndex\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":168,\"w\":24,\"h\":15,\"i\":\"4988f659-a275-4317-b071-8a350087a4e6\"},\"panelIndex\":\"4988f659-a275-4317-b071-8a350087a4e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"References to temporary files\",\"panelRefName\":\"panel_4988f659-a275-4317-b071-8a350087a4e6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":168,\"w\":24,\"h\":15,\"i\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},\"panelIndex\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"RawAccessRead (Sysmon Event 9)\",\"panelRefName\":\"panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":183,\"w\":48,\"h\":4,\"i\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},\"panelIndex\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":12,\"h\":14,\"i\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},\"panelIndex\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Defender event count\",\"panelRefName\":\"panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},{\"type\":\"visualization\",\"gridData\":{\"x\":12,\"y\":187,\"w\":12,\"h\":14,\"i\":\"30454a55-0210-43d2-af3d-822c5b519033\"},\"panelIndex\":\"30454a55-0210-43d2-af3d-822c5b519033\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_30454a55-0210-43d2-af3d-822c5b519033\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":187,\"w\":24,\"h\":14,\"i\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"},\"panelIndex\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"AV Detections (Event 1116)\",\"panelRefName\":\"panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"}]","timeRestore":false,"title":"User Security 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc36188-8461-4927-932e-0e452b7dc3ac","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1dd50c7d-7e5d-439d-9071-544339f6ef3f:panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f","type":"links"},{"id":"4a675166-ce19-4836-9567-eda4ab46b3d5","name":"956d6ef1-5d6b-4ccc-a123-fa66805c15db:panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db","type":"visualization"},{"id":"8d476795-134d-4689-9050-a24b57adaa90","name":"62ea04ec-0776-46c0-9b8c-cf2915600337:panel_62ea04ec-0776-46c0-9b8c-cf2915600337","type":"visualization"},{"id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","name":"45ac8571-ae44-4bb5-a237-cd230ede51d5:panel_45ac8571-ae44-4bb5-a237-cd230ede51d5","type":"visualization"},{"id":"logs-*","name":"1324f39e-f215-45e9-b679-05b06e4fcb9d:indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5","type":"index-pattern"},{"id":"4eccff45-c97a-480f-b593-4744922893e5","name":"b453a1df-c025-430b-84e3-d6dc7a8c48f1:panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1","type":"visualization"},{"id":"3f7d1f53-6b70-4235-879a-f149d98c9063","name":"e5de9fc4-5863-470c-8246-0a86f5af897e:panel_e5de9fc4-5863-470c-8246-0a86f5af897e","type":"visualization"},{"id":"42ae3f23-386c-4ceb-bb84-98879107338b","name":"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48:panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48","type":"visualization"},{"id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","name":"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2:panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2","type":"visualization"},{"id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","name":"0d1c0533-598a-4304-80be-c22047edcbe1:panel_0d1c0533-598a-4304-80be-c22047edcbe1","type":"visualization"},{"id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","name":"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396:panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396","type":"search"},{"id":"80b03097-c117-44d0-8413-3c932d0886a2","name":"0fab3d76-5411-46e4-982f-4d4626c977b8:panel_0fab3d76-5411-46e4-982f-4d4626c977b8","type":"visualization"},{"id":"aa741894-2140-4529-a488-6d34ed57abef","name":"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305:panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305","type":"visualization"},{"id":"logs-*","name":"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c:indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f","type":"index-pattern"},{"id":"logs-*","name":"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b:indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9","type":"index-pattern"},{"id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","name":"6d5d4b74-133b-4fef-8ae5-14d2e7037a78:panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78","type":"visualization"},{"id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","name":"ea6ad677-7322-4c5c-8946-cac4dd983b26:panel_ea6ad677-7322-4c5c-8946-cac4dd983b26","type":"search"},{"id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","name":"43b61744-5553-4fd1-894c-6e91a799f4a2:panel_43b61744-5553-4fd1-894c-6e91a799f4a2","type":"visualization"},{"id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","name":"9a522603-8d31-4ad6-ac4f-130a814f54fa:panel_9a522603-8d31-4ad6-ac4f-130a814f54fa","type":"search"},{"id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","name":"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6:panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6","type":"visualization"},{"id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","name":"68d75f76-3806-4d15-81e9-d0dcfa34c9b9:panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9","type":"visualization"},{"id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","name":"ed7a59ea-caa7-4396-89b7-90c6b8363800:panel_ed7a59ea-caa7-4396-89b7-90c6b8363800","type":"visualization"},{"id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","name":"cfe390f9-80a7-4a11-9a8c-7d599e41e38a:panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a","type":"search"},{"id":"04c60a34-98a9-4073-8538-97996e80855f","name":"9587ef7f-3554-4886-be6a-fae4648e87dd:panel_9587ef7f-3554-4886-be6a-fae4648e87dd","type":"search"},{"id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","name":"7cfff19f-bf9d-4101-be63-4d9b8ea78e26:panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26","type":"visualization"},{"id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","name":"4988f659-a275-4317-b071-8a350087a4e6:panel_4988f659-a275-4317-b071-8a350087a4e6","type":"visualization"},{"id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","name":"bfae12f4-b2fd-471f-a111-daf49cd25ed3:panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3","type":"search"},{"id":"a2cdbce1-9070-4851-909f-774a80d2875a","name":"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b:panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b","type":"visualization"},{"id":"6ac9a9da-1772-483c-8c32-b049f0273186","name":"e8c5ac63-42b4-4081-85e3-378c85c0b4cb:panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb","type":"visualization"},{"id":"fe86395f-474e-43a1-a772-34d1306373e0","name":"30454a55-0210-43d2-af3d-822c5b519033:panel_30454a55-0210-43d2-af3d-822c5b519033","type":"visualization"},{"id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","name":"6ff4d4db-16b6-4c80-8bb6-95e009803d1d:panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MiwxXQ=="} +{"attributes":{"layout":"vertical","links":[{"destinationRefName":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","id":"f002a04e-05b9-4b0e-862a-b0737b0fcc7d","order":0,"type":"dashboardLink"},{"destinationRefName":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","id":"fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1","order":1,"type":"dashboardLink"},{"destinationRefName":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","id":"4a789d96-55a1-4d28-9e97-950bb150397f","order":2,"type":"dashboardLink"},{"destinationRefName":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","id":"1a2ef245-e023-4af9-8798-6a012ac5a9ac","order":3,"type":"dashboardLink"},{"destinationRefName":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","id":"bd24a361-4123-4d7a-82b6-a2c7c20414f2","order":4,"type":"dashboardLink"},{"destinationRefName":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","id":"49b455da-4a39-4c33-ac97-006a2a64c22e","order":5,"type":"dashboardLink"},{"destinationRefName":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","id":"585265f5-693a-4f0e-a824-d0e36ae2f821","order":6,"type":"dashboardLink"},{"destinationRefName":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","id":"706a6fd1-1a22-46dc-829a-960f1897b511","order":7,"type":"dashboardLink"},{"destinationRefName":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","id":"0dde1941-a105-4eb7-ade8-054e4465a9cb","order":8,"type":"dashboardLink"},{"destinationRefName":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","id":"5dc55829-39b3-439d-b18d-2327c4def786","order":9,"type":"dashboardLink"},{"destinationRefName":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","id":"ff056d48-316f-439e-94d6-95af7324ad81","order":10,"type":"dashboardLink"},{"destinationRefName":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","id":"a3da514f-4d57-473a-a3cd-8b5eb6793adf","order":11,"type":"dashboardLink"}],"title":"Logging Made Easy Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","managed":false,"references":[{"id":"baa4f981-0c75-43da-b96e-1107f171dfaa","name":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","type":"dashboard"},{"id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","name":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","type":"dashboard"},{"id":"e4d7b207-99aa-4410-8a2e-03487222bda1","name":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","type":"dashboard"},{"id":"fff78bfe-2758-4fa1-939f-362380fc607d","name":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","type":"dashboard"},{"id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","name":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","type":"dashboard"},{"id":"614a8392-17b5-49c4-9397-bc3cac526c61","name":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","type":"dashboard"},{"id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","name":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","type":"dashboard"},{"id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","name":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","type":"dashboard"},{"id":"beeeb066-d497-4b2a-99d3-44d741238bd1","name":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","type":"dashboard"},{"id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","name":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","type":"dashboard"},{"id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","name":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","type":"dashboard"},{"id":"2fc36188-8461-4927-932e-0e452b7dc3ac","name":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MywxXQ=="} +{"attributes":{"description":"Security log related events","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security logs events\",\"panelRefName\":\"panel_1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":137,\"w\":48,\"h\":17,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Process creation - event ID 4688\",\"panelRefName\":\"panel_2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":112,\"w\":48,\"h\":8,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Log Cleared - event ID 1102 or 104\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":154,\"w\":48,\"h\":18,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logon created - Logon type 2\",\"panelRefName\":\"panel_6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select a computer to filter the below results. Leave blank for all\",\"panelRefName\":\"panel_7\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":172,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - network logon created - Logon type 3\",\"panelRefName\":\"panel_8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":120,\"w\":48,\"h\":17,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log events - Detail\",\"panelRefName\":\"panel_9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":48,\"h\":17,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - logon as a service - Logon type 5\",\"panelRefName\":\"panel_10\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":204,\"w\":48,\"h\":15,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Credential sent as clear text - Logon type 8\",\"panelRefName\":\"panel_11\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":15,\"i\":\"15\"},\"panelIndex\":\"15\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon attempts\",\"panelRefName\":\"panel_15\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":219,\"w\":48,\"h\":18,\"i\":\"19\"},\"panelIndex\":\"19\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logons with special privileges assigned - event ID 4672\",\"panelRefName\":\"panel_19\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":18,\"i\":\"21\"},\"panelIndex\":\"21\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon type codes\",\"panelRefName\":\"panel_21\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":54,\"w\":48,\"h\":16,\"i\":\"22\"},\"panelIndex\":\"22\",\"embeddableConfig\":{\"enhancements\":{},\"description\":\"\"},\"title\":\"Failed logon and reason (see table for explanations)\",\"panelRefName\":\"panel_22\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":70,\"w\":48,\"h\":26,\"i\":\"23\"},\"panelIndex\":\"23\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon status codes\",\"panelRefName\":\"panel_23\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":237,\"w\":48,\"h\":15,\"i\":\"28\"},\"panelIndex\":\"28\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"title\":\"Security log - Process started with different credentials- event ID 4648 [could be RUNAS, scheduled tasks]\",\"panelRefName\":\"panel_28\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":8,\"w\":24,\"h\":13,\"i\":\"30\"},\"panelIndex\":\"30\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"title\":\"Select a computername to filter\",\"panelRefName\":\"panel_30\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"69421b10-759e-477d-8f28-adf6e198c8b5\"},\"panelIndex\":\"69421b10-759e-477d-8f28-adf6e198c8b5\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_69421b10-759e-477d-8f28-adf6e198c8b5\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":96,\"w\":48,\"h\":16,\"i\":\"96010259-5ae8-4632-bcce-34078573b1cd\"},\"panelIndex\":\"96010259-5ae8-4632-bcce-34078573b1cd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed Logons\",\"panelRefName\":\"panel_96010259-5ae8-4632-bcce-34078573b1cd\"}]","timeRestore":false,"title":"Security Dashboard - Security Log 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"beeeb066-d497-4b2a-99d3-44d741238bd1","managed":false,"references":[{"id":"1005636a-f473-4a39-a905-ec18aa855ce1","name":"1:panel_1","type":"visualization"},{"id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","name":"2:panel_2","type":"search"},{"id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","name":"3:panel_3","type":"search"},{"id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","name":"6:panel_6","type":"visualization"},{"id":"21038ddc-61bb-4709-9a06-e9d399ada64a","name":"7:panel_7","type":"visualization"},{"id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","name":"8:panel_8","type":"visualization"},{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"9:panel_9","type":"search"},{"id":"4752d143-4f0a-4685-b890-7a19e29a0efa","name":"10:panel_10","type":"visualization"},{"id":"a7c34827-8829-4c45-81ad-26ffff747efe","name":"11:panel_11","type":"visualization"},{"id":"3f754ea3-d5cc-4060-8b99-c330f973d797","name":"15:panel_15","type":"visualization"},{"id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","name":"19:panel_19","type":"visualization"},{"id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","name":"21:panel_21","type":"visualization"},{"id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","name":"22:panel_22","type":"visualization"},{"id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","name":"23:panel_23","type":"visualization"},{"id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","name":"28:panel_28","type":"search"},{"id":"a7410752-98c4-4145-adb4-1c39506f58ca","name":"30:panel_30","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"69421b10-759e-477d-8f28-adf6e198c8b5:panel_69421b10-759e-477d-8f28-adf6e198c8b5","type":"links"},{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"96010259-5ae8-4632-bcce-34078573b1cd:panel_96010259-5ae8-4632-bcce-34078573b1cd","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NywxXQ=="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":123,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/elastic/sysmon_summary.ndjson b/dashboards/elastic/sysmon_summary.ndjson deleted file mode 100644 index 5756ce73..00000000 --- a/dashboards/elastic/sysmon_summary.ndjson +++ /dev/null @@ -1,11 +0,0 @@ -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T19:02:16.690Z","id":"ee32517b-85a4-448d-b063-ef0c0e1d5887","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-21T19:02:16.690Z","version":"WzEzMTksMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:\\\"Microsoft-Windows-Sysmon/Operational\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_sysmon_all_events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"8df10862-b41c-48f1-8103-acabf6b6a43a","managed":false,"references":[{"id":"ee32517b-85a4-448d-b063-ef0c0e1d5887","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-21T22:22:32.149Z","version":"WzE1NTUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"b7fe57cb-6119-4ba8-b169-63cdf51d8d31","managed":false,"references":[{"id":"8df10862-b41c-48f1-8103-acabf6b6a43a","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NDQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":false,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":0},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"7c60b9ca-af8f-4563-8719-099c16c0020a","managed":false,"references":[{"id":"8df10862-b41c-48f1-8103-acabf6b6a43a","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NDUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_datatable\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event code\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"875432d0-510b-4d4c-a77d-563e1bd70a62","managed":false,"references":[{"id":"8df10862-b41c-48f1-8103-acabf6b6a43a","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NDYsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_host_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_host_events_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Missing computer name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"split\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Missing computer name\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"34250ab9-39e2-4601-8aa5-3d047b43c632","managed":false,"references":[{"id":"8df10862-b41c-48f1-8103-acabf6b6a43a","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NDcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_event_code_reference","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| \\tEvent ID\\t | \\tEvent\\t | \\tDescription\\t |\\n| \\t:-:\\t | \\t:-\\t | \\t-\\t |\\n| \\t1\\t | \\tProcess creation\\t | \\tThe process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.\\t |\\n| \\t2\\t | \\tA process changed a file creation time\\t | \\tThe change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\\t |\\n| \\t3\\t | \\tNetwork connection\\t | \\tThe network connection event logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.\\t |\\n| \\t4\\t | \\tSysmon service state changed\\t | \\tThe service state change event reports the state of the Sysmon service (started or stopped).\\t |\\n| \\t5\\t | \\tProcess terminated\\t | \\tThe process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.\\t |\\n| \\t6\\t | \\tDriver loaded\\t | \\tThe driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.\\t |\\n| \\t7\\t | \\tImage loaded\\t | \\tThe image loaded event logs when a module is loaded in a specific process. This event is disabled by default and needs to be configured with the �l option. It indicates the process in which the module is loaded, hashes and signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading. This event should be configured carefully, as monitoring all image load events will generate a large number of events.\\t |\\n| \\t8\\t | \\tCreateRemoteThread\\t | \\tThe CreateRemoteThread event detects when a process creates a thread in another process. This technique is used by malware to inject code and hide in other processes. The event indicates the source and target process. It gives information on the code that will be run in the new thread: StartAddress, StartModule and StartFunction. Note that StartModule and StartFunction fields are inferred, they might be empty if the starting address is outside loaded modules or known exported functions.\\t |\\n| \\t9\\t | \\tRawAccessRead\\t | \\tThe RawAccessRead event detects when a process conducts reading operations from the drive using the \\\\\\\\\\\\\\\\.\\\\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.\\t |\\n| \\t10\\t | \\tProcessAccess\\t | \\tThe process accessed event reports when a process opens another process, an operation that�s often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks. Enabling it can generate significant amounts of logging if there are diagnostic utilities active that repeatedly open processes to query their state, so it generally should only be done so with filters that remove expected accesses.\\t |\\n| \\t11\\t | \\tFileCreate\\t | \\tFile create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.\\t |\\n| \\t12\\t | \\tRegistryEvent (Object create and delete)\\t | \\tRegistry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications. Sysmon uses abbreviated versions of Registry root key names, with the following mappings: |\\n|||**Key name**                                                                                          **Abbreviation**|\\n|||HKEY_LOCAL_MACHINE                                                                  HKLM|\\n|||HKEY_USERS                                                                                     HKU|\\n|||HKEY_LOCAL_MACHINE\\\\System\\\\ControlSet00x                          HKLM\\\\System\\\\CurrentControlSet|\\n|||HKEY_LOCAL_MACHINE\\\\Classes                                                    HKCR|\\n| \\t13\\t | \\tRegistryEvent (Value Set)\\t | \\tThis Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.\\t |\\n| \\t14\\t | \\tRegistryEvent (Key and Value Rename)\\t | \\tRegistry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.\\t |\\n| \\t15\\t | \\tFileCreateStreamHash\\t | \\tThis event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream. There are malware variants that drop their executables or configuration settings via browser downloads, and this event is aimed at capturing that based on the browser attaching a Zone.Identifier �mark of the web� stream.\\t |\\n| \\t16\\t | \\tServiceConfigurationChange\\t | \\tThis event logs changes in the Sysmon configuration - for example when the filtering rules are updated.\\t |\\n| \\t17\\t | \\tPipeEvent (Pipe Created)\\t | \\tThis event generates when a named pipe is created. Malware often uses named pipes for interprocess communication.\\t |\\n| \\t18\\t | \\tPipeEvent (Pipe Connected)\\t | \\tThis event logs when a named pipe connection is made between a client and a server.\\t |\\n| \\t19\\t | \\tWmiEvent (WmiEventFilter activity detected)\\t | \\tWhen a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.\\t |\\n| \\t20\\t | \\tWmiEvent (WmiEventConsumer activity detected)\\t | \\tThis event logs the registration of WMI consumers, recording the consumer name, log, and destination.\\t |\\n| \\t21\\t | \\tWmiEvent (WmiEventConsumerToFilter activity detected)\\t | \\tWhen a consumer binds to a filter, this event logs the consumer name and filter path.\\t |\\n| \\t22\\t | \\tDNSEvent (DNS query)\\t | \\tThis event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.\\t |\\n| \\t23\\t | \\tFileDelete (A file delete was detected)\\t | \\tA file was deleted.\\t |\\n| \\t24\\t | \\tClipboardChange (New content in the clipboard)\\t | \\tThis event is generated when the system clipboard contents change.\\t |\\n| \\t25\\t | \\tProcessTampering (Process image change)\\t | \\tThis event is generated when a process image is changed from an external source, such as a different process.\\t |\\n| \\t255\\t | \\tError\\t | \\tThis event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the Sysinternals forum or over Twitter (@markrussinovich).\\t |\\n\\nFor more information see *https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"title\":\"vis_sd_sysmon_event_code_reference\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"2f1ca8e2-75c0-4f84-b0f1-192d2bff49c0","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NDgsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_events_by_computer_timelion","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_events_by_computer_timelion\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(q=winlog.provider_name:Microsoft-Windows-Sysmon, index=winlogbeat-*, split=winlog.computer_name:40).label(\\\"$1\\\",\\\"^.* > winlog.computer_name:(\\\\S+) > .*\\\").title(\\\"Sysmon events by computer\\\").legend(position=nw).yaxis(label=\\\"Number of events\\\")\",\"interval\":\"auto\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"c1138577-9732-431b-8584-fbf5a7e333cf","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NDksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"21ac13ec-ac49-42f0-94ab-1075ca23e3e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NTAsMV0="} -{"attributes":{"description":"Summarizes collected Sysmon event data","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":24,\"h\":13,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Total number of Sysmon events found\",\"panelRefName\":\"panel_2\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":3,\"w\":24,\"h\":13,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"title\":\"Percentage of Sysmon events by event code\",\"panelRefName\":\"panel_3\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":16,\"w\":24,\"h\":18,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Count of Sysmon events by event code\",\"panelRefName\":\"panel_4\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":16,\"w\":24,\"h\":18,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"asc\"}}},\"enhancements\":{}},\"title\":\"Top 10 hosts generating the most Sysmon data\",\"panelRefName\":\"panel_5\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":34,\"w\":48,\"h\":21,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon event code reference\",\"panelRefName\":\"panel_7\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":55,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon events\",\"panelRefName\":\"panel_8\"},{\"version\":\"8.7.1\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"76bd58e2-b637-4a48-ae79-4ca8abeab308\"},\"panelIndex\":\"76bd58e2-b637-4a48-ae79-4ca8abeab308\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_76bd58e2-b637-4a48-ae79-4ca8abeab308\"}]","timeRestore":false,"title":"Sysmon Summary","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-21T22:21:37.974Z","id":"newdashboard","managed":false,"references":[{"id":"b7fe57cb-6119-4ba8-b169-63cdf51d8d31","name":"2:panel_2","type":"visualization"},{"id":"7c60b9ca-af8f-4563-8719-099c16c0020a","name":"3:panel_3","type":"visualization"},{"id":"875432d0-510b-4d4c-a77d-563e1bd70a62","name":"4:panel_4","type":"visualization"},{"id":"34250ab9-39e2-4601-8aa5-3d047b43c632","name":"5:panel_5","type":"visualization"},{"id":"2f1ca8e2-75c0-4f84-b0f1-192d2bff49c0","name":"7:panel_7","type":"visualization"},{"id":"c1138577-9732-431b-8584-fbf5a7e333cf","name":"8:panel_8","type":"visualization"},{"id":"21ac13ec-ac49-42f0-94ab-1075ca23e3e5","name":"76bd58e2-b637-4a48-ae79-4ca8abeab308:panel_76bd58e2-b637-4a48-ae79-4ca8abeab308","type":"visualization"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-21T22:21:37.974Z","version":"WzE1NTEsMV0="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":10,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/elastic/sysmon_summary_2_0.ndjson b/dashboards/elastic/sysmon_summary_2_0.ndjson new file mode 100644 index 00000000..1ed94600 --- /dev/null +++ b/dashboards/elastic/sysmon_summary_2_0.ndjson @@ -0,0 +1,124 @@ +{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{\"event.action\":{\"count\":2},\"process.name\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.KeyFilePath\":{\"count\":2},\"file.path\":{\"count\":1},\"event.code\":{\"count\":1},\"event.provider\":{\"count\":1}}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:37.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"logs-*","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:37.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzEzNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:\\\"Microsoft-Windows-Sysmon/Operational\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_sysmon_all_events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":false,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":0},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_datatable\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event code\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"90a5fcee-d3fb-4969-a336-869ab6808777","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_host_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_host_events_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Missing computer name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"split\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Missing computer name\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_event_code_reference","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| \\tEvent ID\\t | \\tEvent\\t | \\tDescription\\t |\\n| \\t:-:\\t | \\t:-\\t | \\t-\\t |\\n| \\t1\\t | \\tProcess creation\\t | \\tThe process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.\\t |\\n| \\t2\\t | \\tA process changed a file creation time\\t | \\tThe change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\\t |\\n| \\t3\\t | \\tNetwork connection\\t | \\tThe network connection event logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.\\t |\\n| \\t4\\t | \\tSysmon service state changed\\t | \\tThe service state change event reports the state of the Sysmon service (started or stopped).\\t |\\n| \\t5\\t | \\tProcess terminated\\t | \\tThe process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.\\t |\\n| \\t6\\t | \\tDriver loaded\\t | \\tThe driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.\\t |\\n| \\t7\\t | \\tImage loaded\\t | \\tThe image loaded event logs when a module is loaded in a specific process. This event is disabled by default and needs to be configured with the �l option. It indicates the process in which the module is loaded, hashes and signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading. This event should be configured carefully, as monitoring all image load events will generate a large number of events.\\t |\\n| \\t8\\t | \\tCreateRemoteThread\\t | \\tThe CreateRemoteThread event detects when a process creates a thread in another process. This technique is used by malware to inject code and hide in other processes. The event indicates the source and target process. It gives information on the code that will be run in the new thread: StartAddress, StartModule and StartFunction. Note that StartModule and StartFunction fields are inferred, they might be empty if the starting address is outside loaded modules or known exported functions.\\t |\\n| \\t9\\t | \\tRawAccessRead\\t | \\tThe RawAccessRead event detects when a process conducts reading operations from the drive using the \\\\\\\\\\\\\\\\.\\\\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.\\t |\\n| \\t10\\t | \\tProcessAccess\\t | \\tThe process accessed event reports when a process opens another process, an operation that�s often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks. Enabling it can generate significant amounts of logging if there are diagnostic utilities active that repeatedly open processes to query their state, so it generally should only be done so with filters that remove expected accesses.\\t |\\n| \\t11\\t | \\tFileCreate\\t | \\tFile create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.\\t |\\n| \\t12\\t | \\tRegistryEvent (Object create and delete)\\t | \\tRegistry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications. Sysmon uses abbreviated versions of Registry root key names, with the following mappings: |\\n|||**Key name**                                                                                          **Abbreviation**|\\n|||HKEY_LOCAL_MACHINE                                                                  HKLM|\\n|||HKEY_USERS                                                                                     HKU|\\n|||HKEY_LOCAL_MACHINE\\\\System\\\\ControlSet00x                          HKLM\\\\System\\\\CurrentControlSet|\\n|||HKEY_LOCAL_MACHINE\\\\Classes                                                    HKCR|\\n| \\t13\\t | \\tRegistryEvent (Value Set)\\t | \\tThis Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.\\t |\\n| \\t14\\t | \\tRegistryEvent (Key and Value Rename)\\t | \\tRegistry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.\\t |\\n| \\t15\\t | \\tFileCreateStreamHash\\t | \\tThis event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream. There are malware variants that drop their executables or configuration settings via browser downloads, and this event is aimed at capturing that based on the browser attaching a Zone.Identifier �mark of the web� stream.\\t |\\n| \\t16\\t | \\tServiceConfigurationChange\\t | \\tThis event logs changes in the Sysmon configuration - for example when the filtering rules are updated.\\t |\\n| \\t17\\t | \\tPipeEvent (Pipe Created)\\t | \\tThis event generates when a named pipe is created. Malware often uses named pipes for interprocess communication.\\t |\\n| \\t18\\t | \\tPipeEvent (Pipe Connected)\\t | \\tThis event logs when a named pipe connection is made between a client and a server.\\t |\\n| \\t19\\t | \\tWmiEvent (WmiEventFilter activity detected)\\t | \\tWhen a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.\\t |\\n| \\t20\\t | \\tWmiEvent (WmiEventConsumer activity detected)\\t | \\tThis event logs the registration of WMI consumers, recording the consumer name, log, and destination.\\t |\\n| \\t21\\t | \\tWmiEvent (WmiEventConsumerToFilter activity detected)\\t | \\tWhen a consumer binds to a filter, this event logs the consumer name and filter path.\\t |\\n| \\t22\\t | \\tDNSEvent (DNS query)\\t | \\tThis event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.\\t |\\n| \\t23\\t | \\tFileDelete (A file delete was detected)\\t | \\tA file was deleted.\\t |\\n| \\t24\\t | \\tClipboardChange (New content in the clipboard)\\t | \\tThis event is generated when the system clipboard contents change.\\t |\\n| \\t25\\t | \\tProcessTampering (Process image change)\\t | \\tThis event is generated when a process image is changed from an external source, such as a different process.\\t |\\n| \\t255\\t | \\tError\\t | \\tThis event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the Sysinternals forum or over Twitter (@markrussinovich).\\t |\\n\\nFor more information see *https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"title\":\"vis_sd_sysmon_event_code_reference\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"88efefcc-de0a-4a08-9a17-3d09423092e0","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - MITRE Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - MITRE Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### MITRE ATT&CK Technique\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"63587a03-5f00-4678-b1fa-99b31a719c25","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"high\\\" or signal.rule.severity : \\\"critical\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Critical Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"133f677c-628d-4684-af5f-0c906e4101cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Mitre Technique Table2","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Mitre Technique Table2\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"MITRE ID\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.reference\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Reference\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":true,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1993dc60-efe8-46ec-952d-cc4d513cee72","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"medium\\\" or signal.rule.severity : \\\"low\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Suspicious Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Signals Overview","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signals Overview\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Suspicious Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","managed":false,"references":[{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Signal guage","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signal guage\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signal Gauge\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Signals Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Signals Overview\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Signals Data Table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Signals Data Table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":105,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Rule Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.tactic.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":500,\"otherBucket\":false,\"otherBucketLabel\":\"Uncatergorised\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Tactic\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.severity\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Severity\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":11,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Rule Name\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Uncatergorised\",\"otherBucketLabel\":\"Uncatergorised\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Tactic\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Severity\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Technique\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"Alerting - Signals Details","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Details\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signals Details \\n[View alerts dashboard](/app/security/alerts)\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Further Signals Info","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Further Signals Info\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":250,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\".\"},\"schema\":\"split\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"event.created\",\"timeRange\":{\"from\":\"now-24h\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30m\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No host data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Hostname\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No User Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"1\"},\"schema\":\"bucket\"},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column2\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"2\"},\"schema\":\"bucket\"},{\"id\":\"8\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column3\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"3\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":1,\"aggType\":\"date_histogram\",\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm\"}},\"label\":\"event.created per 30 minutes\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No host data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"Hostname\",\"params\":{}},{\"accessor\":3,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No User Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"User\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"1\",\"params\":{}},{\"accessor\":5,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"2\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"3\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}],\"splitRow\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\".\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"row\":true,\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Event Log Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Event Log Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Full Event Logs\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MCwxXQ=="} +{"attributes":{"color":"#e5e289","description":"Logging Made Easy Custom Dashboards","name":"Logging Made Easy"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"05484269-a438-43a1-8114-4f32479f51c4","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2MywxXQ=="} +{"attributes":{"description":"Alerting Overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":false,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":true}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":28,\"i\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},\"panelIndex\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":0,\"w\":10,\"h\":4,\"i\":\"02fa17ed-1419-415c-9a27-f90684d5645f\"},\"panelIndex\":\"02fa17ed-1419-415c-9a27-f90684d5645f\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Critical Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":0,\"w\":27,\"h\":5,\"i\":\"3832099d-1166-44f0-a766-270f65ae20c3\"},\"panelIndex\":\"3832099d-1166-44f0-a766-270f65ae20c3\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_3832099d-1166-44f0-a766-270f65ae20c3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":4,\"w\":10,\"h\":21,\"i\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\"},\"panelIndex\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"uiState\":{},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Critical Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"enhancements\":{},\"hidePanelTitles\":false,\"description\":\"This panel shows critical signals\"},\"title\":\"Signals Overview\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":5,\"w\":27,\"h\":17,\"i\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},\"panelIndex\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":28,\"w\":11,\"h\":4,\"i\":\"8459632e-bab5-491a-aad4-d40a09d9589e\"},\"panelIndex\":\"8459632e-bab5-491a-aad4-d40a09d9589e\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Suspicious Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":32,\"w\":11,\"h\":21,\"i\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\"},\"panelIndex\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_543e736d-1e0e-4096-a02d-a00b7a145ad8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":22,\"w\":27,\"h\":4,\"i\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\"},\"panelIndex\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_1688fd32-5aa8-4358-8587-d46f4e11613e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":26,\"w\":27,\"h\":25,\"i\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\"},\"panelIndex\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"gauge\",\"params\":{\"type\":\"gauge\",\"addTooltip\":true,\"addLegend\":true,\"isDisplayWarning\":false,\"gauge\":{\"alignment\":\"automatic\",\"extendRange\":true,\"percentageMode\":false,\"gaugeType\":\"Arc\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"Labels\",\"colorsRange\":[{\"from\":0,\"to\":50},{\"from\":50,\"to\":75},{\"from\":75,\"to\":100}],\"invertColors\":false,\"labels\":{\"show\":true,\"color\":\"black\"},\"scale\":{\"show\":true,\"labels\":false,\"color\":\"rgba(105,112,125,0.2)\"},\"type\":\"meter\",\"style\":{\"bgWidth\":0.9,\"width\":0.9,\"mask\":false,\"bgMask\":false,\"maskBars\":50,\"bgFill\":\"rgba(105,112,125,0.2)\",\"bgColor\":true,\"subText\":\"\",\"fontSize\":60}}},\"uiState\":{\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"}}},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{}}},\"hidePanelTitles\":false,\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"},\"legendOpen\":false}},\"title\":\"Alert Gauge\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":53,\"w\":21,\"h\":5,\"i\":\"93136da7-3849-4932-92f2-a443350636f2\"},\"panelIndex\":\"93136da7-3849-4932-92f2-a443350636f2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_93136da7-3849-4932-92f2-a443350636f2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":58,\"w\":21,\"h\":17,\"i\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\"},\"panelIndex\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_aa385ced-e59f-4096-8b49-ad0014c0087c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":75,\"w\":48,\"h\":8,\"i\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},\"panelIndex\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":83,\"w\":48,\"h\":21,\"i\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\"},\"panelIndex\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"asc\"}}},\"enhancements\":{}},\"panelRefName\":\"panel_a7f758eb-65c6-4202-86a3-b8b4a169845c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":104,\"w\":48,\"h\":6,\"i\":\"25f49696-70e2-472e-9992-287665c7db7d\"},\"panelIndex\":\"25f49696-70e2-472e-9992-287665c7db7d\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_25f49696-70e2-472e-9992-287665c7db7d\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":110,\"w\":48,\"h\":28,\"i\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\"},\"panelIndex\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"panelRefName\":\"panel_38cb573e-5533-48f8-874d-5cfd5929d68a\"}]","refreshInterval":{"pause":true,"value":0},"timeFrom":"now-7d/d","timeRestore":true,"timeTo":"now","title":"Alerting Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"baa4f981-0c75-43da-b96e-1107f171dfaa","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0:panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0","type":"links"},{"id":"63587a03-5f00-4678-b1fa-99b31a719c25","name":"3832099d-1166-44f0-a766-270f65ae20c3:panel_3832099d-1166-44f0-a766-270f65ae20c3","type":"visualization"},{"id":"133f677c-628d-4684-af5f-0c906e4101cb","name":"33d73051-f4d8-4ca0-826c-3d7060fa75da:search_0","type":"search"},{"id":"1993dc60-efe8-46ec-952d-cc4d513cee72","name":"2ab0a53c-c5c7-4116-afff-e0d119aeefa9:panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9","type":"visualization"},{"id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","name":"543e736d-1e0e-4096-a02d-a00b7a145ad8:panel_543e736d-1e0e-4096-a02d-a00b7a145ad8","type":"visualization"},{"id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","name":"1688fd32-5aa8-4358-8587-d46f4e11613e:panel_1688fd32-5aa8-4358-8587-d46f4e11613e","type":"visualization"},{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"739bc01e-ec0f-4565-92e3-1af95510fc60:search_0","type":"search"},{"id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","name":"93136da7-3849-4932-92f2-a443350636f2:panel_93136da7-3849-4932-92f2-a443350636f2","type":"visualization"},{"id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","name":"aa385ced-e59f-4096-8b49-ad0014c0087c:panel_aa385ced-e59f-4096-8b49-ad0014c0087c","type":"visualization"},{"id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","name":"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b:panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b","type":"visualization"},{"id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","name":"a7f758eb-65c6-4202-86a3-b8b4a169845c:panel_a7f758eb-65c6-4202-86a3-b8b4a169845c","type":"visualization"},{"id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","name":"25f49696-70e2-472e-9992-287665c7db7d:panel_25f49696-70e2-472e-9992-287665c7db7d","type":"visualization"},{"id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","name":"38cb573e-5533-48f8-874d-5cfd5929d68a:panel_38cb573e-5533-48f8-874d-5cfd5929d68a","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_host_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_chc_host_count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_filter_hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_filter_hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Events\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"Host name\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ae4d4888-b29b-459a-a369-ece810d70325","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"title_chc_software","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"title_chc_software\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Software\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"65c534a3-beee-4140-83ef-d511662e9ffa","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.param1","winlog.event_data.param11","winlog.event_data.param12","winlog.provider_name"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1000 or event.code:1002\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_proc_crash","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6c264739-59d8-4fd3-af36-27332178d08f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_proc_crashes","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_proc_crashes\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"0ms\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{},\"customLabel\":\"Date\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"interpolate\":\"linear\",\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_chc_crash_table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_crash_table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user_data.param1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Application\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"winlog.event_data.param1: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3cf72536-3546-4c88-9b4b-46cede29474f","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SourceImage","winlog.event_data.TargetImage"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:8 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_chc_create_remote_thread","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OCwxXQ=="} +{"attributes":{"description":"Shows software running on hosts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":21,\"i\":\"23406828-78ea-414f-b7eb-b1c76db1a992\"},\"panelIndex\":\"23406828-78ea-414f-b7eb-b1c76db1a992\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_23406828-78ea-414f-b7eb-b1c76db1a992\"},{\"type\":\"visualization\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":21,\"i\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\"},\"panelIndex\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Host Count\",\"panelRefName\":\"panel_67acd3d3-1fe1-4027-8e0d-17369b15986f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":21,\"i\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\"},\"panelIndex\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Filter Hosts\",\"panelRefName\":\"panel_bde0ab63-0219-412e-90b3-029fc58aa2df\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":4,\"i\":\"974eebf8-3870-403f-b4b8-0151e57408e1\"},\"panelIndex\":\"974eebf8-3870-403f-b4b8-0151e57408e1\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":true},\"panelRefName\":\"panel_974eebf8-3870-403f-b4b8-0151e57408e1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":25,\"w\":24,\"h\":15,\"i\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},\"panelIndex\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging\",\"panelRefName\":\"panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":25,\"w\":24,\"h\":15,\"i\":\"06f203bf-d632-4f1a-b024-67ec7373873b\"},\"panelIndex\":\"06f203bf-d632-4f1a-b024-67ec7373873b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging Count\",\"panelRefName\":\"panel_06f203bf-d632-4f1a-b024-67ec7373873b\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":56,\"w\":48,\"h\":15,\"i\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},\"panelIndex\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"CreateRemoteThread events\",\"panelRefName\":\"panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":16,\"i\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\"},\"panelIndex\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273\"}],\"state\":{\"visualization\":{\"layerId\":\"f9c66ef1-e443-4a34-950c-5c9556714273\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"isTransposed\":false,\"isMetric\":false},{\"isTransposed\":false,\"columnId\":\"1b266c97-5508-45bb-bb55-40f392f3de3c\"},{\"isTransposed\":false,\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"}]},\"query\":{\"query\":\"event.code: \\\"1\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f9c66ef1-e443-4a34-950c-5c9556714273\":{\"columns\":{\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":100,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1b266c97-5508-45bb-bb55-40f392f3de3c\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"1b266c97-5508-45bb-bb55-40f392f3de3c\",\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"],\"sampling\":1,\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Processes\"}]","timeRestore":false,"title":"Computer Software Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"23406828-78ea-414f-b7eb-b1c76db1a992:panel_23406828-78ea-414f-b7eb-b1c76db1a992","type":"links"},{"id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","name":"67acd3d3-1fe1-4027-8e0d-17369b15986f:panel_67acd3d3-1fe1-4027-8e0d-17369b15986f","type":"visualization"},{"id":"ae4d4888-b29b-459a-a369-ece810d70325","name":"bde0ab63-0219-412e-90b3-029fc58aa2df:panel_bde0ab63-0219-412e-90b3-029fc58aa2df","type":"visualization"},{"id":"65c534a3-beee-4140-83ef-d511662e9ffa","name":"974eebf8-3870-403f-b4b8-0151e57408e1:panel_974eebf8-3870-403f-b4b8-0151e57408e1","type":"visualization"},{"id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","name":"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f:panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f","type":"visualization"},{"id":"3cf72536-3546-4c88-9b4b-46cede29474f","name":"06f203bf-d632-4f1a-b024-67ec7373873b:panel_06f203bf-d632-4f1a-b024-67ec7373873b","type":"visualization"},{"id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","name":"9f671b0e-5ffb-46b6-af00-9dbc4d241121:panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121","type":"search"},{"id":"logs-*","name":"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f:indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1bb35497-6257-4b29-95fa-579306bda91a\"},\"panelIndex\":\"1bb35497-6257-4b29-95fa-579306bda91a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1bb35497-6257-4b29-95fa-579306bda91a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\"},\"panelIndex\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\",\"embeddableConfig\":{\"enhancements\":{},\"attributes\":{\"title\":\"Audit logons\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b\"}],\"state\":{\"visualization\":{\"layers\":[{\"categoryDisplay\":\"default\",\"layerId\":\"9da2d10b-4d81-4f9b-abbc-d950139a209b\",\"layerType\":\"data\",\"legendDisplay\":\"default\",\"metrics\":[\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"nestedLegend\":false,\"numberDisplay\":\"percent\",\"primaryGroups\":[\"2609b197-b493-4da4-9526-21b71512702a\"]}],\"shape\":\"donut\"},\"query\":{\"language\":\"kuery\",\"query\":\"4624\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9da2d10b-4d81-4f9b-abbc-d950139a209b\":{\"columnOrder\":[\"2609b197-b493-4da4-9526-21b71512702a\",\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"columns\":{\"2609b197-b493-4da4-9526-21b71512702a\":{\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"Top 5 values of host.name\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"ca9653b4-9247-4c13-98e0-beeb95821de0\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"host.name\"},\"ca9653b4-9247-4c13-98e0-beeb95821de0\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"}},\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":15,\"i\":\"6c884475-eba9-42bb-bcb7-145a5be31420\"},\"panelIndex\":\"6c884475-eba9-42bb-bcb7-145a5be31420\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos ticket - Failed attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"a40bb6e7-f754-425d-92c6-f94e9601af3c\",\"seriesType\":\"line\",\"xAccessor\":\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"splitAccessor\":\"fa882916-213f-40d3-b79e-216a43c16a72\",\"accessors\":[\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4769\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a40bb6e7-f754-425d-92c6-f94e9601af3c\":{\"columns\":{\"fa882916-213f-40d3-b79e-216a43c16a72\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"cb6cedeb-8521-4443-8bbc-c372817d75d7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fa882916-213f-40d3-b79e-216a43c16a72\",\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":15,\"w\":24,\"h\":7,\"i\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\"},\"panelIndex\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Account lockout -attempts\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1\"}],\"state\":{\"visualization\":{\"layerId\":\"42d33e36-7a47-4658-9792-5eff5f4918d1\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"ee31adc4-0bbd-40e0-86de-df6578c560b9\"},{\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4625\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"42d33e36-7a47-4658-9792-5eff5f4918d1\":{\"columns\":{\"ee31adc4-0bbd-40e0-86de-df6578c560b9\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ee31adc4-0bbd-40e0-86de-df6578c560b9\",\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":7,\"i\":\"17865857-b6e0-4e72-bf28-44b64f154df7\"},\"panelIndex\":\"17865857-b6e0-4e72-bf28-44b64f154df7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Special logon-attempts\",\"description\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707\"}],\"state\":{\"visualization\":{\"layerId\":\"67cdda05-ae7c-41b9-8a85-1e49828e9707\",\"layerType\":\"data\",\"metricAccessor\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\",\"breakdownByAccessor\":\"83a5ad17-791e-4869-bbb3-1a7465716837\"},\"query\":{\"language\":\"kuery\",\"query\":\"4672\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67cdda05-ae7c-41b9-8a85-1e49828e9707\":{\"columns\":{\"83a5ad17-791e-4869-bbb3-1a7465716837\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"83a5ad17-791e-4869-bbb3-1a7465716837\",\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":22,\"w\":24,\"h\":12,\"i\":\"face26df-a171-4753-8cda-79dea7b83ab6\"},\"panelIndex\":\"face26df-a171-4753-8cda-79dea7b83ab6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos auth request\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"d29fda24-60a4-4ddd-bf19-67175ef85af2\",\"primaryGroups\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\"],\"metrics\":[\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"default\",\"legendDisplay\":\"default\",\"nestedLegend\":false,\"layerType\":\"data\"}]},\"query\":{\"query\":\"4768\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d29fda24-60a4-4ddd-bf19-67175ef85af2\":{\"columns\":{\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a20bff59-6317-4758-ab4f-0bec099cd004\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"a20bff59-6317-4758-ab4f-0bec099cd004\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\",\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":24,\"h\":12,\"i\":\"29494e18-b33e-457b-9a07-664463eaf1e6\"},\"panelIndex\":\"29494e18-b33e-457b-9a07-664463eaf1e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Other logon /logoff-Disconnection attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"splitAccessor\":\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"accessors\":[\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4779\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\":{\"columns\":{\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":34,\"w\":24,\"h\":15,\"i\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\"},\"panelIndex\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Credential validation- attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"79c23cfd-619e-4bc7-bbca-d2564165f04b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"splitAccessor\":\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"accessors\":[\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4776\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"79c23cfd-619e-4bc7-bbca-d2564165f04b\":{\"columns\":{\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c4de01ed-8a99-4230-9cc5-6889447a60b6\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":24,\"h\":15,\"i\":\"b819c130-6164-41e4-8188-984964e44e39\"},\"panelIndex\":\"b819c130-6164-41e4-8188-984964e44e39\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon attempts by hosts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_horizontal_stacked\",\"layers\":[{\"layerId\":\"d8138ff4-5996-4544-9b28-98739cc15747\",\"seriesType\":\"bar_horizontal_stacked\",\"xAccessor\":\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"accessors\":[\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4624\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d8138ff4-5996-4544-9b28-98739cc15747\":{\"columns\":{\"d0dd77ee-78c7-457b-ad0d-ebe327215549\":{\"label\":\" host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":55,\"w\":24,\"h\":15,\"i\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\"},\"panelIndex\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon-using explicit credential attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"accessors\":[\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\",\"color\":\"#6092c0\"}]}]},\"query\":{\"query\":\"4648\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\":{\"columns\":{\"c19cba52-bfca-46e4-9ff9-e46579e4d378\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"},\"orderDirection\":\"asc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}}]","timeRestore":false,"title":"Credential Access logs Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e4d7b207-99aa-4410-8a2e-03487222bda1","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1bb35497-6257-4b29-95fa-579306bda91a:panel_1bb35497-6257-4b29-95fa-579306bda91a","type":"links"},{"id":"logs-*","name":"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2:indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b","type":"index-pattern"},{"id":"logs-*","name":"6c884475-eba9-42bb-bcb7-145a5be31420:indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c","type":"index-pattern"},{"id":"logs-*","name":"62e638ae-d23f-47dd-834b-bdcb2902f527:indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1","type":"index-pattern"},{"id":"logs-*","name":"17865857-b6e0-4e72-bf28-44b64f154df7:indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707","type":"index-pattern"},{"id":"logs-*","name":"face26df-a171-4753-8cda-79dea7b83ab6:indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2","type":"index-pattern"},{"id":"logs-*","name":"29494e18-b33e-457b-9a07-664463eaf1e6:indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317","type":"index-pattern"},{"id":"logs-*","name":"f2c86900-93cc-4480-bd84-f63f0cb0ac79:indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b","type":"index-pattern"},{"id":"logs-*","name":"b819c130-6164-41e4-8188-984964e44e39:indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747","type":"index-pattern"},{"id":"logs-*","name":"0d81bae9-3b04-4344-98f0-49202a2258ce:indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alpha - Health Check - Total Hosts - Metric","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alpha - Health Check - Total Hosts - Metric\",\"type\":\"metric\",\"aggs\":[{\"id\":\"3\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Total Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f0e888d4-b9e1-402f-8481-4195773d8a82","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Events by machine","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Events by machine\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Number of events seen\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"segment\"}],\"params\":{\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"62711d6d-17f8-4c2d-aa37-b11717455e53","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Users seen","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Users seen\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"winlog.user.name\",\"customLabel\":\"Users seen (total)\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8c34636f-01f4-4b46-b519-3120e5fe1731","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Unexpected Power Off","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Unexpected shutdowns","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Unexpected shutdowns\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":50,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","managed":false,"references":[{"id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNSwxXQ=="} +{"attributes":{"description":"Health Check overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},\"panelIndex\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":11,\"i\":\"ba924baf-3793-418e-a1de-ff805560f85b\"},\"panelIndex\":\"ba924baf-3793-418e-a1de-ff805560f85b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Total Hosts\",\"panelRefName\":\"panel_ba924baf-3793-418e-a1de-ff805560f85b\"},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":12,\"h\":21,\"i\":\"2b349db3-6677-43de-99ff-111253bee020\"},\"panelIndex\":\"2b349db3-6677-43de-99ff-111253bee020\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Alpha - Health Check - Number of Admins - Metric (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\",\"shouldTruncate\":true,\"maxLines\":5,\"legendStats\":[\"currentAndLastValue\"]},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"bf39875d-159e-4950-8c3d-803a61d82313\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"accessors\":[\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"winlog.event_id:1 and winlog.event_data.IntegrityLevel : \\\"High\\\" and not \\\"NT VIRTUAL MACHINE\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"1aab2c4b-51a1-4b7a-8173-1d0c9fb242a5\",\"key\":\"winlog.user.name\",\"field\":\"winlog.user.name\",\"type\":\"exists\"},\"query\":{\"exists\":{\"field\":\"winlog.user.name\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bf39875d-159e-4950-8c3d-803a61d82313\":{\"columns\":{\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"cf94e195-c66f-4040-9aee-44a0c719091a\":{\"label\":\"Unique Count of Admin Users\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}}},\"customLabel\":true}},\"columnOrder\":[\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Number of Admins\"},{\"type\":\"visualization\",\"gridData\":{\"x\":28,\"y\":0,\"w\":17,\"h\":21,\"i\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},\"panelIndex\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":8,\"h\":10,\"i\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},\"panelIndex\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":45,\"h\":12,\"i\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"},\"panelIndex\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"panelRefName\":\"panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"}]","timeRestore":false,"title":"HealthCheck Dashboard - Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fff78bfe-2758-4fa1-939f-362380fc607d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a:panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a","type":"links"},{"id":"f0e888d4-b9e1-402f-8481-4195773d8a82","name":"ba924baf-3793-418e-a1de-ff805560f85b:panel_ba924baf-3793-418e-a1de-ff805560f85b","type":"visualization"},{"id":"logs-*","name":"2b349db3-6677-43de-99ff-111253bee020:indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313","type":"index-pattern"},{"id":"62711d6d-17f8-4c2d-aa37-b11717455e53","name":"9479b8b7-fd3b-4160-8d3a-d7e4685c5819:panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819","type":"visualization"},{"id":"8c34636f-01f4-4b46-b519-3120e5fe1731","name":"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118:panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118","type":"visualization"},{"id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","name":"c4bcdc99-aaf7-4555-8ed0-d99f701396f2:panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"password_resets_and_changes logs","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"user_lockouts","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:1502\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_default_domain_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},\"panelIndex\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":28,\"h\":21,\"i\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\"},\"panelIndex\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\",\"accessors\":[\"40ece351-d270-400e-8da5-c469d428770f\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\"}]},\"query\":{\"query\":\"winlog.event_id:4657\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\":{\"columns\":{\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"40ece351-d270-400e-8da5-c469d428770f\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\",\"40ece351-d270-400e-8da5-c469d428770f\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Registry Object Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":36,\"y\":0,\"w\":12,\"h\":21,\"i\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\"},\"panelIndex\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df\"}],\"state\":{\"visualization\":{\"layerId\":\"8d620430-5405-4088-949e-1c7c369784df\",\"accessor\":\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4698\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8d620430-5405-4088-949e-1c7c369784df\":{\"columns\":{\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\":{\"label\":\"New Scheduled Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"winlog.event_id\",\"params\":{\"emptyAsNull\":false},\"customLabel\":true}},\"columnOrder\":[\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"New Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"c4767fa6-123a-4f2c-958f-504253babada\"},\"panelIndex\":\"c4767fa6-123a-4f2c-958f-504253babada\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Password Resets and Changes Logs\",\"panelRefName\":\"panel_c4767fa6-123a-4f2c-958f-504253babada\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\"},\"panelIndex\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2\"}],\"state\":{\"visualization\":{\"layerId\":\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\",\"accessor\":\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4702\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\":{\"columns\":{\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\":{\"label\":\"Updated Scheduler Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Updated Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":36,\"w\":24,\"h\":15,\"i\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},\"panelIndex\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"User Lockouts\",\"panelRefName\":\"panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":36,\"w\":24,\"h\":15,\"i\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\"},\"panelIndex\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\",\"accessors\":[\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"baf404fd-0f09-4df0-a861-2f15b539ca51\"}]},\"query\":{\"query\":\"winlog.event_id:4724 or winlog.event_id:4723\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\":{\"columns\":{\"baf404fd-0f09-4df0-a861-2f15b539ca51\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"51979016-6414-4ce0-aa1e-bb07e33110c0\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"baf404fd-0f09-4df0-a861-2f15b539ca51\",\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Resets and Changes\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":51,\"w\":24,\"h\":15,\"i\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\"},\"panelIndex\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\",\"accessors\":[\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"8e283438-d965-48a0-b803-cea59d83d093\"}]},\"query\":{\"query\":\"winlog.event_id:4782\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\":{\"columns\":{\"8e283438-d965-48a0-b803-cea59d83d093\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"96f3ed8f-397d-4947-ab3c-789a15fb329c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"8e283438-d965-48a0-b803-cea59d83d093\",\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Hash Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":51,\"w\":24,\"h\":15,\"i\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\"},\"panelIndex\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\",\"accessors\":[\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\"}]},\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\":{\"columns\":{\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\",\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"User Lockouts\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":66,\"w\":24,\"h\":15,\"i\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\"},\"panelIndex\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Changes to Default Domain Policy\",\"panelRefName\":\"panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9\"}]","timeRestore":false,"title":"Identity Access Management 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1fafa69c-12b3-49eb-b4dc-cd14591eb597:panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597","type":"links"},{"id":"logs-*","name":"68d682d0-f9a5-44c1-a0a0-9f731f970cd0:indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c","type":"index-pattern"},{"id":"logs-*","name":"d5d99e08-12e4-4f56-8a89-9b9e52b6a007:indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df","type":"index-pattern"},{"id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","name":"c4767fa6-123a-4f2c-958f-504253babada:panel_c4767fa6-123a-4f2c-958f-504253babada","type":"search"},{"id":"logs-*","name":"15b71263-a739-41f2-bc7c-38a5586aec9d:indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2","type":"index-pattern"},{"id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","name":"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81:panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81","type":"search"},{"id":"logs-*","name":"35f07da3-7a63-455b-b393-adf2032d5a7a:indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd","type":"index-pattern"},{"id":"logs-*","name":"ce9cad31-6b06-472c-b249-d0ad1efcb5cf:indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf","type":"index-pattern"},{"id":"logs-*","name":"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72:indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c","type":"index-pattern"},{"id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","name":"ac85c23f-b911-474e-b45e-cbbf1456c9a9:panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:\\\"4946\\\" or winlog.event_id:\\\"4947\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"new_or_modified_exception_list_rules","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4950\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_settings","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4954\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7b4c9843-87d7-42b9-935e-ff4713840de3","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5024 or winlog.event_id:5033\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned on","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5025 or winlog.event_id:5034\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned off","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"53b18c74-3370-4237-a524-90fd7489bf47","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4719\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_audit_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"26bac78a-07ef-4925-9473-4e2f60e5c151","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4713\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_kerberos","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},\"panelIndex\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":14,\"h\":21,\"i\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\"},\"panelIndex\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f\"}],\"state\":{\"visualization\":{\"layerId\":\"b64767f2-cf92-4fc3-b001-8e256e39314f\",\"accessor\":\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b64767f2-cf92-4fc3-b001-8e256e39314f\":{\"columns\":{\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\":{\"label\":\"RPC Connection Attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":2}}},\"customLabel\":true}},\"columnOrder\":[\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"RPC Connection Attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":14,\"h\":21,\"i\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\"},\"panelIndex\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee\"}],\"state\":{\"visualization\":{\"layerId\":\"44404bd2-1430-4712-9667-3fa30aed28ee\",\"accessor\":\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4946 or winlog.event_id:4947\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"44404bd2-1430-4712-9667-3fa30aed28ee\":{\"columns\":{\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\":{\"label\":\"Added or Updated Rules to Firewall Exception List\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":14,\"i\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\"},\"panelIndex\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"357c66cc-ad43-42ef-807c-5911c93ab357\",\"accessors\":[\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\"}]},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"357c66cc-ad43-42ef-807c-5911c93ab357\":{\"columns\":{\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"ecc638ab-21e8-4123-a662-cf612107dedd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\",\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"RPC Connections\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":15,\"i\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},\"panelIndex\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\",\"panelRefName\":\"panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":50,\"w\":24,\"h\":15,\"i\":\"955799aa-0778-4034-9624-2d258c7ee7d5\"},\"panelIndex\":\"955799aa-0778-4034-9624-2d258c7ee7d5\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Setting Changes\",\"panelRefName\":\"panel_955799aa-0778-4034-9624-2d258c7ee7d5\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":50,\"w\":24,\"h\":15,\"i\":\"73173146-a695-4da9-8760-f327c3d39b5f\"},\"panelIndex\":\"73173146-a695-4da9-8760-f327c3d39b5f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Policy Changes\",\"panelRefName\":\"panel_73173146-a695-4da9-8760-f327c3d39b5f\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":65,\"w\":24,\"h\":15,\"i\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},\"panelIndex\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned On\",\"panelRefName\":\"panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":65,\"w\":24,\"h\":15,\"i\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},\"panelIndex\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned Off\",\"panelRefName\":\"panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":80,\"w\":24,\"h\":15,\"i\":\"8ee424e6-e3df-4389-838c-4923da9036f6\"},\"panelIndex\":\"8ee424e6-e3df-4389-838c-4923da9036f6\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Audit Policy Changes\",\"panelRefName\":\"panel_8ee424e6-e3df-4389-838c-4923da9036f6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":80,\"w\":24,\"h\":15,\"i\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},\"panelIndex\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Kerberos Policy Changes\",\"panelRefName\":\"panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":95,\"w\":24,\"h\":15,\"i\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\"},\"panelIndex\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\",\"accessors\":[\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"c970c28f-4b0f-4560-be20-691ef6ff7722\"}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\":{\"columns\":{\"c970c28f-4b0f-4560-be20-691ef6ff7722\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c85c4fcc-e896-4607-bf76-4531ea13358e\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"c970c28f-4b0f-4560-be20-691ef6ff7722\",\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Start Up\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":95,\"w\":24,\"h\":15,\"i\":\"cde6896d-e694-4467-915c-a40f8a96e072\"},\"panelIndex\":\"cde6896d-e694-4467-915c-a40f8a96e072\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"646160c2-9253-4e43-b062-e99092afccb2\",\"accessors\":[\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"bc53a3ce-785a-48be-b77c-4f54950fd843\"}]},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"646160c2-9253-4e43-b062-e99092afccb2\":{\"columns\":{\"bc53a3ce-785a-48be-b77c-4f54950fd843\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18118859-447e-4ddc-aab9-7a6193e562f1\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc53a3ce-785a-48be-b77c-4f54950fd843\",\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shut Down\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":110,\"w\":24,\"h\":15,\"i\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\"},\"panelIndex\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c\"}],\"state\":{\"visualization\":{\"layerId\":\"b14413de-d521-4fae-9803-61bb7bb0481c\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\",\"isTransposed\":false},{\"columnId\":\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"isTransposed\":false}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b14413de-d521-4fae-9803-61bb7bb0481c\":{\"columns\":{\"26c59d98-b16d-4231-b7f0-9cf5738531ab\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"43a09ae6-c67c-41ab-a028-590677c0fbb0\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Startups\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":110,\"w\":24,\"h\":15,\"i\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\"},\"panelIndex\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"isTransposed\":false},{\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\",\"isTransposed\":false}],\"layerId\":\"a4076119-449b-4671-b641-1576ea6b1a4d\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a4076119-449b-4671-b641-1576ea6b1a4d\":{\"columns\":{\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"310e557f-37b5-406a-85e6-7eabac7c522b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"310e557f-37b5-406a-85e6-7eabac7c522b\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shutdowns\"}]","timeRestore":false,"title":"Policy Changes and System Activity 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"614a8392-17b5-49c4-9397-bc3cac526c61","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a:panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a","type":"links"},{"id":"logs-*","name":"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd:indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f","type":"index-pattern"},{"id":"logs-*","name":"638a3409-963c-41bf-b44c-5c84631ed0d5:indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee","type":"index-pattern"},{"id":"logs-*","name":"0c81b645-b5a7-4c63-a4df-34be3cd2bad3:indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357","type":"index-pattern"},{"id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","name":"ec3a6d47-cc36-440f-ad19-1482eb9f5b68:panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68","type":"search"},{"id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","name":"955799aa-0778-4034-9624-2d258c7ee7d5:panel_955799aa-0778-4034-9624-2d258c7ee7d5","type":"search"},{"id":"7b4c9843-87d7-42b9-935e-ff4713840de3","name":"73173146-a695-4da9-8760-f327c3d39b5f:panel_73173146-a695-4da9-8760-f327c3d39b5f","type":"search"},{"id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","name":"59995b8c-7f7f-4d12-998f-ae94ef27ed89:panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89","type":"search"},{"id":"53b18c74-3370-4237-a524-90fd7489bf47","name":"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8:panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8","type":"search"},{"id":"26bac78a-07ef-4925-9473-4e2f60e5c151","name":"8ee424e6-e3df-4389-838c-4923da9036f6:panel_8ee424e6-e3df-4389-838c-4923da9036f6","type":"search"},{"id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","name":"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e:panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e","type":"search"},{"id":"logs-*","name":"39bc0b92-1ba5-46a6-a527-094f749c86cf:indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb","type":"index-pattern"},{"id":"logs-*","name":"cde6896d-e694-4467-915c-a40f8a96e072:indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2","type":"index-pattern"},{"id":"logs-*","name":"95d5d91c-454a-477b-a2a2-c12df98091ab:indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c","type":"index-pattern"},{"id":"logs-*","name":"6f9bce5a-19c2-4f12-ba21-6066488a01c3:indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOCwxXQ=="} +{"attributes":{"columns":[],"description":"This dashboard will audit, privileged use and detailed tracking processes. ","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"refreshInterval":{"pause":true,"value":5000},"sort":[["@timestamp","desc"]],"timeRange":{"from":"now-30d/d","to":"now"},"timeRestore":true,"title":"Privileged Activity dashboard ","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":6,\"h\":25,\"i\":\"8048e972-d666-4403-ba50-805ec6552a2e\"},\"panelIndex\":\"8048e972-d666-4403-ba50-805ec6552a2e\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8048e972-d666-4403-ba50-805ec6552a2e\"},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":0,\"w\":21,\"h\":13,\"i\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\"},\"panelIndex\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"f8e3a2b3-9937-415f-b405-27363667b11e\",\"seriesType\":\"line\",\"xAccessor\":\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"accessors\":[\"ed03924f-84eb-434a-834b-1f074954b815\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4688\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f8e3a2b3-9937-415f-b405-27363667b11e\":{\"columns\":{\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"ed03924f-84eb-434a-834b-1f074954b815\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"ed03924f-84eb-434a-834b-1f074954b815\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"ed03924f-84eb-434a-834b-1f074954b815\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":0,\"w\":19,\"h\":13,\"i\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\"},\"panelIndex\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process termination\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873\"},{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"splitAccessor\":\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"accessors\":[\"8580666f-56c1-4af5-80fd-6178148354be\"],\"layerType\":\"data\"},{\"layerId\":\"3293242f-292b-4b40-9a26-d77cf1ae570c\",\"layerType\":\"data\",\"accessors\":[],\"seriesType\":\"bar_stacked\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4689\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\":{\"columns\":{\"57566510-cf0e-4e35-b01d-8b5821f389fc\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8580666f-56c1-4af5-80fd-6178148354be\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"e3910605-fe72-4ac8-9250-49d64f1cba7b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"8580666f-56c1-4af5-80fd-6178148354be\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"8580666f-56c1-4af5-80fd-6178148354be\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"},\"3293242f-292b-4b40-9a26-d77cf1ae570c\":{\"linkToLayers\":[],\"columns\":{},\"columnOrder\":[],\"sampling\":1,\"ignoreGlobalFilters\":false,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":13,\"w\":21,\"h\":12,\"i\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\"},\"panelIndex\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Audit Sensitive privilege Use\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"layers\":[{\"accessors\":[\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"layerId\":\"unifiedHistogram\",\"layerType\":\"data\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"date_column\"}],\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"preferredSeriesType\":\"bar_stacked\",\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\"},\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"date_column\",\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"columns\":{\"1ec9d305-2ddb-4c55-99db-549c767142a1\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"date_column\":{\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Privilege service attempts \"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":13,\"w\":19,\"h\":12,\"i\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\"},\"panelIndex\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Token assigned to process\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882\"}],\"state\":{\"visualization\":{\"layerId\":\"9ab8eb11-2529-4e5e-a153-834e29cc7882\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"aa267d47-4c05-4d62-9e91-523fd042b1d0\"},{\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"}]},\"query\":{\"query\":\"4696\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9ab8eb11-2529-4e5e-a153-834e29cc7882\":{\"columns\":{\"aa267d47-4c05-4d62-9e91-523fd042b1d0\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"feeda031-4d04-4512-bb90-f78038ef4666\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"aa267d47-4c05-4d62-9e91-523fd042b1d0\",\"feeda031-4d04-4512-bb90-f78038ef4666\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Assigned Token \"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":25,\"w\":27,\"h\":13,\"i\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\"},\"panelIndex\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Non-sensitive privilege event\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\"}],\"state\":{\"visualization\":{\"layerId\":\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\",\"accessor\":\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":2714.66},{\"color\":\"#d6bf57\",\"stop\":5429.33},{\"color\":\"#cc5642\",\"stop\":8144}],\"continuity\":\"above\",\"maxSteps\":5,\"colorStops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":2714.66},{\"color\":\"#cc5642\",\"stop\":5429.33}]}},\"textAlign\":\"center\",\"titlePosition\":\"bottom\",\"size\":\"l\"},\"query\":{\"query\":\"4674\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\":{\"columns\":{\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Non-sensitive privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":25,\"w\":19,\"h\":13,\"i\":\"f3f34099-a467-4343-9985-2b1fb741c78f\"},\"panelIndex\":\"f3f34099-a467-4343-9985-2b1fb741c78f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Edit visualization\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"layerId\":\"unifiedHistogram\",\"accessor\":\"count_column\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"type\":\"palette\",\"name\":\"status\",\"params\":{\"name\":\"status\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":1048.5,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":466},{\"color\":\"#cc5642\",\"stop\":932}],\"steps\":3,\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"l\",\"titlePosition\":\"bottom\"},\"query\":{\"language\":\"kuery\",\"query\":\"4674\"},\"filters\":[{\"meta\":{\"index\":\"c1678fe0-175c-4aa3-abcc-ee8260800574\",\"type\":\"exists\",\"key\":\"@timestamp\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"@timestamp\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"count_column\"],\"columns\":{\"count_column\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"@timestamp\",\"isBucketed\":false,\"params\":{\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}},\"emptyAsNull\":true},\"customLabel\":true}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Sensitive Privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":38,\"w\":27,\"h\":13,\"i\":\"7423841b-4470-4aee-ad93-a1a558c54d80\"},\"panelIndex\":\"7423841b-4470-4aee-ad93-a1a558c54d80\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"curveType\":\"LINEAR\",\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":false,\"yLeft\":false,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":-90},\"layers\":[{\"accessors\":[\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"isHistogram\":true,\"layerId\":\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\",\"layerType\":\"data\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"seriesType\":\"bar_stacked\",\"simpleView\":false,\"splitAccessor\":\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"xAccessor\":\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"xScaleType\":\"time\",\"yConfig\":[{\"axisMode\":\"left\",\"forAccessor\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"}]}],\"legend\":{\"isVisible\":true,\"legendSize\":\"auto\",\"maxLines\":1,\"position\":\"right\",\"shouldTruncate\":true,\"showSingleSeries\":true,\"legendStats\":[]},\"preferredSeriesType\":\"bar_stacked\",\"showCurrentTimeMarker\":false,\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\",\"yLeftExtent\":{\"enforce\":true,\"mode\":\"full\"},\"yLeftScale\":\"linear\",\"yRightScale\":\"linear\",\"yTitle\":\"Count\"},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\":{\"columnOrder\":[\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"columns\":{\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\":{\"customLabel\":true,\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\":{\"customLabel\":true,\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"winlog.event_data.User: Descending\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.User\"},\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\":{\"customLabel\":true,\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"dropPartials\":false,\"includeEmptyRows\":false,\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Process creation-Activities\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"4d293281-b115-4bf5-8143-be056b148c25\"},\"panelIndex\":\"4d293281-b115-4bf5-8143-be056b148c25\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Privilege Activity entry \",\"panelRefName\":\"panel_4d293281-b115-4bf5-8143-be056b148c25\"}]","timeRestore":false,"title":"Privileged Activity log Dashboards 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8048e972-d666-4403-ba50-805ec6552a2e:panel_8048e972-d666-4403-ba50-805ec6552a2e","type":"links"},{"id":"logs-*","name":"c98b5f54-1c52-4163-8cba-8e09e9765c61:indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c","type":"index-pattern"},{"id":"logs-*","name":"0a90ec8c-687d-4165-9ab1-327baf40fb82:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"8d4ac232-4cce-46b1-b1de-ffbbc839a958:indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882","type":"index-pattern"},{"id":"logs-*","name":"ace01c88-d563-4633-a8d3-b26ec8eca790:indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6","type":"index-pattern"},{"id":"logs-*","name":"f3f34099-a467-4343-9985-2b1fb741c78f:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"7423841b-4470-4aee-ad93-a1a558c54d80:indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743","type":"index-pattern"},{"id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","name":"4d293281-b115-4bf5-8143-be056b148c25:panel_4d293281-b115-4bf5-8143-be056b148c25","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Process - hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Total Processes\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"host.name: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOSwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.ProcessId","winlog.event_data.ParentProcessId","winlog.event_data.CommandLine","winlog.event_data.User","winlog.event_data.IntegrityLevel"],"description":"","grid":{"columns":{"host.name":{"width":202},"winlog.event_data.IntegrityLevel":{"width":238},"winlog.event_data.ParentProcessId":{"width":141},"winlog.event_data.ProcessId":{"width":116}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawn Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2a069ea5-946c-4c62-9e95-a4801299794d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Process - Spawned area ","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Spawned area \",\"type\":\"area\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15w\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"1d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"labels\":{},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD\"}},\"params\":{\"date\":true,\"interval\":\"P1D\",\"intervalESValue\":1,\"intervalESUnit\":\"d\",\"format\":\"YYYY-MM-DD\",\"bounds\":{\"min\":\"2020-01-22T16:30:25.973Z\",\"max\":\"2020-05-06T15:30:25.973Z\"}},\"label\":\"@timestamp per day\",\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","managed":false,"references":[{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - Users bar","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Users bar\",\"type\":\"histogram\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d/d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"12h\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"user.name: Descending\",\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\",\"radiusRatio\":0,\"truncateLegend\":true,\"maxLegendLines\":1}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMiwxXQ=="} +{"attributes":{"columns":["host.name","event.action","process.name","user.name","file.path"],"description":"","grid":{"columns":{"@timestamp":{"width":240},"event.code":{"width":148},"event.provider":{"width":260},"host.name":{"width":168},"winlog.event_data.TargetFilename":{"width":630}}},"hideChart":true,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"event.action: \\\"creation\\\" AND file.path.text: \\\"*\\\\\\\\Downloads\\\\\\\\*\\\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"rowHeight":1,"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Download Test 2","usesAdHocDataView":false,"viewMode":"documents"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.EventType","winlog.event_data.TargetObject","winlog.event_data.Details"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:12 or event.code:13 or event.code:14) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process - Registry events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8584f0da-88c3-478e-bd13-fff76a975897","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\"},\"panelIndex\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_429e5318-e2ae-4637-ac70-eb4a12f191e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":40,\"h\":21,\"i\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},\"panelIndex\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Hosts\",\"panelRefName\":\"panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},\"panelIndex\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Process spawns over time\",\"panelRefName\":\"panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\"},\"panelIndex\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Processes created by users over time\",\"panelRefName\":\"panel_b6b8e77e-67f7-42ce-a835-650ad795834f\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":15,\"i\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\"},\"panelIndex\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process - Users (converted)\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500\"}],\"state\":{\"visualization\":{\"layerId\":\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\",\"alignment\":\"left\",\"hidden\":true},{\"columnId\":\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"alignment\":\"left\"},{\"columnId\":\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"alignment\":\"left\"}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\":{\"columns\":{\"12f20e93-46d3-4931-926b-91fbf9177d4e\":{\"label\":\"Domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\":{\"label\":\"Username\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Users\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},\"panelIndex\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\",\"embeddableConfig\":{\"enhancements\":{},\"columns\":[\"@timestamp\",\"host.name\",\"winlog.event_data.CommandLine\",\"winlog.event_data.User\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ParentProcessId\"]},\"title\":\"Process spawn event logs (Sysmon ID 1)\",\"panelRefName\":\"panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":68,\"w\":48,\"h\":14,\"i\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},\"panelIndex\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\",\"embeddableConfig\":{\"hidePanelTitles\":false,\"description\":\"Shows all the files created in Downloads Directory.\",\"rowHeight\":1,\"enhancements\":{}},\"title\":\"Files created (in Downloads)\",\"panelRefName\":\"panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":82,\"w\":48,\"h\":15,\"i\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\"},\"panelIndex\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Registry events (Sysmon 12, 13, 14)\",\"panelRefName\":\"panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e\"}]","timeRestore":false,"title":"Process Explorer 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"429e5318-e2ae-4637-ac70-eb4a12f191e6:panel_429e5318-e2ae-4637-ac70-eb4a12f191e6","type":"links"},{"id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","name":"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f:panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f","type":"visualization"},{"id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","name":"2cb3c5a0-bf16-43b4-a69d-73012062f55b:panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b","type":"visualization"},{"id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","name":"b6b8e77e-67f7-42ce-a835-650ad795834f:panel_b6b8e77e-67f7-42ce-a835-650ad795834f","type":"visualization"},{"id":"logs-*","name":"9a28d907-c8ef-4815-8ebc-ac897b19ab48:indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500","type":"index-pattern"},{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd:panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd","type":"search"},{"id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","name":"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10:panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10","type":"search"},{"id":"8584f0da-88c3-478e-bd13-fff76a975897","name":"502494bd-c9c5-4f2a-a85f-ffc27cec088e:panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNSwxXQ=="} +{"attributes":{"columns":["event.code","event.action","winlog.logon.type","host.name","winlog.event_data.LogonProcessName","winlog.logon.id","winlog.event_data.SubjectUserName","winlog.event_data.IpAddress","winlog.event_data.TargetDomainName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Vis_sd_security_log_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Vis_sd_security_log_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Count\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1005636a-f473-4a39-a905-ec18aa855ce1","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_id","winlog.event_data.TokenElevationType","winlog.event_data.MandatoryLabel","winlog.event_data.ProcessId","winlog.event_data.ProcessName","process.parent.executable","process.executable"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code: \\\"4688\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4688_process_creation","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOCwxXQ=="} +{"attributes":{"columns":["winlog.user_data.SubjectDomainName","winlog.user_data.SubjectUserName","host.name","event.code","winlog.user_data.Channel","event.module"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1102\\\" OR event.code:\\\"104\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_1102_security_log_cleared","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:2\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_2","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"92562206-3ca8-4227-8dc3-c69d56598302","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_2_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_2_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"logon created locally\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","managed":false,"references":[{"id":"92562206-3ca8-4227-8dc3-c69d56598302","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"winlog.channel\",\"negate\":false,\"params\":{\"query\":\"Security\"},\"type\":\"phrase\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"winlog.channel\":{\"query\":\"Security\"}}}}]}"},"title":"vis_sd_security_4624_picker","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_picker\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1570446686972\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Computername\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"21038ddc-61bb-4709-9a06-e9d399ada64a","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMiwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:3\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_3","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"0d2b506b-85b9-4624-924c-a588072e5ad7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"not user.name:*$\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_3_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_3_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Network logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"network logon by user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","managed":false,"references":[{"id":"0d2b506b-85b9-4624-924c-a588072e5ad7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:5\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_5","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"08f51fba-7f74-4724-a424-d90fd6f433e6","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_5_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_5_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Service account used\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon as service with user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":16,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4752d143-4f0a-4685-b890-7a19e29a0efa","managed":false,"references":[{"id":"08f51fba-7f74-4724-a424-d90fd6f433e6","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:8\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_8","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bbed4a2c-015d-44db-ad34-de2173a81668","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_8_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_8_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Credentials sent in clear text\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7c34827-8829-4c45-81ad-26ffff747efe","managed":false,"references":[{"id":"bbed4a2c-015d-44db-ad34-de2173a81668","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.WorkstationName","winlog.event_data.TargetUserName","winlog.event_data.LogonType","winlog.event_data.IpAddress","winlog.event_data.Status","winlog.event_data.SubStatus"],"description":"New settings test 9/29/2023 16:44","grid":{"columns":{"winlog.event_data.Status":{"width":221}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4625\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4625_failed_logon","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc86684-4065-45c3-9847-2d4c241ec544","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f754ea3-d5cc-4060-8b99-c330f973d797","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectUserName","winlog.computer_name","winlog.task","winlog.event_id","winlog.event_data.PrivilegeList"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4672\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4672_special_privileges_assigned","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":\"NT AUTHORITY, Window Manager, Font Driver Host\",\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4672_special_privileges_assigned_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4672_special_privileges_assigned_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computername\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges logged on\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_types_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_types_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"|Logon Type|Logon Title|Description|\\n| :-: | :- | :- |\\n| 2 | Interactive | A user logged on to this computer. |\\n| 3 | Network | A user or computer logged on to this computer from the network. |\\n| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |\\n| 5 | Service | A service was started by the Service Control Manager. |\\n| 7 | Unlock | This workstation was unlocked. |\\n| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |\\n| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |\\n| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |\\n| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_status_codes_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_codes_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.LogonType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.Status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.SubStatus\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":true,\"truncateLegend\":true,\"maxLegendLines\":5,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_status_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| Code | Description |\\n| :- | :- |\\n| 0XC000005E | There are currently no logon servers available to service the logon request. |\\n| 0xC0000064 | User logon with misspelled or bad user account |\\n| 0xC000006A | User logon with misspelled or bad password |\\n| 0XC000006D | This is either due to a bad username or authentication information |\\n| 0XC000006E | Unknown user name or bad password. |\\n| 0xC000006F | User logon outside authorized hours |\\n| 0xC0000070 | User logon from unauthorized workstation |\\n| 0xC0000071 | User logon with expired password |\\n| 0xC0000072 | User logon to account disabled by administrator |\\n| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |\\n| 0XC0000133 | Clocks between DC and other computer too far out of sync |\\n| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |\\n| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |\\n| 0XC0000192 | An attempt was made to logon, but the Netlogon service was not started. |\\n| 0xC0000193 | User logon with expired account |\\n| 0XC0000224 | User is required to change password at next logon |\\n| 0XC0000225 | Evidently a bug in Windows and not a risk |\\n| 0xC0000234 | User logon with account locked |\\n| 0XC00002EE | Failure Reason: An Error occurred during Logon |\\n| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |\\n| 0x0 | Status OK. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SubjectUserName","winlog.event_data.TargetUserName","winlog.event_data.TargetServerName","winlog.event_data.SubjectDomainName","winlog.event_data.TargetDomainName","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4648 \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4648_logon_explicit_creds_running_as_different_user","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_logs_computernames_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Logged events\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"filters\",\"schema\":\"bucket\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_id : 4624\",\"language\":\"kuery\"},\"label\":\"EventID 4624\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":1000,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computername\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"vis_sd_security_logs_computernames_datatable\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7410752-98c4-4145-adb4-1c39506f58ca","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NiwxXQ=="} +{"attributes":{"description":"Security log related events","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security logs events\",\"panelRefName\":\"panel_1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":137,\"w\":48,\"h\":17,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Process creation - event ID 4688\",\"panelRefName\":\"panel_2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":112,\"w\":48,\"h\":8,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Log Cleared - event ID 1102 or 104\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":154,\"w\":48,\"h\":18,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logon created - Logon type 2\",\"panelRefName\":\"panel_6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select a computer to filter the below results. Leave blank for all\",\"panelRefName\":\"panel_7\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":172,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - network logon created - Logon type 3\",\"panelRefName\":\"panel_8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":120,\"w\":48,\"h\":17,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log events - Detail\",\"panelRefName\":\"panel_9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":48,\"h\":17,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - logon as a service - Logon type 5\",\"panelRefName\":\"panel_10\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":204,\"w\":48,\"h\":15,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Credential sent as clear text - Logon type 8\",\"panelRefName\":\"panel_11\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":15,\"i\":\"15\"},\"panelIndex\":\"15\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon attempts\",\"panelRefName\":\"panel_15\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":219,\"w\":48,\"h\":18,\"i\":\"19\"},\"panelIndex\":\"19\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logons with special privileges assigned - event ID 4672\",\"panelRefName\":\"panel_19\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":18,\"i\":\"21\"},\"panelIndex\":\"21\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon type codes\",\"panelRefName\":\"panel_21\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":54,\"w\":48,\"h\":16,\"i\":\"22\"},\"panelIndex\":\"22\",\"embeddableConfig\":{\"enhancements\":{},\"description\":\"\"},\"title\":\"Failed logon and reason (see table for explanations)\",\"panelRefName\":\"panel_22\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":70,\"w\":48,\"h\":26,\"i\":\"23\"},\"panelIndex\":\"23\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon status codes\",\"panelRefName\":\"panel_23\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":237,\"w\":48,\"h\":15,\"i\":\"28\"},\"panelIndex\":\"28\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"title\":\"Security log - Process started with different credentials- event ID 4648 [could be RUNAS, scheduled tasks]\",\"panelRefName\":\"panel_28\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":8,\"w\":24,\"h\":13,\"i\":\"30\"},\"panelIndex\":\"30\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"title\":\"Select a computername to filter\",\"panelRefName\":\"panel_30\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"69421b10-759e-477d-8f28-adf6e198c8b5\"},\"panelIndex\":\"69421b10-759e-477d-8f28-adf6e198c8b5\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_69421b10-759e-477d-8f28-adf6e198c8b5\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":96,\"w\":48,\"h\":16,\"i\":\"96010259-5ae8-4632-bcce-34078573b1cd\"},\"panelIndex\":\"96010259-5ae8-4632-bcce-34078573b1cd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed Logons\",\"panelRefName\":\"panel_96010259-5ae8-4632-bcce-34078573b1cd\"}]","timeRestore":false,"title":"Security Dashboard - Security Log 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"beeeb066-d497-4b2a-99d3-44d741238bd1","managed":false,"references":[{"id":"1005636a-f473-4a39-a905-ec18aa855ce1","name":"1:panel_1","type":"visualization"},{"id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","name":"2:panel_2","type":"search"},{"id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","name":"3:panel_3","type":"search"},{"id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","name":"6:panel_6","type":"visualization"},{"id":"21038ddc-61bb-4709-9a06-e9d399ada64a","name":"7:panel_7","type":"visualization"},{"id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","name":"8:panel_8","type":"visualization"},{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"9:panel_9","type":"search"},{"id":"4752d143-4f0a-4685-b890-7a19e29a0efa","name":"10:panel_10","type":"visualization"},{"id":"a7c34827-8829-4c45-81ad-26ffff747efe","name":"11:panel_11","type":"visualization"},{"id":"3f754ea3-d5cc-4060-8b99-c330f973d797","name":"15:panel_15","type":"visualization"},{"id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","name":"19:panel_19","type":"visualization"},{"id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","name":"21:panel_21","type":"visualization"},{"id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","name":"22:panel_22","type":"visualization"},{"id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","name":"23:panel_23","type":"visualization"},{"id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","name":"28:panel_28","type":"search"},{"id":"a7410752-98c4-4145-adb4-1c39506f58ca","name":"30:panel_30","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"69421b10-759e-477d-8f28-adf6e198c8b5:panel_69421b10-759e-477d-8f28-adf6e198c8b5","type":"links"},{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"96010259-5ae8-4632-bcce-34078573b1cd:panel_96010259-5ae8-4632-bcce-34078573b1cd","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - User activity title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - User activity title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## All user activity\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - Logon title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Logon title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Logon / Logoff events\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NywxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectDomainName","winlog.event_data.TargetUserName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"user.name":{"width":193},"winlog.event_data.SubjectDomainName":{"width":193}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4624\\\" and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_data.LogonType\",\"value\":[\"2\",\"10\",\"11\",\"7\"],\"params\":[\"2\",\"10\",\"11\",\"7\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_data.LogonType\":\"2\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"10\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"11\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"7\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Interactive Logon search","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{"columns":{"winlog.event_data.TargetDomainName":{"width":241},"winlog.event_data.TargetUserName":{"width":241}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:\\\"4634\\\" OR event.code:\\\"4647\\\" ) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"HR - Interactive v Remote pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Interactive v Remote pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"2\\\"\",\"language\":\"lucene\"},\"label\":\"Interactive\"},{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"10\\\"\\n\",\"language\":\"lucene\"},\"label\":\"RemoteInteractive\"}]},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"label\":\"filters\",\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MCwxXQ=="} +{"attributes":{"description":"Overview of user activity for Human Resources\n","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":24,\"i\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},\"panelIndex\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":20,\"h\":12,\"i\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\"},\"panelIndex\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"accessors\":[\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"splitAccessor\":\"fc23a029-309e-40a7-aeca-309fd8423ced\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\":{\"columns\":{\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\":{\"label\":\"Top 5 values of winlog.event_data.SubjectDomainName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.SubjectDomainName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"fc23a029-309e-40a7-aeca-309fd8423ced\":{\"label\":\"Top 3 values of winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5a238afa-9ffa-4568-8a43-6167c0a76b67\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"fc23a029-309e-40a7-aeca-309fd8423ced\",\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Users\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":20,\"h\":12,\"i\":\"69771c75-8536-49b2-a835-c134ada8cd8d\"},\"panelIndex\":\"69771c75-8536-49b2-a835-c134ada8cd8d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"accessors\":[\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"position\":\"top\",\"seriesType\":\"bar\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"22b4e313-2858-411e-a90b-911198fa34fe\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\":{\"columns\":{\"22b4e313-2858-411e-a90b-911198fa34fe\":{\"label\":\"Top 5 values of winlog.computer_name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.computer_name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"22b4e313-2858-411e-a90b-911198fa34fe\",\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Computers\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":12,\"w\":40,\"h\":12,\"i\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},\"panelIndex\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select domain(s) and username(s)\",\"panelRefName\":\"panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":24,\"w\":48,\"h\":4,\"i\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\"},\"panelIndex\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_f2f654b0-42ef-403c-bee2-7e26499f809a\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":48,\"h\":14,\"i\":\"e40e6077-f799-4c66-9bf8-1664121d8069\"},\"panelIndex\":\"e40e6077-f799-4c66-9bf8-1664121d8069\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f46d1729-4bd5-4219-9973-01913c208fef\",\"accessors\":[\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f46d1729-4bd5-4219-9973-01913c208fef\":{\"columns\":{\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"800c3857-3c9c-4fc5-a403-3fcbede05599\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\",\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events by Time\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":42,\"w\":48,\"h\":4,\"i\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},\"panelIndex\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":46,\"w\":24,\"h\":15,\"i\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},\"panelIndex\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logon events (filter by LogonId)\",\"panelRefName\":\"panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":46,\"w\":24,\"h\":15,\"i\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\"},\"panelIndex\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logoff events (correlate to logon events)\",\"panelRefName\":\"panel_bb42b25e-f934-485b-854c-440cc1b3ebee\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":24,\"h\":15,\"i\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"},\"panelIndex\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"In person vs Remote logons\",\"panelRefName\":\"panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"}]","timeRestore":false,"title":"User HR 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d:panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d","type":"links"},{"id":"logs-*","name":"c8d3e871-1f5d-40bd-a0f9-5441a58cad32:indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093","type":"index-pattern"},{"id":"logs-*","name":"69771c75-8536-49b2-a835-c134ada8cd8d:indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2","type":"index-pattern"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"ab726ae4-6c98-4f26-8cd3-07bf2808b704:panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704","type":"visualization"},{"id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","name":"f2f654b0-42ef-403c-bee2-7e26499f809a:panel_f2f654b0-42ef-403c-bee2-7e26499f809a","type":"visualization"},{"id":"logs-*","name":"e40e6077-f799-4c66-9bf8-1664121d8069:indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef","type":"index-pattern"},{"id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","name":"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e:panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e","type":"visualization"},{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"755f30aa-d6ad-46d9-b2c3-7425c02ed03e:panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e","type":"search"},{"id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","name":"bb42b25e-f934-485b-854c-440cc1b3ebee:panel_bb42b25e-f934-485b-854c-440cc1b3ebee","type":"search"},{"id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","name":"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f:panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"1587572089136\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4a675166-ce19-4836-9567-eda4ab46b3d5","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - Filter Hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Filter Hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Event count\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8d476795-134d-4689-9050-a24b57adaa90","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security - Select Host","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select Host\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588685297382\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Logons Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logons Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Logons\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4eccff45-c97a-480f-b593-4744922893e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human User Logon Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon attempts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon attempts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Login attempts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f7d1f53-6b70-4235-879a-f149d98c9063","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon events over time","uiStateJSON":"{\"vis\":{\"colors\":{\"Failed attempts\":\"#BF1B00\",\"Successful atempts\":\"#629E51\"}}}","version":1,"visState":"{\"title\":\"Security - Logon events over time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":1,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-23T08:41:59.000Z\",\"max\":\"2020-04-23T08:56:59.000Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"event.code:4625\",\"language\":\"lucene\"},\"label\":\"Failed attempts\"},{\"input\":{\"query\":\"event.code:4624\",\"language\":\"lucene\"},\"label\":\"Successful atempts\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15m\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"42ae3f23-386c-4ceb-bb84-98879107338b","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4,624, 4,625\",\"params\":[\"4624\",\"4625\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}},{\"match_phrase\":{\"event.code\":\"4625\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Computers\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MCwxXQ=="} +{"attributes":{"columns":["event.code","host.name","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.IpAddress","event.action","event.outcome","winlog.event_data.LogonType"],"description":"","grid":{"columns":{"user.domain":{"width":119},"user.name":{"width":134}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human Logon & Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Network Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Network Connections\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80b03097-c117-44d0-8413-3c932d0886a2","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id : \\\"3\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"All network activity ","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f02a3c3d-eb39-4347-91f7-d62bece13128","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Activity Line","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Activity Line\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Connections\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Connections\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Connections\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-24T15:29:10.918Z\",\"max\":\"2020-04-24T15:44:10.918Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"aa741894-2140-4529-a488-6d34ed57abef","managed":false,"references":[{"id":"f02a3c3d-eb39-4347-91f7-d62bece13128","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.DestinationHostname","destination.ip","winlog.event_data.DestinationIsIpv6","network.","process.executable","winlog.event_data.DestinationPort","winlog.event_data.Protocol","winlog.user.name","winlog.user.type","source.ip","winlog.event_data.SourceIsIpv6","source.port","network.protocol"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_non_browsers_connection","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50b150ad-5aff-4706-9229-d9bcb38255ef","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Overview - Processes with unusual network activity","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Overview - Processes with unusual network activity\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"params\":{\"field\":\"process.name\",\"size\":10,\"include\":\"\",\"json\":\"\",\"customLabel\":\"Process\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"string\"},\"params\":{},\"label\":\"Process\",\"aggType\":\"significant_terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NiwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{"columns":{"winlog.event_data.SubjectDomainName":{"width":216}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_non_private_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Processes Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Processes Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Processes & Powershell\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.User","winlog.event_data.ProcessId","winlog.event_data.ProcessName","winlog.event_data.Hashes","process.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawns","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OSwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.command_line","process.parent.executable","process.parent.command_line","file.path","event.code"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\" OR process.command_line.text:\\\"powershell\\\" OR parent.process.command_line.text:\\\"powershell\\\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_powershell_run","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell Run Count","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Security - Powershell Run Count\",\"type\":\"metric\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell runs over time","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now/w\",\"to\":\"now/w\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}],\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\"},\"title\":\"Security - Powershell runs over time\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Power shell hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"title\":\"Security - Power shell hosts pie\",\"type\":\"pie\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.args","process.parent.executable","process.parent.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND process.command_line.text:(\\\"invoke\\\" or \\\"bypass\\\" or \\\"iex\\\" or \\\"ex\\\" or \\\"icm\\\" or \\\"new-object\\\" or \\\"set\\\" or \\\"get\\\" or \\\"write\\\" or \\\"out\\\" or \\\"download\\\" or \\\"encoded\\\")\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Potentially Suspicious Powershell","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","destination.domain","destination.ip"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND (process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_powershell_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04c60a34-98a9-4073-8538-97996e80855f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Files title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Files title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Files\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"file.path.text: \\\"tmp\\\" OR file.path.text:\\\"temp\\\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"file.path\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"exists\":{\"field\":\"file.path\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"TEMP & %TEMP%","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d3792434-6184-44ed-bad4-830249085d68","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"TEMP & %TEMP%","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target File\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":30,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Hostname\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"TEMP & %TEMP%\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","managed":false,"references":[{"id":"d3792434-6184-44ed-bad4-830249085d68","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NSwxXQ=="} +{"attributes":{"columns":["@timestamp","user.domain","user.name","host.name","process.executable","winlog.event_data.ProcessId"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: \\\"9\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Raw Access Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Windows Defender Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Windows Defender Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Windows Defender\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a2cdbce1-9070-4851-909f-774a80d2875a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - AV Events Count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - AV Events Count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Windows AV Events\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ac9a9da-1772-483c-8c32-b049f0273186","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_id\",\"value\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"params\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"negate\":false,\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_id\":\"1006\"}},{\"match_phrase\":{\"winlog.event_id\":\"1007\"}},{\"match_phrase\":{\"winlog.event_id\":\"1008\"}},{\"match_phrase\":{\"winlog.event_id\":\"1009\"}},{\"match_phrase\":{\"winlog.event_id\":\"1116\"}},{\"match_phrase\":{\"winlog.event_id\":\"1117\"}},{\"match_phrase\":{\"winlog.event_id\":\"1118\"}},{\"match_phrase\":{\"winlog.event_id\":\"1119\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"AV Detection event","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"AV Hits (Count)","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"AV Hits (Count)\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"AV Detection hits\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fe86395f-474e-43a1-a772-34d1306373e0","managed":false,"references":[{"id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.Detection User","host.name","winlog.event_data.Path","winlog.event_data.FWLink"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: 1116\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"Microsoft-Windows-Windows Defender\"},\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"match_phrase\":{\"event.provider\":{\"query\":\"Microsoft-Windows-Windows Defender\"}}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Defender AV Detections","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MSwxXQ=="} +{"attributes":{"description":"User Security overview, filtered by Domain / Username or hostname","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},\"panelIndex\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":15,\"h\":11,\"i\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},\"panelIndex\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search users\",\"panelRefName\":\"panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},{\"type\":\"visualization\",\"gridData\":{\"x\":23,\"y\":0,\"w\":25,\"h\":11,\"i\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\"},\"panelIndex\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Filter hosts\",\"panelRefName\":\"panel_62ea04ec-0776-46c0-9b8c-cf2915600337\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":15,\"h\":10,\"i\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\"},\"panelIndex\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search hosts\",\"panelRefName\":\"panel_45ac8571-ae44-4bb5-a237-cd230ede51d5\"},{\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":11,\"w\":25,\"h\":10,\"i\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\"},\"panelIndex\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\",\"isTransposed\":false},{\"columnId\":\"26752485-2aa5-4908-b400-504d6e7ef451\",\"isTransposed\":false},{\"columnId\":\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"layerType\":\"data\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d123adeb-fd39-4176-b3c9-69c88d2852d5\":{\"columns\":{\"6f33ff19-9959-4c43-b791-939582a0b3d2\":{\"label\":\"Event Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"26752485-2aa5-4908-b400-504d6e7ef451\":{\"label\":\"Filters\",\"dataType\":\"string\",\"operationType\":\"filters\",\"scale\":\"ordinal\",\"isBucketed\":true,\"params\":{\"filters\":[{\"label\":\"\",\"input\":{\"query\":\"\\\"log\\\" : *\",\"language\":\"kuery\"}}]}},\"cc4e45f6-be3a-4de0-a416-e21043b601bb\":{\"label\":\"Top 3 values of user.domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"user.domain\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"26752485-2aa5-4908-b400-504d6e7ef451\",\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"6f33ff19-9959-4c43-b791-939582a0b3d2\"],\"sampling\":1,\"indexPatternId\":\"logs-*\",\"incompleteColumns\":{}}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter users\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":5,\"i\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},\"panelIndex\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":26,\"w\":9,\"h\":7,\"i\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\"},\"panelIndex\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_e5de9fc4-5863-470c-8246-0a86f5af897e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":9,\"y\":26,\"w\":20,\"h\":14,\"i\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},\"panelIndex\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logon attempts\",\"panelRefName\":\"panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},{\"type\":\"visualization\",\"gridData\":{\"x\":29,\"y\":26,\"w\":19,\"h\":14,\"i\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},\"panelIndex\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logged on computers\",\"panelRefName\":\"panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":33,\"w\":9,\"h\":7,\"i\":\"0d1c0533-598a-4304-80be-c22047edcbe1\"},\"panelIndex\":\"0d1c0533-598a-4304-80be-c22047edcbe1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0d1c0533-598a-4304-80be-c22047edcbe1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":17,\"i\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},\"panelIndex\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User Logon & Logoff Events\",\"panelRefName\":\"panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":57,\"w\":48,\"h\":4,\"i\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\"},\"panelIndex\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0fab3d76-5411-46e4-982f-4d4626c977b8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":48,\"h\":14,\"i\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},\"panelIndex\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"All network connections\",\"panelRefName\":\"panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":75,\"w\":24,\"h\":15,\"i\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},\"panelIndex\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network Process List (converted)\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\"}],\"state\":{\"visualization\":{\"layerId\":\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\",\"alignment\":\"left\"},{\"columnId\":\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"alignment\":\"left\"},{\"columnId\":\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"alignment\":\"left\"},{\"columnId\":\"f467badb-5f40-4b21-bdaf-f378db834902\",\"isTransposed\":false,\"isMetric\":false}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\":{\"ignoreGlobalFilters\":false,\"columns\":{\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\":{\"label\":\"Destination IP\",\"dataType\":\"ip\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"destination.ip\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\":{\"label\":\"Computer\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5330e606-7244-4d38-a5a3-d94d5c6412c2\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"f467badb-5f40-4b21-bdaf-f378db834902\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"f467badb-5f40-4b21-bdaf-f378db834902\",\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network Process List\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":75,\"w\":24,\"h\":15,\"i\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},\"panelIndex\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network connections area (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\",\"seriesType\":\"bar\",\"xAccessor\":\"70a3abae-7040-4287-97d3-550088410400\",\"accessors\":[\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"layerType\":\"data\",\"colorMapping\":{\"assignments\":[],\"specialAssignments\":[{\"rule\":{\"type\":\"other\"},\"color\":{\"type\":\"loop\"},\"touched\":false}],\"paletteId\":\"eui_amsterdam_color_blind\",\"colorMode\":{\"type\":\"categorical\"}}}]},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\":{\"ignoreGlobalFilters\":false,\"columns\":{\"70a3abae-7040-4287-97d3-550088410400\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0fbfe911-4334-4e6f-8256-b72f2a280259\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"0fbfe911-4334-4e6f-8256-b72f2a280259\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"70a3abae-7040-4287-97d3-550088410400\",\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network connections area\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":90,\"w\":48,\"h\":15,\"i\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},\"panelIndex\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Unusual network connections from non-browser processes\",\"panelRefName\":\"panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":105,\"w\":48,\"h\":10,\"i\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\"},\"panelIndex\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network Connection Events (Sysmon ID 3)\",\"panelRefName\":\"panel_ea6ad677-7322-4c5c-8946-cac4dd983b26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":115,\"w\":48,\"h\":4,\"i\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\"},\"panelIndex\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_43b61744-5553-4fd1-894c-6e91a799f4a2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":119,\"w\":48,\"h\":14,\"i\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\"},\"panelIndex\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Spawned Processes\",\"panelRefName\":\"panel_9a522603-8d31-4ad6-ac4f-130a814f54fa\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":133,\"w\":10,\"h\":15,\"i\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},\"panelIndex\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell Events\",\"panelRefName\":\"panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":10,\"y\":133,\"w\":20,\"h\":15,\"i\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},\"panelIndex\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events over time\",\"panelRefName\":\"panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":30,\"y\":133,\"w\":18,\"h\":15,\"i\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\"},\"panelIndex\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events by computer\",\"panelRefName\":\"panel_ed7a59ea-caa7-4396-89b7-90c6b8363800\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":148,\"w\":25,\"h\":16,\"i\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},\"panelIndex\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Potentially suspicious powershell\",\"panelRefName\":\"panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},{\"type\":\"search\",\"gridData\":{\"x\":25,\"y\":148,\"w\":23,\"h\":16,\"i\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\"},\"panelIndex\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell network connections\",\"panelRefName\":\"panel_9587ef7f-3554-4886-be6a-fae4648e87dd\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":164,\"w\":48,\"h\":4,\"i\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},\"panelIndex\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":168,\"w\":24,\"h\":15,\"i\":\"4988f659-a275-4317-b071-8a350087a4e6\"},\"panelIndex\":\"4988f659-a275-4317-b071-8a350087a4e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"References to temporary files\",\"panelRefName\":\"panel_4988f659-a275-4317-b071-8a350087a4e6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":168,\"w\":24,\"h\":15,\"i\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},\"panelIndex\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"RawAccessRead (Sysmon Event 9)\",\"panelRefName\":\"panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":183,\"w\":48,\"h\":4,\"i\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},\"panelIndex\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":12,\"h\":14,\"i\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},\"panelIndex\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Defender event count\",\"panelRefName\":\"panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},{\"type\":\"visualization\",\"gridData\":{\"x\":12,\"y\":187,\"w\":12,\"h\":14,\"i\":\"30454a55-0210-43d2-af3d-822c5b519033\"},\"panelIndex\":\"30454a55-0210-43d2-af3d-822c5b519033\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_30454a55-0210-43d2-af3d-822c5b519033\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":187,\"w\":24,\"h\":14,\"i\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"},\"panelIndex\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"AV Detections (Event 1116)\",\"panelRefName\":\"panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"}]","timeRestore":false,"title":"User Security 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc36188-8461-4927-932e-0e452b7dc3ac","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1dd50c7d-7e5d-439d-9071-544339f6ef3f:panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f","type":"links"},{"id":"4a675166-ce19-4836-9567-eda4ab46b3d5","name":"956d6ef1-5d6b-4ccc-a123-fa66805c15db:panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db","type":"visualization"},{"id":"8d476795-134d-4689-9050-a24b57adaa90","name":"62ea04ec-0776-46c0-9b8c-cf2915600337:panel_62ea04ec-0776-46c0-9b8c-cf2915600337","type":"visualization"},{"id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","name":"45ac8571-ae44-4bb5-a237-cd230ede51d5:panel_45ac8571-ae44-4bb5-a237-cd230ede51d5","type":"visualization"},{"id":"logs-*","name":"1324f39e-f215-45e9-b679-05b06e4fcb9d:indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5","type":"index-pattern"},{"id":"4eccff45-c97a-480f-b593-4744922893e5","name":"b453a1df-c025-430b-84e3-d6dc7a8c48f1:panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1","type":"visualization"},{"id":"3f7d1f53-6b70-4235-879a-f149d98c9063","name":"e5de9fc4-5863-470c-8246-0a86f5af897e:panel_e5de9fc4-5863-470c-8246-0a86f5af897e","type":"visualization"},{"id":"42ae3f23-386c-4ceb-bb84-98879107338b","name":"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48:panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48","type":"visualization"},{"id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","name":"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2:panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2","type":"visualization"},{"id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","name":"0d1c0533-598a-4304-80be-c22047edcbe1:panel_0d1c0533-598a-4304-80be-c22047edcbe1","type":"visualization"},{"id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","name":"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396:panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396","type":"search"},{"id":"80b03097-c117-44d0-8413-3c932d0886a2","name":"0fab3d76-5411-46e4-982f-4d4626c977b8:panel_0fab3d76-5411-46e4-982f-4d4626c977b8","type":"visualization"},{"id":"aa741894-2140-4529-a488-6d34ed57abef","name":"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305:panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305","type":"visualization"},{"id":"logs-*","name":"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c:indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f","type":"index-pattern"},{"id":"logs-*","name":"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b:indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9","type":"index-pattern"},{"id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","name":"6d5d4b74-133b-4fef-8ae5-14d2e7037a78:panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78","type":"visualization"},{"id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","name":"ea6ad677-7322-4c5c-8946-cac4dd983b26:panel_ea6ad677-7322-4c5c-8946-cac4dd983b26","type":"search"},{"id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","name":"43b61744-5553-4fd1-894c-6e91a799f4a2:panel_43b61744-5553-4fd1-894c-6e91a799f4a2","type":"visualization"},{"id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","name":"9a522603-8d31-4ad6-ac4f-130a814f54fa:panel_9a522603-8d31-4ad6-ac4f-130a814f54fa","type":"search"},{"id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","name":"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6:panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6","type":"visualization"},{"id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","name":"68d75f76-3806-4d15-81e9-d0dcfa34c9b9:panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9","type":"visualization"},{"id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","name":"ed7a59ea-caa7-4396-89b7-90c6b8363800:panel_ed7a59ea-caa7-4396-89b7-90c6b8363800","type":"visualization"},{"id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","name":"cfe390f9-80a7-4a11-9a8c-7d599e41e38a:panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a","type":"search"},{"id":"04c60a34-98a9-4073-8538-97996e80855f","name":"9587ef7f-3554-4886-be6a-fae4648e87dd:panel_9587ef7f-3554-4886-be6a-fae4648e87dd","type":"search"},{"id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","name":"7cfff19f-bf9d-4101-be63-4d9b8ea78e26:panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26","type":"visualization"},{"id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","name":"4988f659-a275-4317-b071-8a350087a4e6:panel_4988f659-a275-4317-b071-8a350087a4e6","type":"visualization"},{"id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","name":"bfae12f4-b2fd-471f-a111-daf49cd25ed3:panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3","type":"search"},{"id":"a2cdbce1-9070-4851-909f-774a80d2875a","name":"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b:panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b","type":"visualization"},{"id":"6ac9a9da-1772-483c-8c32-b049f0273186","name":"e8c5ac63-42b4-4081-85e3-378c85c0b4cb:panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb","type":"visualization"},{"id":"fe86395f-474e-43a1-a772-34d1306373e0","name":"30454a55-0210-43d2-af3d-822c5b519033:panel_30454a55-0210-43d2-af3d-822c5b519033","type":"visualization"},{"id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","name":"6ff4d4db-16b6-4c80-8bb6-95e009803d1d:panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MiwxXQ=="} +{"attributes":{"layout":"vertical","links":[{"destinationRefName":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","id":"f002a04e-05b9-4b0e-862a-b0737b0fcc7d","order":0,"type":"dashboardLink"},{"destinationRefName":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","id":"fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1","order":1,"type":"dashboardLink"},{"destinationRefName":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","id":"4a789d96-55a1-4d28-9e97-950bb150397f","order":2,"type":"dashboardLink"},{"destinationRefName":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","id":"1a2ef245-e023-4af9-8798-6a012ac5a9ac","order":3,"type":"dashboardLink"},{"destinationRefName":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","id":"bd24a361-4123-4d7a-82b6-a2c7c20414f2","order":4,"type":"dashboardLink"},{"destinationRefName":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","id":"49b455da-4a39-4c33-ac97-006a2a64c22e","order":5,"type":"dashboardLink"},{"destinationRefName":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","id":"585265f5-693a-4f0e-a824-d0e36ae2f821","order":6,"type":"dashboardLink"},{"destinationRefName":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","id":"706a6fd1-1a22-46dc-829a-960f1897b511","order":7,"type":"dashboardLink"},{"destinationRefName":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","id":"0dde1941-a105-4eb7-ade8-054e4465a9cb","order":8,"type":"dashboardLink"},{"destinationRefName":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","id":"5dc55829-39b3-439d-b18d-2327c4def786","order":9,"type":"dashboardLink"},{"destinationRefName":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","id":"ff056d48-316f-439e-94d6-95af7324ad81","order":10,"type":"dashboardLink"},{"destinationRefName":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","id":"a3da514f-4d57-473a-a3cd-8b5eb6793adf","order":11,"type":"dashboardLink"}],"title":"Logging Made Easy Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","managed":false,"references":[{"id":"baa4f981-0c75-43da-b96e-1107f171dfaa","name":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","type":"dashboard"},{"id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","name":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","type":"dashboard"},{"id":"e4d7b207-99aa-4410-8a2e-03487222bda1","name":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","type":"dashboard"},{"id":"fff78bfe-2758-4fa1-939f-362380fc607d","name":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","type":"dashboard"},{"id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","name":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","type":"dashboard"},{"id":"614a8392-17b5-49c4-9397-bc3cac526c61","name":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","type":"dashboard"},{"id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","name":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","type":"dashboard"},{"id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","name":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","type":"dashboard"},{"id":"beeeb066-d497-4b2a-99d3-44d741238bd1","name":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","type":"dashboard"},{"id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","name":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","type":"dashboard"},{"id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","name":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","type":"dashboard"},{"id":"2fc36188-8461-4927-932e-0e452b7dc3ac","name":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MywxXQ=="} +{"attributes":{"description":"Summarizes collected Sysmon event data","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Total number of Sysmon events found\",\"panelRefName\":\"panel_2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":13,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"title\":\"Percentage of Sysmon events by event code\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":18,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Count of Sysmon events by event code\",\"panelRefName\":\"panel_4\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":13,\"w\":24,\"h\":18,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"asc\"}}},\"enhancements\":{}},\"title\":\"Top 10 hosts generating the most Sysmon data\",\"panelRefName\":\"panel_5\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":39,\"w\":48,\"h\":21,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon event code reference\",\"panelRefName\":\"panel_7\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\"},\"panelIndex\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550\"}]","timeRestore":false,"title":"Sysmon Summary 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","managed":false,"references":[{"id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","name":"2:panel_2","type":"visualization"},{"id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","name":"3:panel_3","type":"visualization"},{"id":"90a5fcee-d3fb-4969-a336-869ab6808777","name":"4:panel_4","type":"visualization"},{"id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","name":"5:panel_5","type":"visualization"},{"id":"88efefcc-de0a-4a08-9a17-3d09423092e0","name":"7:panel_7","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"4fb34c82-2e7f-43cb-88ca-54b304bc2550:panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550","type":"links"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NCwxXQ=="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":123,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/elastic/user_hr_2_0.ndjson b/dashboards/elastic/user_hr_2_0.ndjson index 62ad3718..b044483a 100644 --- a/dashboards/elastic/user_hr_2_0.ndjson +++ b/dashboards/elastic/user_hr_2_0.ndjson @@ -1,14 +1,124 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T14:37:25.744Z","id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-23T14:37:25.744Z","version":"WzI0MDQsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T14:39:31.396Z","id":"72f39161-3f69-49a4-b39a-b0168b88856a","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T14:39:31.396Z","version":"WzI0MzMsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"72f39161-3f69-49a4-b39a-b0168b88856a","name":"control_0_index_pattern","type":"index-pattern"},{"id":"72f39161-3f69-49a4-b39a-b0168b88856a","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNjcsMV0="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T14:37:25.744Z","id":"252e4f32-a2c6-483d-a289-5d658410df17","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T14:37:25.744Z","version":"WzI0MTAsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"e3f24157-721c-4741-ac8f-8be48c22d612","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNjksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - User activity title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - User activity title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## All user activity\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNzAsMV0="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T14:37:25.744Z","id":"logs-*","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T14:37:25.744Z","version":"WzI0MTksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - Logon title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Logon title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Logon / Logoff events\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNzIsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"winlogbeat-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T14:39:31.396Z","id":"68a051a0-1d7f-11e9-9fc5-a91039822035","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T14:39:31.396Z","version":"WzI0MzEsMV0="} -{"attributes":{"columns":["winlog.event_data.SubjectDomainName","winlog.event_data.TargetUserName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"user.name":{"width":193},"winlog.event_data.SubjectDomainName":{"width":193}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4624\\\" and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_data.LogonType\",\"value\":[\"2\",\"10\",\"11\",\"7\"],\"params\":[\"2\",\"10\",\"11\",\"7\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_data.LogonType\":\"2\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"10\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"11\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"7\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Interactive Logon search","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNzQsMV0="} -{"attributes":{"columns":[],"description":"","grid":{"columns":{"winlog.event_data.TargetDomainName":{"width":241},"winlog.event_data.TargetUserName":{"width":241}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:\\\"4634\\\" OR event.code:\\\"4647\\\" ) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"68a051a0-1d7f-11e9-9fc5-a91039822035","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNzUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"HR - Interactive v Remote pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Interactive v Remote pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"label\":\"filters\",\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"segment\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_data.LogonType:2\",\"language\":\"lucene\"},\"label\":\"Interactive\"},{\"input\":{\"query\":\"winlog.event_data.LogonType:10\",\"language\":\"lucene\"},\"label\":\"RemoteInteractive\"}]}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNzYsMV0="} -{"attributes":{"description":"Overview of user activity for Human Resources\n","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"a6335da9-2093-46ac-bd39-f1c5e5fe8825\"},\"panelIndex\":\"a6335da9-2093-46ac-bd39-f1c5e5fe8825\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a6335da9-2093-46ac-bd39-f1c5e5fe8825\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":16,\"h\":12,\"i\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},\"panelIndex\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select domain(s) and username(s)\",\"panelRefName\":\"panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":3,\"w\":15,\"h\":12,\"i\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\"},\"panelIndex\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"252e4f32-a2c6-483d-a289-5d658410df17\",\"name\":\"indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"accessors\":[\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"splitAccessor\":\"fc23a029-309e-40a7-aeca-309fd8423ced\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\":{\"columns\":{\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\":{\"label\":\"Top 5 values of winlog.event_data.SubjectDomainName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.SubjectDomainName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"fc23a029-309e-40a7-aeca-309fd8423ced\":{\"label\":\"Top 3 values of winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5a238afa-9ffa-4568-8a43-6167c0a76b67\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"fc23a029-309e-40a7-aeca-309fd8423ced\",\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Users\"},{\"type\":\"lens\",\"gridData\":{\"x\":31,\"y\":3,\"w\":17,\"h\":12,\"i\":\"69771c75-8536-49b2-a835-c134ada8cd8d\"},\"panelIndex\":\"69771c75-8536-49b2-a835-c134ada8cd8d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"e3f24157-721c-4741-ac8f-8be48c22d612\",\"name\":\"indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"accessors\":[\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"position\":\"top\",\"seriesType\":\"bar\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"22b4e313-2858-411e-a90b-911198fa34fe\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\":{\"columns\":{\"22b4e313-2858-411e-a90b-911198fa34fe\":{\"label\":\"Top 5 values of winlog.computer_name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.computer_name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"22b4e313-2858-411e-a90b-911198fa34fe\",\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Computers\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":15,\"w\":48,\"h\":4,\"i\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\"},\"panelIndex\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_f2f654b0-42ef-403c-bee2-7e26499f809a\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":19,\"w\":24,\"h\":15,\"i\":\"4b306ffa-7af9-461d-b7aa-966f67b4ed57\"},\"panelIndex\":\"4b306ffa-7af9-461d-b7aa-966f67b4ed57\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-6bfbd839-8497-464d-a473-26c01d5ba342\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"6bfbd839-8497-464d-a473-26c01d5ba342\",\"accessors\":[],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6bfbd839-8497-464d-a473-26c01d5ba342\":{\"columns\":{\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}}},\"columnOrder\":[\"ded5443c-8b2d-4ea7-b640-b3a6a2212559\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"All User Events by Day of Week, Hour of Day\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":19,\"w\":24,\"h\":15,\"i\":\"e40e6077-f799-4c66-9bf8-1664121d8069\"},\"panelIndex\":\"e40e6077-f799-4c66-9bf8-1664121d8069\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f46d1729-4bd5-4219-9973-01913c208fef\",\"accessors\":[\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f46d1729-4bd5-4219-9973-01913c208fef\":{\"columns\":{\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"800c3857-3c9c-4fc5-a403-3fcbede05599\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\",\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Timestamps by Count\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":34,\"w\":48,\"h\":4,\"i\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},\"panelIndex\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":38,\"w\":24,\"h\":15,\"i\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},\"panelIndex\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logon events (filter by LogonId)\",\"panelRefName\":\"panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":38,\"w\":24,\"h\":15,\"i\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\"},\"panelIndex\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logoff events (correlate to logon events)\",\"panelRefName\":\"panel_bb42b25e-f934-485b-854c-440cc1b3ebee\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":53,\"w\":24,\"h\":15,\"i\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"},\"panelIndex\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"In person vs Remote logons\",\"panelRefName\":\"panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"}]","timeRestore":false,"title":"User HR 2.0","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:30:38.918Z","id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","managed":false,"references":[{"id":"12735ff0-9396-11ea-b41f-4dc1d87833fe","name":"a6335da9-2093-46ac-bd39-f1c5e5fe8825:panel_a6335da9-2093-46ac-bd39-f1c5e5fe8825","type":"visualization"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"ab726ae4-6c98-4f26-8cd3-07bf2808b704:panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704","type":"visualization"},{"id":"252e4f32-a2c6-483d-a289-5d658410df17","name":"c8d3e871-1f5d-40bd-a0f9-5441a58cad32:indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093","type":"index-pattern"},{"id":"e3f24157-721c-4741-ac8f-8be48c22d612","name":"69771c75-8536-49b2-a835-c134ada8cd8d:indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2","type":"index-pattern"},{"id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","name":"f2f654b0-42ef-403c-bee2-7e26499f809a:panel_f2f654b0-42ef-403c-bee2-7e26499f809a","type":"visualization"},{"id":"logs-*","name":"4b306ffa-7af9-461d-b7aa-966f67b4ed57:indexpattern-datasource-layer-6bfbd839-8497-464d-a473-26c01d5ba342","type":"index-pattern"},{"id":"logs-*","name":"e40e6077-f799-4c66-9bf8-1664121d8069:indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef","type":"index-pattern"},{"id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","name":"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e:panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e","type":"visualization"},{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"755f30aa-d6ad-46d9-b2c3-7425c02ed03e:panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e","type":"search"},{"id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","name":"bb42b25e-f934-485b-854c-440cc1b3ebee:panel_bb42b25e-f934-485b-854c-440cc1b3ebee","type":"search"},{"id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","name":"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f:panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f","type":"visualization"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-23T15:09:36.784Z","version":"WzI0ODYsMV0="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":13,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - MITRE Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - MITRE Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### MITRE ATT&CK Technique\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"63587a03-5f00-4678-b1fa-99b31a719c25","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OSwxXQ=="} +{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{\"event.action\":{\"count\":2},\"process.name\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.KeyFilePath\":{\"count\":2},\"file.path\":{\"count\":1},\"event.code\":{\"count\":1},\"event.provider\":{\"count\":1}}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:37.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"logs-*","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:37.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzEzNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"high\\\" or signal.rule.severity : \\\"critical\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Critical Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"133f677c-628d-4684-af5f-0c906e4101cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Mitre Technique Table2","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Mitre Technique Table2\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"MITRE ID\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.reference\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Reference\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":true,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1993dc60-efe8-46ec-952d-cc4d513cee72","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"medium\\\" or signal.rule.severity : \\\"low\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Suspicious Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Signals Overview","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signals Overview\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Suspicious Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","managed":false,"references":[{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Signal guage","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signal guage\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signal Gauge\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Signals Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Signals Overview\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Signals Data Table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Signals Data Table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":105,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Rule Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.tactic.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":500,\"otherBucket\":false,\"otherBucketLabel\":\"Uncatergorised\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Tactic\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.severity\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Severity\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":11,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Rule Name\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Uncatergorised\",\"otherBucketLabel\":\"Uncatergorised\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Tactic\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Severity\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Technique\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"Alerting - Signals Details","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Details\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signals Details \\n[View alerts dashboard](/app/security/alerts)\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Further Signals Info","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Further Signals Info\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":250,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\".\"},\"schema\":\"split\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"event.created\",\"timeRange\":{\"from\":\"now-24h\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30m\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No host data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Hostname\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No User Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"1\"},\"schema\":\"bucket\"},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column2\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"2\"},\"schema\":\"bucket\"},{\"id\":\"8\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column3\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"3\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":1,\"aggType\":\"date_histogram\",\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm\"}},\"label\":\"event.created per 30 minutes\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No host data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"Hostname\",\"params\":{}},{\"accessor\":3,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No User Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"User\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"1\",\"params\":{}},{\"accessor\":5,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"2\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"3\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}],\"splitRow\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\".\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"row\":true,\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Event Log Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Event Log Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Full Event Logs\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MCwxXQ=="} +{"attributes":{"color":"#e5e289","description":"Logging Made Easy Custom Dashboards","name":"Logging Made Easy"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"05484269-a438-43a1-8114-4f32479f51c4","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2MywxXQ=="} +{"attributes":{"description":"Alerting Overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":false,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":true}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":28,\"i\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},\"panelIndex\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":0,\"w\":10,\"h\":4,\"i\":\"02fa17ed-1419-415c-9a27-f90684d5645f\"},\"panelIndex\":\"02fa17ed-1419-415c-9a27-f90684d5645f\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Critical Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":0,\"w\":27,\"h\":5,\"i\":\"3832099d-1166-44f0-a766-270f65ae20c3\"},\"panelIndex\":\"3832099d-1166-44f0-a766-270f65ae20c3\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_3832099d-1166-44f0-a766-270f65ae20c3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":4,\"w\":10,\"h\":21,\"i\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\"},\"panelIndex\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"uiState\":{},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Critical Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"enhancements\":{},\"hidePanelTitles\":false,\"description\":\"This panel shows critical signals\"},\"title\":\"Signals Overview\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":5,\"w\":27,\"h\":17,\"i\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},\"panelIndex\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":28,\"w\":11,\"h\":4,\"i\":\"8459632e-bab5-491a-aad4-d40a09d9589e\"},\"panelIndex\":\"8459632e-bab5-491a-aad4-d40a09d9589e\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Suspicious Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":32,\"w\":11,\"h\":21,\"i\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\"},\"panelIndex\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_543e736d-1e0e-4096-a02d-a00b7a145ad8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":22,\"w\":27,\"h\":4,\"i\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\"},\"panelIndex\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_1688fd32-5aa8-4358-8587-d46f4e11613e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":26,\"w\":27,\"h\":25,\"i\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\"},\"panelIndex\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"gauge\",\"params\":{\"type\":\"gauge\",\"addTooltip\":true,\"addLegend\":true,\"isDisplayWarning\":false,\"gauge\":{\"alignment\":\"automatic\",\"extendRange\":true,\"percentageMode\":false,\"gaugeType\":\"Arc\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"Labels\",\"colorsRange\":[{\"from\":0,\"to\":50},{\"from\":50,\"to\":75},{\"from\":75,\"to\":100}],\"invertColors\":false,\"labels\":{\"show\":true,\"color\":\"black\"},\"scale\":{\"show\":true,\"labels\":false,\"color\":\"rgba(105,112,125,0.2)\"},\"type\":\"meter\",\"style\":{\"bgWidth\":0.9,\"width\":0.9,\"mask\":false,\"bgMask\":false,\"maskBars\":50,\"bgFill\":\"rgba(105,112,125,0.2)\",\"bgColor\":true,\"subText\":\"\",\"fontSize\":60}}},\"uiState\":{\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"}}},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{}}},\"hidePanelTitles\":false,\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"},\"legendOpen\":false}},\"title\":\"Alert Gauge\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":53,\"w\":21,\"h\":5,\"i\":\"93136da7-3849-4932-92f2-a443350636f2\"},\"panelIndex\":\"93136da7-3849-4932-92f2-a443350636f2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_93136da7-3849-4932-92f2-a443350636f2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":58,\"w\":21,\"h\":17,\"i\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\"},\"panelIndex\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_aa385ced-e59f-4096-8b49-ad0014c0087c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":75,\"w\":48,\"h\":8,\"i\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},\"panelIndex\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":83,\"w\":48,\"h\":21,\"i\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\"},\"panelIndex\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"asc\"}}},\"enhancements\":{}},\"panelRefName\":\"panel_a7f758eb-65c6-4202-86a3-b8b4a169845c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":104,\"w\":48,\"h\":6,\"i\":\"25f49696-70e2-472e-9992-287665c7db7d\"},\"panelIndex\":\"25f49696-70e2-472e-9992-287665c7db7d\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_25f49696-70e2-472e-9992-287665c7db7d\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":110,\"w\":48,\"h\":28,\"i\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\"},\"panelIndex\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"panelRefName\":\"panel_38cb573e-5533-48f8-874d-5cfd5929d68a\"}]","refreshInterval":{"pause":true,"value":0},"timeFrom":"now-7d/d","timeRestore":true,"timeTo":"now","title":"Alerting Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"baa4f981-0c75-43da-b96e-1107f171dfaa","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0:panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0","type":"links"},{"id":"63587a03-5f00-4678-b1fa-99b31a719c25","name":"3832099d-1166-44f0-a766-270f65ae20c3:panel_3832099d-1166-44f0-a766-270f65ae20c3","type":"visualization"},{"id":"133f677c-628d-4684-af5f-0c906e4101cb","name":"33d73051-f4d8-4ca0-826c-3d7060fa75da:search_0","type":"search"},{"id":"1993dc60-efe8-46ec-952d-cc4d513cee72","name":"2ab0a53c-c5c7-4116-afff-e0d119aeefa9:panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9","type":"visualization"},{"id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","name":"543e736d-1e0e-4096-a02d-a00b7a145ad8:panel_543e736d-1e0e-4096-a02d-a00b7a145ad8","type":"visualization"},{"id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","name":"1688fd32-5aa8-4358-8587-d46f4e11613e:panel_1688fd32-5aa8-4358-8587-d46f4e11613e","type":"visualization"},{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"739bc01e-ec0f-4565-92e3-1af95510fc60:search_0","type":"search"},{"id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","name":"93136da7-3849-4932-92f2-a443350636f2:panel_93136da7-3849-4932-92f2-a443350636f2","type":"visualization"},{"id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","name":"aa385ced-e59f-4096-8b49-ad0014c0087c:panel_aa385ced-e59f-4096-8b49-ad0014c0087c","type":"visualization"},{"id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","name":"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b:panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b","type":"visualization"},{"id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","name":"a7f758eb-65c6-4202-86a3-b8b4a169845c:panel_a7f758eb-65c6-4202-86a3-b8b4a169845c","type":"visualization"},{"id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","name":"25f49696-70e2-472e-9992-287665c7db7d:panel_25f49696-70e2-472e-9992-287665c7db7d","type":"visualization"},{"id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","name":"38cb573e-5533-48f8-874d-5cfd5929d68a:panel_38cb573e-5533-48f8-874d-5cfd5929d68a","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_host_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_chc_host_count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_filter_hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_filter_hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Events\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"Host name\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ae4d4888-b29b-459a-a369-ece810d70325","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"title_chc_software","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"title_chc_software\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Software\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"65c534a3-beee-4140-83ef-d511662e9ffa","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.param1","winlog.event_data.param11","winlog.event_data.param12","winlog.provider_name"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1000 or event.code:1002\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_proc_crash","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6c264739-59d8-4fd3-af36-27332178d08f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_proc_crashes","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_proc_crashes\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"0ms\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{},\"customLabel\":\"Date\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"interpolate\":\"linear\",\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_chc_crash_table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_crash_table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user_data.param1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Application\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"winlog.event_data.param1: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3cf72536-3546-4c88-9b4b-46cede29474f","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SourceImage","winlog.event_data.TargetImage"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:8 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_chc_create_remote_thread","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OCwxXQ=="} +{"attributes":{"description":"Shows software running on hosts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":21,\"i\":\"23406828-78ea-414f-b7eb-b1c76db1a992\"},\"panelIndex\":\"23406828-78ea-414f-b7eb-b1c76db1a992\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_23406828-78ea-414f-b7eb-b1c76db1a992\"},{\"type\":\"visualization\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":21,\"i\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\"},\"panelIndex\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Host Count\",\"panelRefName\":\"panel_67acd3d3-1fe1-4027-8e0d-17369b15986f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":21,\"i\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\"},\"panelIndex\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Filter Hosts\",\"panelRefName\":\"panel_bde0ab63-0219-412e-90b3-029fc58aa2df\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":4,\"i\":\"974eebf8-3870-403f-b4b8-0151e57408e1\"},\"panelIndex\":\"974eebf8-3870-403f-b4b8-0151e57408e1\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":true},\"panelRefName\":\"panel_974eebf8-3870-403f-b4b8-0151e57408e1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":25,\"w\":24,\"h\":15,\"i\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},\"panelIndex\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging\",\"panelRefName\":\"panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":25,\"w\":24,\"h\":15,\"i\":\"06f203bf-d632-4f1a-b024-67ec7373873b\"},\"panelIndex\":\"06f203bf-d632-4f1a-b024-67ec7373873b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging Count\",\"panelRefName\":\"panel_06f203bf-d632-4f1a-b024-67ec7373873b\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":56,\"w\":48,\"h\":15,\"i\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},\"panelIndex\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"CreateRemoteThread events\",\"panelRefName\":\"panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":16,\"i\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\"},\"panelIndex\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273\"}],\"state\":{\"visualization\":{\"layerId\":\"f9c66ef1-e443-4a34-950c-5c9556714273\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"isTransposed\":false,\"isMetric\":false},{\"isTransposed\":false,\"columnId\":\"1b266c97-5508-45bb-bb55-40f392f3de3c\"},{\"isTransposed\":false,\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"}]},\"query\":{\"query\":\"event.code: \\\"1\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f9c66ef1-e443-4a34-950c-5c9556714273\":{\"columns\":{\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":100,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1b266c97-5508-45bb-bb55-40f392f3de3c\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"1b266c97-5508-45bb-bb55-40f392f3de3c\",\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"],\"sampling\":1,\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Processes\"}]","timeRestore":false,"title":"Computer Software Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"23406828-78ea-414f-b7eb-b1c76db1a992:panel_23406828-78ea-414f-b7eb-b1c76db1a992","type":"links"},{"id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","name":"67acd3d3-1fe1-4027-8e0d-17369b15986f:panel_67acd3d3-1fe1-4027-8e0d-17369b15986f","type":"visualization"},{"id":"ae4d4888-b29b-459a-a369-ece810d70325","name":"bde0ab63-0219-412e-90b3-029fc58aa2df:panel_bde0ab63-0219-412e-90b3-029fc58aa2df","type":"visualization"},{"id":"65c534a3-beee-4140-83ef-d511662e9ffa","name":"974eebf8-3870-403f-b4b8-0151e57408e1:panel_974eebf8-3870-403f-b4b8-0151e57408e1","type":"visualization"},{"id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","name":"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f:panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f","type":"visualization"},{"id":"3cf72536-3546-4c88-9b4b-46cede29474f","name":"06f203bf-d632-4f1a-b024-67ec7373873b:panel_06f203bf-d632-4f1a-b024-67ec7373873b","type":"visualization"},{"id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","name":"9f671b0e-5ffb-46b6-af00-9dbc4d241121:panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121","type":"search"},{"id":"logs-*","name":"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f:indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1bb35497-6257-4b29-95fa-579306bda91a\"},\"panelIndex\":\"1bb35497-6257-4b29-95fa-579306bda91a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1bb35497-6257-4b29-95fa-579306bda91a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\"},\"panelIndex\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\",\"embeddableConfig\":{\"enhancements\":{},\"attributes\":{\"title\":\"Audit logons\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b\"}],\"state\":{\"visualization\":{\"layers\":[{\"categoryDisplay\":\"default\",\"layerId\":\"9da2d10b-4d81-4f9b-abbc-d950139a209b\",\"layerType\":\"data\",\"legendDisplay\":\"default\",\"metrics\":[\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"nestedLegend\":false,\"numberDisplay\":\"percent\",\"primaryGroups\":[\"2609b197-b493-4da4-9526-21b71512702a\"]}],\"shape\":\"donut\"},\"query\":{\"language\":\"kuery\",\"query\":\"4624\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9da2d10b-4d81-4f9b-abbc-d950139a209b\":{\"columnOrder\":[\"2609b197-b493-4da4-9526-21b71512702a\",\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"columns\":{\"2609b197-b493-4da4-9526-21b71512702a\":{\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"Top 5 values of host.name\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"ca9653b4-9247-4c13-98e0-beeb95821de0\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"host.name\"},\"ca9653b4-9247-4c13-98e0-beeb95821de0\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"}},\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":15,\"i\":\"6c884475-eba9-42bb-bcb7-145a5be31420\"},\"panelIndex\":\"6c884475-eba9-42bb-bcb7-145a5be31420\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos ticket - Failed attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"a40bb6e7-f754-425d-92c6-f94e9601af3c\",\"seriesType\":\"line\",\"xAccessor\":\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"splitAccessor\":\"fa882916-213f-40d3-b79e-216a43c16a72\",\"accessors\":[\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4769\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a40bb6e7-f754-425d-92c6-f94e9601af3c\":{\"columns\":{\"fa882916-213f-40d3-b79e-216a43c16a72\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"cb6cedeb-8521-4443-8bbc-c372817d75d7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fa882916-213f-40d3-b79e-216a43c16a72\",\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":15,\"w\":24,\"h\":7,\"i\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\"},\"panelIndex\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Account lockout -attempts\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1\"}],\"state\":{\"visualization\":{\"layerId\":\"42d33e36-7a47-4658-9792-5eff5f4918d1\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"ee31adc4-0bbd-40e0-86de-df6578c560b9\"},{\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4625\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"42d33e36-7a47-4658-9792-5eff5f4918d1\":{\"columns\":{\"ee31adc4-0bbd-40e0-86de-df6578c560b9\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ee31adc4-0bbd-40e0-86de-df6578c560b9\",\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":7,\"i\":\"17865857-b6e0-4e72-bf28-44b64f154df7\"},\"panelIndex\":\"17865857-b6e0-4e72-bf28-44b64f154df7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Special logon-attempts\",\"description\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707\"}],\"state\":{\"visualization\":{\"layerId\":\"67cdda05-ae7c-41b9-8a85-1e49828e9707\",\"layerType\":\"data\",\"metricAccessor\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\",\"breakdownByAccessor\":\"83a5ad17-791e-4869-bbb3-1a7465716837\"},\"query\":{\"language\":\"kuery\",\"query\":\"4672\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67cdda05-ae7c-41b9-8a85-1e49828e9707\":{\"columns\":{\"83a5ad17-791e-4869-bbb3-1a7465716837\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"83a5ad17-791e-4869-bbb3-1a7465716837\",\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":22,\"w\":24,\"h\":12,\"i\":\"face26df-a171-4753-8cda-79dea7b83ab6\"},\"panelIndex\":\"face26df-a171-4753-8cda-79dea7b83ab6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos auth request\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"d29fda24-60a4-4ddd-bf19-67175ef85af2\",\"primaryGroups\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\"],\"metrics\":[\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"default\",\"legendDisplay\":\"default\",\"nestedLegend\":false,\"layerType\":\"data\"}]},\"query\":{\"query\":\"4768\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d29fda24-60a4-4ddd-bf19-67175ef85af2\":{\"columns\":{\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a20bff59-6317-4758-ab4f-0bec099cd004\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"a20bff59-6317-4758-ab4f-0bec099cd004\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\",\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":24,\"h\":12,\"i\":\"29494e18-b33e-457b-9a07-664463eaf1e6\"},\"panelIndex\":\"29494e18-b33e-457b-9a07-664463eaf1e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Other logon /logoff-Disconnection attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"splitAccessor\":\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"accessors\":[\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4779\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\":{\"columns\":{\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":34,\"w\":24,\"h\":15,\"i\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\"},\"panelIndex\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Credential validation- attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"79c23cfd-619e-4bc7-bbca-d2564165f04b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"splitAccessor\":\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"accessors\":[\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4776\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"79c23cfd-619e-4bc7-bbca-d2564165f04b\":{\"columns\":{\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c4de01ed-8a99-4230-9cc5-6889447a60b6\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":24,\"h\":15,\"i\":\"b819c130-6164-41e4-8188-984964e44e39\"},\"panelIndex\":\"b819c130-6164-41e4-8188-984964e44e39\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon attempts by hosts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_horizontal_stacked\",\"layers\":[{\"layerId\":\"d8138ff4-5996-4544-9b28-98739cc15747\",\"seriesType\":\"bar_horizontal_stacked\",\"xAccessor\":\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"accessors\":[\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4624\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d8138ff4-5996-4544-9b28-98739cc15747\":{\"columns\":{\"d0dd77ee-78c7-457b-ad0d-ebe327215549\":{\"label\":\" host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":55,\"w\":24,\"h\":15,\"i\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\"},\"panelIndex\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon-using explicit credential attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"accessors\":[\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\",\"color\":\"#6092c0\"}]}]},\"query\":{\"query\":\"4648\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\":{\"columns\":{\"c19cba52-bfca-46e4-9ff9-e46579e4d378\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"},\"orderDirection\":\"asc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}}]","timeRestore":false,"title":"Credential Access logs Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e4d7b207-99aa-4410-8a2e-03487222bda1","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1bb35497-6257-4b29-95fa-579306bda91a:panel_1bb35497-6257-4b29-95fa-579306bda91a","type":"links"},{"id":"logs-*","name":"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2:indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b","type":"index-pattern"},{"id":"logs-*","name":"6c884475-eba9-42bb-bcb7-145a5be31420:indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c","type":"index-pattern"},{"id":"logs-*","name":"62e638ae-d23f-47dd-834b-bdcb2902f527:indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1","type":"index-pattern"},{"id":"logs-*","name":"17865857-b6e0-4e72-bf28-44b64f154df7:indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707","type":"index-pattern"},{"id":"logs-*","name":"face26df-a171-4753-8cda-79dea7b83ab6:indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2","type":"index-pattern"},{"id":"logs-*","name":"29494e18-b33e-457b-9a07-664463eaf1e6:indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317","type":"index-pattern"},{"id":"logs-*","name":"f2c86900-93cc-4480-bd84-f63f0cb0ac79:indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b","type":"index-pattern"},{"id":"logs-*","name":"b819c130-6164-41e4-8188-984964e44e39:indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747","type":"index-pattern"},{"id":"logs-*","name":"0d81bae9-3b04-4344-98f0-49202a2258ce:indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alpha - Health Check - Total Hosts - Metric","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alpha - Health Check - Total Hosts - Metric\",\"type\":\"metric\",\"aggs\":[{\"id\":\"3\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Total Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f0e888d4-b9e1-402f-8481-4195773d8a82","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Events by machine","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Events by machine\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Number of events seen\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"segment\"}],\"params\":{\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"62711d6d-17f8-4c2d-aa37-b11717455e53","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Users seen","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Users seen\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"winlog.user.name\",\"customLabel\":\"Users seen (total)\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8c34636f-01f4-4b46-b519-3120e5fe1731","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Unexpected Power Off","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Unexpected shutdowns","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Unexpected shutdowns\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":50,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","managed":false,"references":[{"id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNSwxXQ=="} +{"attributes":{"description":"Health Check overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},\"panelIndex\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":11,\"i\":\"ba924baf-3793-418e-a1de-ff805560f85b\"},\"panelIndex\":\"ba924baf-3793-418e-a1de-ff805560f85b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Total Hosts\",\"panelRefName\":\"panel_ba924baf-3793-418e-a1de-ff805560f85b\"},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":12,\"h\":21,\"i\":\"2b349db3-6677-43de-99ff-111253bee020\"},\"panelIndex\":\"2b349db3-6677-43de-99ff-111253bee020\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Alpha - Health Check - Number of Admins - Metric (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\",\"shouldTruncate\":true,\"maxLines\":5,\"legendStats\":[\"currentAndLastValue\"]},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"bf39875d-159e-4950-8c3d-803a61d82313\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"accessors\":[\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"winlog.event_id:1 and winlog.event_data.IntegrityLevel : \\\"High\\\" and not \\\"NT VIRTUAL MACHINE\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"1aab2c4b-51a1-4b7a-8173-1d0c9fb242a5\",\"key\":\"winlog.user.name\",\"field\":\"winlog.user.name\",\"type\":\"exists\"},\"query\":{\"exists\":{\"field\":\"winlog.user.name\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bf39875d-159e-4950-8c3d-803a61d82313\":{\"columns\":{\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"cf94e195-c66f-4040-9aee-44a0c719091a\":{\"label\":\"Unique Count of Admin Users\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}}},\"customLabel\":true}},\"columnOrder\":[\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Number of Admins\"},{\"type\":\"visualization\",\"gridData\":{\"x\":28,\"y\":0,\"w\":17,\"h\":21,\"i\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},\"panelIndex\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":8,\"h\":10,\"i\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},\"panelIndex\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":45,\"h\":12,\"i\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"},\"panelIndex\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"panelRefName\":\"panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"}]","timeRestore":false,"title":"HealthCheck Dashboard - Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fff78bfe-2758-4fa1-939f-362380fc607d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a:panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a","type":"links"},{"id":"f0e888d4-b9e1-402f-8481-4195773d8a82","name":"ba924baf-3793-418e-a1de-ff805560f85b:panel_ba924baf-3793-418e-a1de-ff805560f85b","type":"visualization"},{"id":"logs-*","name":"2b349db3-6677-43de-99ff-111253bee020:indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313","type":"index-pattern"},{"id":"62711d6d-17f8-4c2d-aa37-b11717455e53","name":"9479b8b7-fd3b-4160-8d3a-d7e4685c5819:panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819","type":"visualization"},{"id":"8c34636f-01f4-4b46-b519-3120e5fe1731","name":"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118:panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118","type":"visualization"},{"id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","name":"c4bcdc99-aaf7-4555-8ed0-d99f701396f2:panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"password_resets_and_changes logs","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"user_lockouts","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:1502\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_default_domain_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},\"panelIndex\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":28,\"h\":21,\"i\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\"},\"panelIndex\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\",\"accessors\":[\"40ece351-d270-400e-8da5-c469d428770f\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\"}]},\"query\":{\"query\":\"winlog.event_id:4657\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\":{\"columns\":{\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"40ece351-d270-400e-8da5-c469d428770f\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\",\"40ece351-d270-400e-8da5-c469d428770f\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Registry Object Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":36,\"y\":0,\"w\":12,\"h\":21,\"i\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\"},\"panelIndex\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df\"}],\"state\":{\"visualization\":{\"layerId\":\"8d620430-5405-4088-949e-1c7c369784df\",\"accessor\":\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4698\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8d620430-5405-4088-949e-1c7c369784df\":{\"columns\":{\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\":{\"label\":\"New Scheduled Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"winlog.event_id\",\"params\":{\"emptyAsNull\":false},\"customLabel\":true}},\"columnOrder\":[\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"New Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"c4767fa6-123a-4f2c-958f-504253babada\"},\"panelIndex\":\"c4767fa6-123a-4f2c-958f-504253babada\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Password Resets and Changes Logs\",\"panelRefName\":\"panel_c4767fa6-123a-4f2c-958f-504253babada\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\"},\"panelIndex\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2\"}],\"state\":{\"visualization\":{\"layerId\":\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\",\"accessor\":\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4702\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\":{\"columns\":{\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\":{\"label\":\"Updated Scheduler Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Updated Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":36,\"w\":24,\"h\":15,\"i\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},\"panelIndex\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"User Lockouts\",\"panelRefName\":\"panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":36,\"w\":24,\"h\":15,\"i\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\"},\"panelIndex\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\",\"accessors\":[\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"baf404fd-0f09-4df0-a861-2f15b539ca51\"}]},\"query\":{\"query\":\"winlog.event_id:4724 or winlog.event_id:4723\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\":{\"columns\":{\"baf404fd-0f09-4df0-a861-2f15b539ca51\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"51979016-6414-4ce0-aa1e-bb07e33110c0\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"baf404fd-0f09-4df0-a861-2f15b539ca51\",\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Resets and Changes\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":51,\"w\":24,\"h\":15,\"i\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\"},\"panelIndex\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\",\"accessors\":[\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"8e283438-d965-48a0-b803-cea59d83d093\"}]},\"query\":{\"query\":\"winlog.event_id:4782\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\":{\"columns\":{\"8e283438-d965-48a0-b803-cea59d83d093\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"96f3ed8f-397d-4947-ab3c-789a15fb329c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"8e283438-d965-48a0-b803-cea59d83d093\",\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Hash Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":51,\"w\":24,\"h\":15,\"i\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\"},\"panelIndex\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\",\"accessors\":[\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\"}]},\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\":{\"columns\":{\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\",\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"User Lockouts\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":66,\"w\":24,\"h\":15,\"i\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\"},\"panelIndex\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Changes to Default Domain Policy\",\"panelRefName\":\"panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9\"}]","timeRestore":false,"title":"Identity Access Management 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1fafa69c-12b3-49eb-b4dc-cd14591eb597:panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597","type":"links"},{"id":"logs-*","name":"68d682d0-f9a5-44c1-a0a0-9f731f970cd0:indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c","type":"index-pattern"},{"id":"logs-*","name":"d5d99e08-12e4-4f56-8a89-9b9e52b6a007:indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df","type":"index-pattern"},{"id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","name":"c4767fa6-123a-4f2c-958f-504253babada:panel_c4767fa6-123a-4f2c-958f-504253babada","type":"search"},{"id":"logs-*","name":"15b71263-a739-41f2-bc7c-38a5586aec9d:indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2","type":"index-pattern"},{"id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","name":"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81:panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81","type":"search"},{"id":"logs-*","name":"35f07da3-7a63-455b-b393-adf2032d5a7a:indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd","type":"index-pattern"},{"id":"logs-*","name":"ce9cad31-6b06-472c-b249-d0ad1efcb5cf:indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf","type":"index-pattern"},{"id":"logs-*","name":"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72:indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c","type":"index-pattern"},{"id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","name":"ac85c23f-b911-474e-b45e-cbbf1456c9a9:panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:\\\"4946\\\" or winlog.event_id:\\\"4947\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"new_or_modified_exception_list_rules","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4950\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_settings","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4954\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7b4c9843-87d7-42b9-935e-ff4713840de3","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5024 or winlog.event_id:5033\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned on","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5025 or winlog.event_id:5034\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned off","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"53b18c74-3370-4237-a524-90fd7489bf47","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4719\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_audit_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"26bac78a-07ef-4925-9473-4e2f60e5c151","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4713\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_kerberos","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},\"panelIndex\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":14,\"h\":21,\"i\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\"},\"panelIndex\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f\"}],\"state\":{\"visualization\":{\"layerId\":\"b64767f2-cf92-4fc3-b001-8e256e39314f\",\"accessor\":\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b64767f2-cf92-4fc3-b001-8e256e39314f\":{\"columns\":{\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\":{\"label\":\"RPC Connection Attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":2}}},\"customLabel\":true}},\"columnOrder\":[\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"RPC Connection Attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":14,\"h\":21,\"i\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\"},\"panelIndex\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee\"}],\"state\":{\"visualization\":{\"layerId\":\"44404bd2-1430-4712-9667-3fa30aed28ee\",\"accessor\":\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4946 or winlog.event_id:4947\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"44404bd2-1430-4712-9667-3fa30aed28ee\":{\"columns\":{\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\":{\"label\":\"Added or Updated Rules to Firewall Exception List\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":14,\"i\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\"},\"panelIndex\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"357c66cc-ad43-42ef-807c-5911c93ab357\",\"accessors\":[\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\"}]},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"357c66cc-ad43-42ef-807c-5911c93ab357\":{\"columns\":{\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"ecc638ab-21e8-4123-a662-cf612107dedd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\",\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"RPC Connections\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":15,\"i\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},\"panelIndex\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\",\"panelRefName\":\"panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":50,\"w\":24,\"h\":15,\"i\":\"955799aa-0778-4034-9624-2d258c7ee7d5\"},\"panelIndex\":\"955799aa-0778-4034-9624-2d258c7ee7d5\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Setting Changes\",\"panelRefName\":\"panel_955799aa-0778-4034-9624-2d258c7ee7d5\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":50,\"w\":24,\"h\":15,\"i\":\"73173146-a695-4da9-8760-f327c3d39b5f\"},\"panelIndex\":\"73173146-a695-4da9-8760-f327c3d39b5f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Policy Changes\",\"panelRefName\":\"panel_73173146-a695-4da9-8760-f327c3d39b5f\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":65,\"w\":24,\"h\":15,\"i\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},\"panelIndex\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned On\",\"panelRefName\":\"panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":65,\"w\":24,\"h\":15,\"i\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},\"panelIndex\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned Off\",\"panelRefName\":\"panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":80,\"w\":24,\"h\":15,\"i\":\"8ee424e6-e3df-4389-838c-4923da9036f6\"},\"panelIndex\":\"8ee424e6-e3df-4389-838c-4923da9036f6\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Audit Policy Changes\",\"panelRefName\":\"panel_8ee424e6-e3df-4389-838c-4923da9036f6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":80,\"w\":24,\"h\":15,\"i\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},\"panelIndex\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Kerberos Policy Changes\",\"panelRefName\":\"panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":95,\"w\":24,\"h\":15,\"i\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\"},\"panelIndex\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\",\"accessors\":[\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"c970c28f-4b0f-4560-be20-691ef6ff7722\"}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\":{\"columns\":{\"c970c28f-4b0f-4560-be20-691ef6ff7722\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c85c4fcc-e896-4607-bf76-4531ea13358e\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"c970c28f-4b0f-4560-be20-691ef6ff7722\",\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Start Up\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":95,\"w\":24,\"h\":15,\"i\":\"cde6896d-e694-4467-915c-a40f8a96e072\"},\"panelIndex\":\"cde6896d-e694-4467-915c-a40f8a96e072\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"646160c2-9253-4e43-b062-e99092afccb2\",\"accessors\":[\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"bc53a3ce-785a-48be-b77c-4f54950fd843\"}]},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"646160c2-9253-4e43-b062-e99092afccb2\":{\"columns\":{\"bc53a3ce-785a-48be-b77c-4f54950fd843\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18118859-447e-4ddc-aab9-7a6193e562f1\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc53a3ce-785a-48be-b77c-4f54950fd843\",\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shut Down\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":110,\"w\":24,\"h\":15,\"i\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\"},\"panelIndex\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c\"}],\"state\":{\"visualization\":{\"layerId\":\"b14413de-d521-4fae-9803-61bb7bb0481c\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\",\"isTransposed\":false},{\"columnId\":\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"isTransposed\":false}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b14413de-d521-4fae-9803-61bb7bb0481c\":{\"columns\":{\"26c59d98-b16d-4231-b7f0-9cf5738531ab\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"43a09ae6-c67c-41ab-a028-590677c0fbb0\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Startups\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":110,\"w\":24,\"h\":15,\"i\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\"},\"panelIndex\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"isTransposed\":false},{\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\",\"isTransposed\":false}],\"layerId\":\"a4076119-449b-4671-b641-1576ea6b1a4d\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a4076119-449b-4671-b641-1576ea6b1a4d\":{\"columns\":{\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"310e557f-37b5-406a-85e6-7eabac7c522b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"310e557f-37b5-406a-85e6-7eabac7c522b\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shutdowns\"}]","timeRestore":false,"title":"Policy Changes and System Activity 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"614a8392-17b5-49c4-9397-bc3cac526c61","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a:panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a","type":"links"},{"id":"logs-*","name":"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd:indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f","type":"index-pattern"},{"id":"logs-*","name":"638a3409-963c-41bf-b44c-5c84631ed0d5:indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee","type":"index-pattern"},{"id":"logs-*","name":"0c81b645-b5a7-4c63-a4df-34be3cd2bad3:indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357","type":"index-pattern"},{"id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","name":"ec3a6d47-cc36-440f-ad19-1482eb9f5b68:panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68","type":"search"},{"id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","name":"955799aa-0778-4034-9624-2d258c7ee7d5:panel_955799aa-0778-4034-9624-2d258c7ee7d5","type":"search"},{"id":"7b4c9843-87d7-42b9-935e-ff4713840de3","name":"73173146-a695-4da9-8760-f327c3d39b5f:panel_73173146-a695-4da9-8760-f327c3d39b5f","type":"search"},{"id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","name":"59995b8c-7f7f-4d12-998f-ae94ef27ed89:panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89","type":"search"},{"id":"53b18c74-3370-4237-a524-90fd7489bf47","name":"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8:panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8","type":"search"},{"id":"26bac78a-07ef-4925-9473-4e2f60e5c151","name":"8ee424e6-e3df-4389-838c-4923da9036f6:panel_8ee424e6-e3df-4389-838c-4923da9036f6","type":"search"},{"id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","name":"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e:panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e","type":"search"},{"id":"logs-*","name":"39bc0b92-1ba5-46a6-a527-094f749c86cf:indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb","type":"index-pattern"},{"id":"logs-*","name":"cde6896d-e694-4467-915c-a40f8a96e072:indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2","type":"index-pattern"},{"id":"logs-*","name":"95d5d91c-454a-477b-a2a2-c12df98091ab:indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c","type":"index-pattern"},{"id":"logs-*","name":"6f9bce5a-19c2-4f12-ba21-6066488a01c3:indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOCwxXQ=="} +{"attributes":{"columns":[],"description":"This dashboard will audit, privileged use and detailed tracking processes. ","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"refreshInterval":{"pause":true,"value":5000},"sort":[["@timestamp","desc"]],"timeRange":{"from":"now-30d/d","to":"now"},"timeRestore":true,"title":"Privileged Activity dashboard ","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":6,\"h\":25,\"i\":\"8048e972-d666-4403-ba50-805ec6552a2e\"},\"panelIndex\":\"8048e972-d666-4403-ba50-805ec6552a2e\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8048e972-d666-4403-ba50-805ec6552a2e\"},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":0,\"w\":21,\"h\":13,\"i\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\"},\"panelIndex\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"f8e3a2b3-9937-415f-b405-27363667b11e\",\"seriesType\":\"line\",\"xAccessor\":\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"accessors\":[\"ed03924f-84eb-434a-834b-1f074954b815\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4688\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f8e3a2b3-9937-415f-b405-27363667b11e\":{\"columns\":{\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"ed03924f-84eb-434a-834b-1f074954b815\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"ed03924f-84eb-434a-834b-1f074954b815\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"ed03924f-84eb-434a-834b-1f074954b815\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":0,\"w\":19,\"h\":13,\"i\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\"},\"panelIndex\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process termination\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873\"},{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"splitAccessor\":\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"accessors\":[\"8580666f-56c1-4af5-80fd-6178148354be\"],\"layerType\":\"data\"},{\"layerId\":\"3293242f-292b-4b40-9a26-d77cf1ae570c\",\"layerType\":\"data\",\"accessors\":[],\"seriesType\":\"bar_stacked\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4689\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\":{\"columns\":{\"57566510-cf0e-4e35-b01d-8b5821f389fc\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8580666f-56c1-4af5-80fd-6178148354be\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"e3910605-fe72-4ac8-9250-49d64f1cba7b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"8580666f-56c1-4af5-80fd-6178148354be\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"8580666f-56c1-4af5-80fd-6178148354be\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"},\"3293242f-292b-4b40-9a26-d77cf1ae570c\":{\"linkToLayers\":[],\"columns\":{},\"columnOrder\":[],\"sampling\":1,\"ignoreGlobalFilters\":false,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":13,\"w\":21,\"h\":12,\"i\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\"},\"panelIndex\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Audit Sensitive privilege Use\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"layers\":[{\"accessors\":[\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"layerId\":\"unifiedHistogram\",\"layerType\":\"data\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"date_column\"}],\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"preferredSeriesType\":\"bar_stacked\",\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\"},\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"date_column\",\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"columns\":{\"1ec9d305-2ddb-4c55-99db-549c767142a1\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"date_column\":{\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Privilege service attempts \"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":13,\"w\":19,\"h\":12,\"i\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\"},\"panelIndex\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Token assigned to process\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882\"}],\"state\":{\"visualization\":{\"layerId\":\"9ab8eb11-2529-4e5e-a153-834e29cc7882\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"aa267d47-4c05-4d62-9e91-523fd042b1d0\"},{\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"}]},\"query\":{\"query\":\"4696\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9ab8eb11-2529-4e5e-a153-834e29cc7882\":{\"columns\":{\"aa267d47-4c05-4d62-9e91-523fd042b1d0\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"feeda031-4d04-4512-bb90-f78038ef4666\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"aa267d47-4c05-4d62-9e91-523fd042b1d0\",\"feeda031-4d04-4512-bb90-f78038ef4666\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Assigned Token \"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":25,\"w\":27,\"h\":13,\"i\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\"},\"panelIndex\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Non-sensitive privilege event\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\"}],\"state\":{\"visualization\":{\"layerId\":\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\",\"accessor\":\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":2714.66},{\"color\":\"#d6bf57\",\"stop\":5429.33},{\"color\":\"#cc5642\",\"stop\":8144}],\"continuity\":\"above\",\"maxSteps\":5,\"colorStops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":2714.66},{\"color\":\"#cc5642\",\"stop\":5429.33}]}},\"textAlign\":\"center\",\"titlePosition\":\"bottom\",\"size\":\"l\"},\"query\":{\"query\":\"4674\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\":{\"columns\":{\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Non-sensitive privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":25,\"w\":19,\"h\":13,\"i\":\"f3f34099-a467-4343-9985-2b1fb741c78f\"},\"panelIndex\":\"f3f34099-a467-4343-9985-2b1fb741c78f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Edit visualization\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"layerId\":\"unifiedHistogram\",\"accessor\":\"count_column\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"type\":\"palette\",\"name\":\"status\",\"params\":{\"name\":\"status\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":1048.5,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":466},{\"color\":\"#cc5642\",\"stop\":932}],\"steps\":3,\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"l\",\"titlePosition\":\"bottom\"},\"query\":{\"language\":\"kuery\",\"query\":\"4674\"},\"filters\":[{\"meta\":{\"index\":\"c1678fe0-175c-4aa3-abcc-ee8260800574\",\"type\":\"exists\",\"key\":\"@timestamp\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"@timestamp\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"count_column\"],\"columns\":{\"count_column\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"@timestamp\",\"isBucketed\":false,\"params\":{\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}},\"emptyAsNull\":true},\"customLabel\":true}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Sensitive Privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":38,\"w\":27,\"h\":13,\"i\":\"7423841b-4470-4aee-ad93-a1a558c54d80\"},\"panelIndex\":\"7423841b-4470-4aee-ad93-a1a558c54d80\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"curveType\":\"LINEAR\",\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":false,\"yLeft\":false,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":-90},\"layers\":[{\"accessors\":[\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"isHistogram\":true,\"layerId\":\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\",\"layerType\":\"data\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"seriesType\":\"bar_stacked\",\"simpleView\":false,\"splitAccessor\":\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"xAccessor\":\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"xScaleType\":\"time\",\"yConfig\":[{\"axisMode\":\"left\",\"forAccessor\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"}]}],\"legend\":{\"isVisible\":true,\"legendSize\":\"auto\",\"maxLines\":1,\"position\":\"right\",\"shouldTruncate\":true,\"showSingleSeries\":true,\"legendStats\":[]},\"preferredSeriesType\":\"bar_stacked\",\"showCurrentTimeMarker\":false,\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\",\"yLeftExtent\":{\"enforce\":true,\"mode\":\"full\"},\"yLeftScale\":\"linear\",\"yRightScale\":\"linear\",\"yTitle\":\"Count\"},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\":{\"columnOrder\":[\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"columns\":{\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\":{\"customLabel\":true,\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\":{\"customLabel\":true,\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"winlog.event_data.User: Descending\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.User\"},\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\":{\"customLabel\":true,\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"dropPartials\":false,\"includeEmptyRows\":false,\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Process creation-Activities\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"4d293281-b115-4bf5-8143-be056b148c25\"},\"panelIndex\":\"4d293281-b115-4bf5-8143-be056b148c25\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Privilege Activity entry \",\"panelRefName\":\"panel_4d293281-b115-4bf5-8143-be056b148c25\"}]","timeRestore":false,"title":"Privileged Activity log Dashboards 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8048e972-d666-4403-ba50-805ec6552a2e:panel_8048e972-d666-4403-ba50-805ec6552a2e","type":"links"},{"id":"logs-*","name":"c98b5f54-1c52-4163-8cba-8e09e9765c61:indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c","type":"index-pattern"},{"id":"logs-*","name":"0a90ec8c-687d-4165-9ab1-327baf40fb82:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"8d4ac232-4cce-46b1-b1de-ffbbc839a958:indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882","type":"index-pattern"},{"id":"logs-*","name":"ace01c88-d563-4633-a8d3-b26ec8eca790:indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6","type":"index-pattern"},{"id":"logs-*","name":"f3f34099-a467-4343-9985-2b1fb741c78f:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"7423841b-4470-4aee-ad93-a1a558c54d80:indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743","type":"index-pattern"},{"id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","name":"4d293281-b115-4bf5-8143-be056b148c25:panel_4d293281-b115-4bf5-8143-be056b148c25","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Process - hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Total Processes\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"host.name: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOSwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.ProcessId","winlog.event_data.ParentProcessId","winlog.event_data.CommandLine","winlog.event_data.User","winlog.event_data.IntegrityLevel"],"description":"","grid":{"columns":{"host.name":{"width":202},"winlog.event_data.IntegrityLevel":{"width":238},"winlog.event_data.ParentProcessId":{"width":141},"winlog.event_data.ProcessId":{"width":116}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawn Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2a069ea5-946c-4c62-9e95-a4801299794d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Process - Spawned area ","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Spawned area \",\"type\":\"area\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15w\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"1d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"labels\":{},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD\"}},\"params\":{\"date\":true,\"interval\":\"P1D\",\"intervalESValue\":1,\"intervalESUnit\":\"d\",\"format\":\"YYYY-MM-DD\",\"bounds\":{\"min\":\"2020-01-22T16:30:25.973Z\",\"max\":\"2020-05-06T15:30:25.973Z\"}},\"label\":\"@timestamp per day\",\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","managed":false,"references":[{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - Users bar","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Users bar\",\"type\":\"histogram\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d/d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"12h\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"user.name: Descending\",\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\",\"radiusRatio\":0,\"truncateLegend\":true,\"maxLegendLines\":1}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMiwxXQ=="} +{"attributes":{"columns":["host.name","event.action","process.name","user.name","file.path"],"description":"","grid":{"columns":{"@timestamp":{"width":240},"event.code":{"width":148},"event.provider":{"width":260},"host.name":{"width":168},"winlog.event_data.TargetFilename":{"width":630}}},"hideChart":true,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"event.action: \\\"creation\\\" AND file.path.text: \\\"*\\\\\\\\Downloads\\\\\\\\*\\\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"rowHeight":1,"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Download Test 2","usesAdHocDataView":false,"viewMode":"documents"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.EventType","winlog.event_data.TargetObject","winlog.event_data.Details"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:12 or event.code:13 or event.code:14) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process - Registry events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8584f0da-88c3-478e-bd13-fff76a975897","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\"},\"panelIndex\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_429e5318-e2ae-4637-ac70-eb4a12f191e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":40,\"h\":21,\"i\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},\"panelIndex\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Hosts\",\"panelRefName\":\"panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},\"panelIndex\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Process spawns over time\",\"panelRefName\":\"panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\"},\"panelIndex\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Processes created by users over time\",\"panelRefName\":\"panel_b6b8e77e-67f7-42ce-a835-650ad795834f\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":15,\"i\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\"},\"panelIndex\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process - Users (converted)\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500\"}],\"state\":{\"visualization\":{\"layerId\":\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\",\"alignment\":\"left\",\"hidden\":true},{\"columnId\":\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"alignment\":\"left\"},{\"columnId\":\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"alignment\":\"left\"}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\":{\"columns\":{\"12f20e93-46d3-4931-926b-91fbf9177d4e\":{\"label\":\"Domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\":{\"label\":\"Username\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Users\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},\"panelIndex\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\",\"embeddableConfig\":{\"enhancements\":{},\"columns\":[\"@timestamp\",\"host.name\",\"winlog.event_data.CommandLine\",\"winlog.event_data.User\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ParentProcessId\"]},\"title\":\"Process spawn event logs (Sysmon ID 1)\",\"panelRefName\":\"panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":68,\"w\":48,\"h\":14,\"i\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},\"panelIndex\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\",\"embeddableConfig\":{\"hidePanelTitles\":false,\"description\":\"Shows all the files created in Downloads Directory.\",\"rowHeight\":1,\"enhancements\":{}},\"title\":\"Files created (in Downloads)\",\"panelRefName\":\"panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":82,\"w\":48,\"h\":15,\"i\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\"},\"panelIndex\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Registry events (Sysmon 12, 13, 14)\",\"panelRefName\":\"panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e\"}]","timeRestore":false,"title":"Process Explorer 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"429e5318-e2ae-4637-ac70-eb4a12f191e6:panel_429e5318-e2ae-4637-ac70-eb4a12f191e6","type":"links"},{"id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","name":"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f:panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f","type":"visualization"},{"id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","name":"2cb3c5a0-bf16-43b4-a69d-73012062f55b:panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b","type":"visualization"},{"id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","name":"b6b8e77e-67f7-42ce-a835-650ad795834f:panel_b6b8e77e-67f7-42ce-a835-650ad795834f","type":"visualization"},{"id":"logs-*","name":"9a28d907-c8ef-4815-8ebc-ac897b19ab48:indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500","type":"index-pattern"},{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd:panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd","type":"search"},{"id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","name":"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10:panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10","type":"search"},{"id":"8584f0da-88c3-478e-bd13-fff76a975897","name":"502494bd-c9c5-4f2a-a85f-ffc27cec088e:panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNSwxXQ=="} +{"attributes":{"columns":["event.code","event.action","winlog.logon.type","host.name","winlog.event_data.LogonProcessName","winlog.logon.id","winlog.event_data.SubjectUserName","winlog.event_data.IpAddress","winlog.event_data.TargetDomainName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Vis_sd_security_log_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Vis_sd_security_log_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Count\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1005636a-f473-4a39-a905-ec18aa855ce1","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_id","winlog.event_data.TokenElevationType","winlog.event_data.MandatoryLabel","winlog.event_data.ProcessId","winlog.event_data.ProcessName","process.parent.executable","process.executable"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code: \\\"4688\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4688_process_creation","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOCwxXQ=="} +{"attributes":{"columns":["winlog.user_data.SubjectDomainName","winlog.user_data.SubjectUserName","host.name","event.code","winlog.user_data.Channel","event.module"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1102\\\" OR event.code:\\\"104\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_1102_security_log_cleared","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:2\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_2","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"92562206-3ca8-4227-8dc3-c69d56598302","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_2_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_2_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"logon created locally\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","managed":false,"references":[{"id":"92562206-3ca8-4227-8dc3-c69d56598302","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"winlog.channel\",\"negate\":false,\"params\":{\"query\":\"Security\"},\"type\":\"phrase\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"winlog.channel\":{\"query\":\"Security\"}}}}]}"},"title":"vis_sd_security_4624_picker","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_picker\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1570446686972\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Computername\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"21038ddc-61bb-4709-9a06-e9d399ada64a","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMiwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:3\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_3","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"0d2b506b-85b9-4624-924c-a588072e5ad7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"not user.name:*$\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_3_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_3_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Network logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"network logon by user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","managed":false,"references":[{"id":"0d2b506b-85b9-4624-924c-a588072e5ad7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:5\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_5","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"08f51fba-7f74-4724-a424-d90fd6f433e6","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_5_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_5_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Service account used\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon as service with user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":16,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4752d143-4f0a-4685-b890-7a19e29a0efa","managed":false,"references":[{"id":"08f51fba-7f74-4724-a424-d90fd6f433e6","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:8\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_8","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bbed4a2c-015d-44db-ad34-de2173a81668","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_8_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_8_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Credentials sent in clear text\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7c34827-8829-4c45-81ad-26ffff747efe","managed":false,"references":[{"id":"bbed4a2c-015d-44db-ad34-de2173a81668","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.WorkstationName","winlog.event_data.TargetUserName","winlog.event_data.LogonType","winlog.event_data.IpAddress","winlog.event_data.Status","winlog.event_data.SubStatus"],"description":"New settings test 9/29/2023 16:44","grid":{"columns":{"winlog.event_data.Status":{"width":221}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4625\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4625_failed_logon","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc86684-4065-45c3-9847-2d4c241ec544","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f754ea3-d5cc-4060-8b99-c330f973d797","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectUserName","winlog.computer_name","winlog.task","winlog.event_id","winlog.event_data.PrivilegeList"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4672\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4672_special_privileges_assigned","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":\"NT AUTHORITY, Window Manager, Font Driver Host\",\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4672_special_privileges_assigned_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4672_special_privileges_assigned_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computername\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges logged on\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_types_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_types_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"|Logon Type|Logon Title|Description|\\n| :-: | :- | :- |\\n| 2 | Interactive | A user logged on to this computer. |\\n| 3 | Network | A user or computer logged on to this computer from the network. |\\n| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |\\n| 5 | Service | A service was started by the Service Control Manager. |\\n| 7 | Unlock | This workstation was unlocked. |\\n| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |\\n| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |\\n| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |\\n| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_status_codes_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_codes_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.LogonType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.Status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.SubStatus\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":true,\"truncateLegend\":true,\"maxLegendLines\":5,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_status_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| Code | Description |\\n| :- | :- |\\n| 0XC000005E | There are currently no logon servers available to service the logon request. |\\n| 0xC0000064 | User logon with misspelled or bad user account |\\n| 0xC000006A | User logon with misspelled or bad password |\\n| 0XC000006D | This is either due to a bad username or authentication information |\\n| 0XC000006E | Unknown user name or bad password. |\\n| 0xC000006F | User logon outside authorized hours |\\n| 0xC0000070 | User logon from unauthorized workstation |\\n| 0xC0000071 | User logon with expired password |\\n| 0xC0000072 | User logon to account disabled by administrator |\\n| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |\\n| 0XC0000133 | Clocks between DC and other computer too far out of sync |\\n| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |\\n| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |\\n| 0XC0000192 | An attempt was made to logon, but the Netlogon service was not started. |\\n| 0xC0000193 | User logon with expired account |\\n| 0XC0000224 | User is required to change password at next logon |\\n| 0XC0000225 | Evidently a bug in Windows and not a risk |\\n| 0xC0000234 | User logon with account locked |\\n| 0XC00002EE | Failure Reason: An Error occurred during Logon |\\n| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |\\n| 0x0 | Status OK. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SubjectUserName","winlog.event_data.TargetUserName","winlog.event_data.TargetServerName","winlog.event_data.SubjectDomainName","winlog.event_data.TargetDomainName","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4648 \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4648_logon_explicit_creds_running_as_different_user","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_logs_computernames_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Logged events\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"filters\",\"schema\":\"bucket\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_id : 4624\",\"language\":\"kuery\"},\"label\":\"EventID 4624\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":1000,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computername\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"vis_sd_security_logs_computernames_datatable\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7410752-98c4-4145-adb4-1c39506f58ca","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NiwxXQ=="} +{"attributes":{"description":"Security log related events","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security logs events\",\"panelRefName\":\"panel_1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":137,\"w\":48,\"h\":17,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Process creation - event ID 4688\",\"panelRefName\":\"panel_2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":112,\"w\":48,\"h\":8,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Log Cleared - event ID 1102 or 104\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":154,\"w\":48,\"h\":18,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logon created - Logon type 2\",\"panelRefName\":\"panel_6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select a computer to filter the below results. Leave blank for all\",\"panelRefName\":\"panel_7\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":172,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - network logon created - Logon type 3\",\"panelRefName\":\"panel_8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":120,\"w\":48,\"h\":17,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log events - Detail\",\"panelRefName\":\"panel_9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":48,\"h\":17,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - logon as a service - Logon type 5\",\"panelRefName\":\"panel_10\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":204,\"w\":48,\"h\":15,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Credential sent as clear text - Logon type 8\",\"panelRefName\":\"panel_11\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":15,\"i\":\"15\"},\"panelIndex\":\"15\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon attempts\",\"panelRefName\":\"panel_15\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":219,\"w\":48,\"h\":18,\"i\":\"19\"},\"panelIndex\":\"19\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logons with special privileges assigned - event ID 4672\",\"panelRefName\":\"panel_19\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":18,\"i\":\"21\"},\"panelIndex\":\"21\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon type codes\",\"panelRefName\":\"panel_21\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":54,\"w\":48,\"h\":16,\"i\":\"22\"},\"panelIndex\":\"22\",\"embeddableConfig\":{\"enhancements\":{},\"description\":\"\"},\"title\":\"Failed logon and reason (see table for explanations)\",\"panelRefName\":\"panel_22\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":70,\"w\":48,\"h\":26,\"i\":\"23\"},\"panelIndex\":\"23\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon status codes\",\"panelRefName\":\"panel_23\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":237,\"w\":48,\"h\":15,\"i\":\"28\"},\"panelIndex\":\"28\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"title\":\"Security log - Process started with different credentials- event ID 4648 [could be RUNAS, scheduled tasks]\",\"panelRefName\":\"panel_28\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":8,\"w\":24,\"h\":13,\"i\":\"30\"},\"panelIndex\":\"30\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"title\":\"Select a computername to filter\",\"panelRefName\":\"panel_30\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"69421b10-759e-477d-8f28-adf6e198c8b5\"},\"panelIndex\":\"69421b10-759e-477d-8f28-adf6e198c8b5\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_69421b10-759e-477d-8f28-adf6e198c8b5\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":96,\"w\":48,\"h\":16,\"i\":\"96010259-5ae8-4632-bcce-34078573b1cd\"},\"panelIndex\":\"96010259-5ae8-4632-bcce-34078573b1cd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed Logons\",\"panelRefName\":\"panel_96010259-5ae8-4632-bcce-34078573b1cd\"}]","timeRestore":false,"title":"Security Dashboard - Security Log 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"beeeb066-d497-4b2a-99d3-44d741238bd1","managed":false,"references":[{"id":"1005636a-f473-4a39-a905-ec18aa855ce1","name":"1:panel_1","type":"visualization"},{"id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","name":"2:panel_2","type":"search"},{"id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","name":"3:panel_3","type":"search"},{"id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","name":"6:panel_6","type":"visualization"},{"id":"21038ddc-61bb-4709-9a06-e9d399ada64a","name":"7:panel_7","type":"visualization"},{"id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","name":"8:panel_8","type":"visualization"},{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"9:panel_9","type":"search"},{"id":"4752d143-4f0a-4685-b890-7a19e29a0efa","name":"10:panel_10","type":"visualization"},{"id":"a7c34827-8829-4c45-81ad-26ffff747efe","name":"11:panel_11","type":"visualization"},{"id":"3f754ea3-d5cc-4060-8b99-c330f973d797","name":"15:panel_15","type":"visualization"},{"id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","name":"19:panel_19","type":"visualization"},{"id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","name":"21:panel_21","type":"visualization"},{"id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","name":"22:panel_22","type":"visualization"},{"id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","name":"23:panel_23","type":"visualization"},{"id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","name":"28:panel_28","type":"search"},{"id":"a7410752-98c4-4145-adb4-1c39506f58ca","name":"30:panel_30","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"69421b10-759e-477d-8f28-adf6e198c8b5:panel_69421b10-759e-477d-8f28-adf6e198c8b5","type":"links"},{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"96010259-5ae8-4632-bcce-34078573b1cd:panel_96010259-5ae8-4632-bcce-34078573b1cd","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:\\\"Microsoft-Windows-Sysmon/Operational\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_sysmon_all_events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":false,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":0},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_datatable\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event code\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"90a5fcee-d3fb-4969-a336-869ab6808777","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_host_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_host_events_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Missing computer name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"split\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Missing computer name\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_event_code_reference","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| \\tEvent ID\\t | \\tEvent\\t | \\tDescription\\t |\\n| \\t:-:\\t | \\t:-\\t | \\t-\\t |\\n| \\t1\\t | \\tProcess creation\\t | \\tThe process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.\\t |\\n| \\t2\\t | \\tA process changed a file creation time\\t | \\tThe change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\\t |\\n| \\t3\\t | \\tNetwork connection\\t | \\tThe network connection event logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.\\t |\\n| \\t4\\t | \\tSysmon service state changed\\t | \\tThe service state change event reports the state of the Sysmon service (started or stopped).\\t |\\n| \\t5\\t | \\tProcess terminated\\t | \\tThe process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.\\t |\\n| \\t6\\t | \\tDriver loaded\\t | \\tThe driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.\\t |\\n| \\t7\\t | \\tImage loaded\\t | \\tThe image loaded event logs when a module is loaded in a specific process. This event is disabled by default and needs to be configured with the �l option. It indicates the process in which the module is loaded, hashes and signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading. This event should be configured carefully, as monitoring all image load events will generate a large number of events.\\t |\\n| \\t8\\t | \\tCreateRemoteThread\\t | \\tThe CreateRemoteThread event detects when a process creates a thread in another process. This technique is used by malware to inject code and hide in other processes. The event indicates the source and target process. It gives information on the code that will be run in the new thread: StartAddress, StartModule and StartFunction. Note that StartModule and StartFunction fields are inferred, they might be empty if the starting address is outside loaded modules or known exported functions.\\t |\\n| \\t9\\t | \\tRawAccessRead\\t | \\tThe RawAccessRead event detects when a process conducts reading operations from the drive using the \\\\\\\\\\\\\\\\.\\\\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.\\t |\\n| \\t10\\t | \\tProcessAccess\\t | \\tThe process accessed event reports when a process opens another process, an operation that�s often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks. Enabling it can generate significant amounts of logging if there are diagnostic utilities active that repeatedly open processes to query their state, so it generally should only be done so with filters that remove expected accesses.\\t |\\n| \\t11\\t | \\tFileCreate\\t | \\tFile create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.\\t |\\n| \\t12\\t | \\tRegistryEvent (Object create and delete)\\t | \\tRegistry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications. Sysmon uses abbreviated versions of Registry root key names, with the following mappings: |\\n|||**Key name**                                                                                          **Abbreviation**|\\n|||HKEY_LOCAL_MACHINE                                                                  HKLM|\\n|||HKEY_USERS                                                                                     HKU|\\n|||HKEY_LOCAL_MACHINE\\\\System\\\\ControlSet00x                          HKLM\\\\System\\\\CurrentControlSet|\\n|||HKEY_LOCAL_MACHINE\\\\Classes                                                    HKCR|\\n| \\t13\\t | \\tRegistryEvent (Value Set)\\t | \\tThis Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.\\t |\\n| \\t14\\t | \\tRegistryEvent (Key and Value Rename)\\t | \\tRegistry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.\\t |\\n| \\t15\\t | \\tFileCreateStreamHash\\t | \\tThis event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream. There are malware variants that drop their executables or configuration settings via browser downloads, and this event is aimed at capturing that based on the browser attaching a Zone.Identifier �mark of the web� stream.\\t |\\n| \\t16\\t | \\tServiceConfigurationChange\\t | \\tThis event logs changes in the Sysmon configuration - for example when the filtering rules are updated.\\t |\\n| \\t17\\t | \\tPipeEvent (Pipe Created)\\t | \\tThis event generates when a named pipe is created. Malware often uses named pipes for interprocess communication.\\t |\\n| \\t18\\t | \\tPipeEvent (Pipe Connected)\\t | \\tThis event logs when a named pipe connection is made between a client and a server.\\t |\\n| \\t19\\t | \\tWmiEvent (WmiEventFilter activity detected)\\t | \\tWhen a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.\\t |\\n| \\t20\\t | \\tWmiEvent (WmiEventConsumer activity detected)\\t | \\tThis event logs the registration of WMI consumers, recording the consumer name, log, and destination.\\t |\\n| \\t21\\t | \\tWmiEvent (WmiEventConsumerToFilter activity detected)\\t | \\tWhen a consumer binds to a filter, this event logs the consumer name and filter path.\\t |\\n| \\t22\\t | \\tDNSEvent (DNS query)\\t | \\tThis event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.\\t |\\n| \\t23\\t | \\tFileDelete (A file delete was detected)\\t | \\tA file was deleted.\\t |\\n| \\t24\\t | \\tClipboardChange (New content in the clipboard)\\t | \\tThis event is generated when the system clipboard contents change.\\t |\\n| \\t25\\t | \\tProcessTampering (Process image change)\\t | \\tThis event is generated when a process image is changed from an external source, such as a different process.\\t |\\n| \\t255\\t | \\tError\\t | \\tThis event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the Sysinternals forum or over Twitter (@markrussinovich).\\t |\\n\\nFor more information see *https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"title\":\"vis_sd_sysmon_event_code_reference\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"88efefcc-de0a-4a08-9a17-3d09423092e0","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MywxXQ=="} +{"attributes":{"description":"Summarizes collected Sysmon event data","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Total number of Sysmon events found\",\"panelRefName\":\"panel_2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":13,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"title\":\"Percentage of Sysmon events by event code\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":18,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Count of Sysmon events by event code\",\"panelRefName\":\"panel_4\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":13,\"w\":24,\"h\":18,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"asc\"}}},\"enhancements\":{}},\"title\":\"Top 10 hosts generating the most Sysmon data\",\"panelRefName\":\"panel_5\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":39,\"w\":48,\"h\":21,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon event code reference\",\"panelRefName\":\"panel_7\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\"},\"panelIndex\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550\"}]","timeRestore":false,"title":"Sysmon Summary 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","managed":false,"references":[{"id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","name":"2:panel_2","type":"visualization"},{"id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","name":"3:panel_3","type":"visualization"},{"id":"90a5fcee-d3fb-4969-a336-869ab6808777","name":"4:panel_4","type":"visualization"},{"id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","name":"5:panel_5","type":"visualization"},{"id":"88efefcc-de0a-4a08-9a17-3d09423092e0","name":"7:panel_7","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"4fb34c82-2e7f-43cb-88ca-54b304bc2550:panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550","type":"links"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"1587572089136\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4a675166-ce19-4836-9567-eda4ab46b3d5","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - Filter Hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Filter Hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Event count\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8d476795-134d-4689-9050-a24b57adaa90","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security - Select Host","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select Host\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588685297382\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Logons Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logons Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Logons\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4eccff45-c97a-480f-b593-4744922893e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human User Logon Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon attempts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon attempts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Login attempts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f7d1f53-6b70-4235-879a-f149d98c9063","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon events over time","uiStateJSON":"{\"vis\":{\"colors\":{\"Failed attempts\":\"#BF1B00\",\"Successful atempts\":\"#629E51\"}}}","version":1,"visState":"{\"title\":\"Security - Logon events over time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":1,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-23T08:41:59.000Z\",\"max\":\"2020-04-23T08:56:59.000Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"event.code:4625\",\"language\":\"lucene\"},\"label\":\"Failed attempts\"},{\"input\":{\"query\":\"event.code:4624\",\"language\":\"lucene\"},\"label\":\"Successful atempts\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15m\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"42ae3f23-386c-4ceb-bb84-98879107338b","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4,624, 4,625\",\"params\":[\"4624\",\"4625\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}},{\"match_phrase\":{\"event.code\":\"4625\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Computers\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MCwxXQ=="} +{"attributes":{"columns":["event.code","host.name","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.IpAddress","event.action","event.outcome","winlog.event_data.LogonType"],"description":"","grid":{"columns":{"user.domain":{"width":119},"user.name":{"width":134}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human Logon & Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Network Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Network Connections\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80b03097-c117-44d0-8413-3c932d0886a2","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id : \\\"3\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"All network activity ","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f02a3c3d-eb39-4347-91f7-d62bece13128","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Activity Line","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Activity Line\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Connections\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Connections\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Connections\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-24T15:29:10.918Z\",\"max\":\"2020-04-24T15:44:10.918Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"aa741894-2140-4529-a488-6d34ed57abef","managed":false,"references":[{"id":"f02a3c3d-eb39-4347-91f7-d62bece13128","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.DestinationHostname","destination.ip","winlog.event_data.DestinationIsIpv6","network.","process.executable","winlog.event_data.DestinationPort","winlog.event_data.Protocol","winlog.user.name","winlog.user.type","source.ip","winlog.event_data.SourceIsIpv6","source.port","network.protocol"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_non_browsers_connection","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50b150ad-5aff-4706-9229-d9bcb38255ef","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Overview - Processes with unusual network activity","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Overview - Processes with unusual network activity\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"params\":{\"field\":\"process.name\",\"size\":10,\"include\":\"\",\"json\":\"\",\"customLabel\":\"Process\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"string\"},\"params\":{},\"label\":\"Process\",\"aggType\":\"significant_terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NiwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{"columns":{"winlog.event_data.SubjectDomainName":{"width":216}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_non_private_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Processes Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Processes Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Processes & Powershell\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.User","winlog.event_data.ProcessId","winlog.event_data.ProcessName","winlog.event_data.Hashes","process.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawns","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OSwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.command_line","process.parent.executable","process.parent.command_line","file.path","event.code"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\" OR process.command_line.text:\\\"powershell\\\" OR parent.process.command_line.text:\\\"powershell\\\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_powershell_run","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell Run Count","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Security - Powershell Run Count\",\"type\":\"metric\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell runs over time","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now/w\",\"to\":\"now/w\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}],\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\"},\"title\":\"Security - Powershell runs over time\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Power shell hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"title\":\"Security - Power shell hosts pie\",\"type\":\"pie\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.args","process.parent.executable","process.parent.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND process.command_line.text:(\\\"invoke\\\" or \\\"bypass\\\" or \\\"iex\\\" or \\\"ex\\\" or \\\"icm\\\" or \\\"new-object\\\" or \\\"set\\\" or \\\"get\\\" or \\\"write\\\" or \\\"out\\\" or \\\"download\\\" or \\\"encoded\\\")\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Potentially Suspicious Powershell","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","destination.domain","destination.ip"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND (process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_powershell_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04c60a34-98a9-4073-8538-97996e80855f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Files title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Files title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Files\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"file.path.text: \\\"tmp\\\" OR file.path.text:\\\"temp\\\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"file.path\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"exists\":{\"field\":\"file.path\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"TEMP & %TEMP%","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d3792434-6184-44ed-bad4-830249085d68","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"TEMP & %TEMP%","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target File\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":30,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Hostname\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"TEMP & %TEMP%\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","managed":false,"references":[{"id":"d3792434-6184-44ed-bad4-830249085d68","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NSwxXQ=="} +{"attributes":{"columns":["@timestamp","user.domain","user.name","host.name","process.executable","winlog.event_data.ProcessId"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: \\\"9\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Raw Access Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Windows Defender Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Windows Defender Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Windows Defender\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a2cdbce1-9070-4851-909f-774a80d2875a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - AV Events Count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - AV Events Count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Windows AV Events\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ac9a9da-1772-483c-8c32-b049f0273186","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_id\",\"value\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"params\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"negate\":false,\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_id\":\"1006\"}},{\"match_phrase\":{\"winlog.event_id\":\"1007\"}},{\"match_phrase\":{\"winlog.event_id\":\"1008\"}},{\"match_phrase\":{\"winlog.event_id\":\"1009\"}},{\"match_phrase\":{\"winlog.event_id\":\"1116\"}},{\"match_phrase\":{\"winlog.event_id\":\"1117\"}},{\"match_phrase\":{\"winlog.event_id\":\"1118\"}},{\"match_phrase\":{\"winlog.event_id\":\"1119\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"AV Detection event","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"AV Hits (Count)","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"AV Hits (Count)\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"AV Detection hits\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fe86395f-474e-43a1-a772-34d1306373e0","managed":false,"references":[{"id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.Detection User","host.name","winlog.event_data.Path","winlog.event_data.FWLink"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: 1116\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"Microsoft-Windows-Windows Defender\"},\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"match_phrase\":{\"event.provider\":{\"query\":\"Microsoft-Windows-Windows Defender\"}}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Defender AV Detections","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MSwxXQ=="} +{"attributes":{"description":"User Security overview, filtered by Domain / Username or hostname","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},\"panelIndex\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":15,\"h\":11,\"i\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},\"panelIndex\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search users\",\"panelRefName\":\"panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},{\"type\":\"visualization\",\"gridData\":{\"x\":23,\"y\":0,\"w\":25,\"h\":11,\"i\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\"},\"panelIndex\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Filter hosts\",\"panelRefName\":\"panel_62ea04ec-0776-46c0-9b8c-cf2915600337\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":15,\"h\":10,\"i\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\"},\"panelIndex\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search hosts\",\"panelRefName\":\"panel_45ac8571-ae44-4bb5-a237-cd230ede51d5\"},{\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":11,\"w\":25,\"h\":10,\"i\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\"},\"panelIndex\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\",\"isTransposed\":false},{\"columnId\":\"26752485-2aa5-4908-b400-504d6e7ef451\",\"isTransposed\":false},{\"columnId\":\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"layerType\":\"data\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d123adeb-fd39-4176-b3c9-69c88d2852d5\":{\"columns\":{\"6f33ff19-9959-4c43-b791-939582a0b3d2\":{\"label\":\"Event Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"26752485-2aa5-4908-b400-504d6e7ef451\":{\"label\":\"Filters\",\"dataType\":\"string\",\"operationType\":\"filters\",\"scale\":\"ordinal\",\"isBucketed\":true,\"params\":{\"filters\":[{\"label\":\"\",\"input\":{\"query\":\"\\\"log\\\" : *\",\"language\":\"kuery\"}}]}},\"cc4e45f6-be3a-4de0-a416-e21043b601bb\":{\"label\":\"Top 3 values of user.domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"user.domain\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"26752485-2aa5-4908-b400-504d6e7ef451\",\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"6f33ff19-9959-4c43-b791-939582a0b3d2\"],\"sampling\":1,\"indexPatternId\":\"logs-*\",\"incompleteColumns\":{}}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter users\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":5,\"i\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},\"panelIndex\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":26,\"w\":9,\"h\":7,\"i\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\"},\"panelIndex\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_e5de9fc4-5863-470c-8246-0a86f5af897e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":9,\"y\":26,\"w\":20,\"h\":14,\"i\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},\"panelIndex\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logon attempts\",\"panelRefName\":\"panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},{\"type\":\"visualization\",\"gridData\":{\"x\":29,\"y\":26,\"w\":19,\"h\":14,\"i\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},\"panelIndex\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logged on computers\",\"panelRefName\":\"panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":33,\"w\":9,\"h\":7,\"i\":\"0d1c0533-598a-4304-80be-c22047edcbe1\"},\"panelIndex\":\"0d1c0533-598a-4304-80be-c22047edcbe1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0d1c0533-598a-4304-80be-c22047edcbe1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":17,\"i\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},\"panelIndex\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User Logon & Logoff Events\",\"panelRefName\":\"panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":57,\"w\":48,\"h\":4,\"i\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\"},\"panelIndex\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0fab3d76-5411-46e4-982f-4d4626c977b8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":48,\"h\":14,\"i\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},\"panelIndex\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"All network connections\",\"panelRefName\":\"panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":75,\"w\":24,\"h\":15,\"i\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},\"panelIndex\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network Process List (converted)\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\"}],\"state\":{\"visualization\":{\"layerId\":\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\",\"alignment\":\"left\"},{\"columnId\":\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"alignment\":\"left\"},{\"columnId\":\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"alignment\":\"left\"},{\"columnId\":\"f467badb-5f40-4b21-bdaf-f378db834902\",\"isTransposed\":false,\"isMetric\":false}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\":{\"ignoreGlobalFilters\":false,\"columns\":{\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\":{\"label\":\"Destination IP\",\"dataType\":\"ip\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"destination.ip\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\":{\"label\":\"Computer\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5330e606-7244-4d38-a5a3-d94d5c6412c2\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"f467badb-5f40-4b21-bdaf-f378db834902\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"f467badb-5f40-4b21-bdaf-f378db834902\",\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network Process List\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":75,\"w\":24,\"h\":15,\"i\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},\"panelIndex\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network connections area (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\",\"seriesType\":\"bar\",\"xAccessor\":\"70a3abae-7040-4287-97d3-550088410400\",\"accessors\":[\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"layerType\":\"data\",\"colorMapping\":{\"assignments\":[],\"specialAssignments\":[{\"rule\":{\"type\":\"other\"},\"color\":{\"type\":\"loop\"},\"touched\":false}],\"paletteId\":\"eui_amsterdam_color_blind\",\"colorMode\":{\"type\":\"categorical\"}}}]},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\":{\"ignoreGlobalFilters\":false,\"columns\":{\"70a3abae-7040-4287-97d3-550088410400\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0fbfe911-4334-4e6f-8256-b72f2a280259\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"0fbfe911-4334-4e6f-8256-b72f2a280259\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"70a3abae-7040-4287-97d3-550088410400\",\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network connections area\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":90,\"w\":48,\"h\":15,\"i\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},\"panelIndex\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Unusual network connections from non-browser processes\",\"panelRefName\":\"panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":105,\"w\":48,\"h\":10,\"i\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\"},\"panelIndex\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network Connection Events (Sysmon ID 3)\",\"panelRefName\":\"panel_ea6ad677-7322-4c5c-8946-cac4dd983b26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":115,\"w\":48,\"h\":4,\"i\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\"},\"panelIndex\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_43b61744-5553-4fd1-894c-6e91a799f4a2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":119,\"w\":48,\"h\":14,\"i\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\"},\"panelIndex\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Spawned Processes\",\"panelRefName\":\"panel_9a522603-8d31-4ad6-ac4f-130a814f54fa\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":133,\"w\":10,\"h\":15,\"i\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},\"panelIndex\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell Events\",\"panelRefName\":\"panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":10,\"y\":133,\"w\":20,\"h\":15,\"i\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},\"panelIndex\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events over time\",\"panelRefName\":\"panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":30,\"y\":133,\"w\":18,\"h\":15,\"i\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\"},\"panelIndex\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events by computer\",\"panelRefName\":\"panel_ed7a59ea-caa7-4396-89b7-90c6b8363800\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":148,\"w\":25,\"h\":16,\"i\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},\"panelIndex\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Potentially suspicious powershell\",\"panelRefName\":\"panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},{\"type\":\"search\",\"gridData\":{\"x\":25,\"y\":148,\"w\":23,\"h\":16,\"i\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\"},\"panelIndex\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell network connections\",\"panelRefName\":\"panel_9587ef7f-3554-4886-be6a-fae4648e87dd\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":164,\"w\":48,\"h\":4,\"i\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},\"panelIndex\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":168,\"w\":24,\"h\":15,\"i\":\"4988f659-a275-4317-b071-8a350087a4e6\"},\"panelIndex\":\"4988f659-a275-4317-b071-8a350087a4e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"References to temporary files\",\"panelRefName\":\"panel_4988f659-a275-4317-b071-8a350087a4e6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":168,\"w\":24,\"h\":15,\"i\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},\"panelIndex\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"RawAccessRead (Sysmon Event 9)\",\"panelRefName\":\"panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":183,\"w\":48,\"h\":4,\"i\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},\"panelIndex\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":12,\"h\":14,\"i\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},\"panelIndex\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Defender event count\",\"panelRefName\":\"panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},{\"type\":\"visualization\",\"gridData\":{\"x\":12,\"y\":187,\"w\":12,\"h\":14,\"i\":\"30454a55-0210-43d2-af3d-822c5b519033\"},\"panelIndex\":\"30454a55-0210-43d2-af3d-822c5b519033\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_30454a55-0210-43d2-af3d-822c5b519033\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":187,\"w\":24,\"h\":14,\"i\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"},\"panelIndex\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"AV Detections (Event 1116)\",\"panelRefName\":\"panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"}]","timeRestore":false,"title":"User Security 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc36188-8461-4927-932e-0e452b7dc3ac","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1dd50c7d-7e5d-439d-9071-544339f6ef3f:panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f","type":"links"},{"id":"4a675166-ce19-4836-9567-eda4ab46b3d5","name":"956d6ef1-5d6b-4ccc-a123-fa66805c15db:panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db","type":"visualization"},{"id":"8d476795-134d-4689-9050-a24b57adaa90","name":"62ea04ec-0776-46c0-9b8c-cf2915600337:panel_62ea04ec-0776-46c0-9b8c-cf2915600337","type":"visualization"},{"id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","name":"45ac8571-ae44-4bb5-a237-cd230ede51d5:panel_45ac8571-ae44-4bb5-a237-cd230ede51d5","type":"visualization"},{"id":"logs-*","name":"1324f39e-f215-45e9-b679-05b06e4fcb9d:indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5","type":"index-pattern"},{"id":"4eccff45-c97a-480f-b593-4744922893e5","name":"b453a1df-c025-430b-84e3-d6dc7a8c48f1:panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1","type":"visualization"},{"id":"3f7d1f53-6b70-4235-879a-f149d98c9063","name":"e5de9fc4-5863-470c-8246-0a86f5af897e:panel_e5de9fc4-5863-470c-8246-0a86f5af897e","type":"visualization"},{"id":"42ae3f23-386c-4ceb-bb84-98879107338b","name":"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48:panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48","type":"visualization"},{"id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","name":"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2:panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2","type":"visualization"},{"id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","name":"0d1c0533-598a-4304-80be-c22047edcbe1:panel_0d1c0533-598a-4304-80be-c22047edcbe1","type":"visualization"},{"id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","name":"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396:panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396","type":"search"},{"id":"80b03097-c117-44d0-8413-3c932d0886a2","name":"0fab3d76-5411-46e4-982f-4d4626c977b8:panel_0fab3d76-5411-46e4-982f-4d4626c977b8","type":"visualization"},{"id":"aa741894-2140-4529-a488-6d34ed57abef","name":"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305:panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305","type":"visualization"},{"id":"logs-*","name":"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c:indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f","type":"index-pattern"},{"id":"logs-*","name":"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b:indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9","type":"index-pattern"},{"id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","name":"6d5d4b74-133b-4fef-8ae5-14d2e7037a78:panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78","type":"visualization"},{"id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","name":"ea6ad677-7322-4c5c-8946-cac4dd983b26:panel_ea6ad677-7322-4c5c-8946-cac4dd983b26","type":"search"},{"id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","name":"43b61744-5553-4fd1-894c-6e91a799f4a2:panel_43b61744-5553-4fd1-894c-6e91a799f4a2","type":"visualization"},{"id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","name":"9a522603-8d31-4ad6-ac4f-130a814f54fa:panel_9a522603-8d31-4ad6-ac4f-130a814f54fa","type":"search"},{"id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","name":"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6:panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6","type":"visualization"},{"id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","name":"68d75f76-3806-4d15-81e9-d0dcfa34c9b9:panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9","type":"visualization"},{"id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","name":"ed7a59ea-caa7-4396-89b7-90c6b8363800:panel_ed7a59ea-caa7-4396-89b7-90c6b8363800","type":"visualization"},{"id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","name":"cfe390f9-80a7-4a11-9a8c-7d599e41e38a:panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a","type":"search"},{"id":"04c60a34-98a9-4073-8538-97996e80855f","name":"9587ef7f-3554-4886-be6a-fae4648e87dd:panel_9587ef7f-3554-4886-be6a-fae4648e87dd","type":"search"},{"id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","name":"7cfff19f-bf9d-4101-be63-4d9b8ea78e26:panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26","type":"visualization"},{"id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","name":"4988f659-a275-4317-b071-8a350087a4e6:panel_4988f659-a275-4317-b071-8a350087a4e6","type":"visualization"},{"id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","name":"bfae12f4-b2fd-471f-a111-daf49cd25ed3:panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3","type":"search"},{"id":"a2cdbce1-9070-4851-909f-774a80d2875a","name":"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b:panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b","type":"visualization"},{"id":"6ac9a9da-1772-483c-8c32-b049f0273186","name":"e8c5ac63-42b4-4081-85e3-378c85c0b4cb:panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb","type":"visualization"},{"id":"fe86395f-474e-43a1-a772-34d1306373e0","name":"30454a55-0210-43d2-af3d-822c5b519033:panel_30454a55-0210-43d2-af3d-822c5b519033","type":"visualization"},{"id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","name":"6ff4d4db-16b6-4c80-8bb6-95e009803d1d:panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MiwxXQ=="} +{"attributes":{"layout":"vertical","links":[{"destinationRefName":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","id":"f002a04e-05b9-4b0e-862a-b0737b0fcc7d","order":0,"type":"dashboardLink"},{"destinationRefName":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","id":"fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1","order":1,"type":"dashboardLink"},{"destinationRefName":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","id":"4a789d96-55a1-4d28-9e97-950bb150397f","order":2,"type":"dashboardLink"},{"destinationRefName":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","id":"1a2ef245-e023-4af9-8798-6a012ac5a9ac","order":3,"type":"dashboardLink"},{"destinationRefName":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","id":"bd24a361-4123-4d7a-82b6-a2c7c20414f2","order":4,"type":"dashboardLink"},{"destinationRefName":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","id":"49b455da-4a39-4c33-ac97-006a2a64c22e","order":5,"type":"dashboardLink"},{"destinationRefName":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","id":"585265f5-693a-4f0e-a824-d0e36ae2f821","order":6,"type":"dashboardLink"},{"destinationRefName":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","id":"706a6fd1-1a22-46dc-829a-960f1897b511","order":7,"type":"dashboardLink"},{"destinationRefName":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","id":"0dde1941-a105-4eb7-ade8-054e4465a9cb","order":8,"type":"dashboardLink"},{"destinationRefName":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","id":"5dc55829-39b3-439d-b18d-2327c4def786","order":9,"type":"dashboardLink"},{"destinationRefName":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","id":"ff056d48-316f-439e-94d6-95af7324ad81","order":10,"type":"dashboardLink"},{"destinationRefName":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","id":"a3da514f-4d57-473a-a3cd-8b5eb6793adf","order":11,"type":"dashboardLink"}],"title":"Logging Made Easy Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","managed":false,"references":[{"id":"baa4f981-0c75-43da-b96e-1107f171dfaa","name":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","type":"dashboard"},{"id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","name":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","type":"dashboard"},{"id":"e4d7b207-99aa-4410-8a2e-03487222bda1","name":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","type":"dashboard"},{"id":"fff78bfe-2758-4fa1-939f-362380fc607d","name":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","type":"dashboard"},{"id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","name":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","type":"dashboard"},{"id":"614a8392-17b5-49c4-9397-bc3cac526c61","name":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","type":"dashboard"},{"id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","name":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","type":"dashboard"},{"id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","name":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","type":"dashboard"},{"id":"beeeb066-d497-4b2a-99d3-44d741238bd1","name":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","type":"dashboard"},{"id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","name":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","type":"dashboard"},{"id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","name":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","type":"dashboard"},{"id":"2fc36188-8461-4927-932e-0e452b7dc3ac","name":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - User activity title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - User activity title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## All user activity\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - Logon title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Logon title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Logon / Logoff events\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NywxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectDomainName","winlog.event_data.TargetUserName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"user.name":{"width":193},"winlog.event_data.SubjectDomainName":{"width":193}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4624\\\" and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_data.LogonType\",\"value\":[\"2\",\"10\",\"11\",\"7\"],\"params\":[\"2\",\"10\",\"11\",\"7\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_data.LogonType\":\"2\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"10\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"11\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"7\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Interactive Logon search","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{"columns":{"winlog.event_data.TargetDomainName":{"width":241},"winlog.event_data.TargetUserName":{"width":241}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:\\\"4634\\\" OR event.code:\\\"4647\\\" ) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"HR - Interactive v Remote pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Interactive v Remote pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"2\\\"\",\"language\":\"lucene\"},\"label\":\"Interactive\"},{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"10\\\"\\n\",\"language\":\"lucene\"},\"label\":\"RemoteInteractive\"}]},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"label\":\"filters\",\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MCwxXQ=="} +{"attributes":{"description":"Overview of user activity for Human Resources\n","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":24,\"i\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},\"panelIndex\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":20,\"h\":12,\"i\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\"},\"panelIndex\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"accessors\":[\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"splitAccessor\":\"fc23a029-309e-40a7-aeca-309fd8423ced\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\":{\"columns\":{\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\":{\"label\":\"Top 5 values of winlog.event_data.SubjectDomainName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.SubjectDomainName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"fc23a029-309e-40a7-aeca-309fd8423ced\":{\"label\":\"Top 3 values of winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5a238afa-9ffa-4568-8a43-6167c0a76b67\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"fc23a029-309e-40a7-aeca-309fd8423ced\",\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Users\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":20,\"h\":12,\"i\":\"69771c75-8536-49b2-a835-c134ada8cd8d\"},\"panelIndex\":\"69771c75-8536-49b2-a835-c134ada8cd8d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"accessors\":[\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"position\":\"top\",\"seriesType\":\"bar\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"22b4e313-2858-411e-a90b-911198fa34fe\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\":{\"columns\":{\"22b4e313-2858-411e-a90b-911198fa34fe\":{\"label\":\"Top 5 values of winlog.computer_name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.computer_name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"22b4e313-2858-411e-a90b-911198fa34fe\",\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Computers\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":12,\"w\":40,\"h\":12,\"i\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},\"panelIndex\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select domain(s) and username(s)\",\"panelRefName\":\"panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":24,\"w\":48,\"h\":4,\"i\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\"},\"panelIndex\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_f2f654b0-42ef-403c-bee2-7e26499f809a\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":48,\"h\":14,\"i\":\"e40e6077-f799-4c66-9bf8-1664121d8069\"},\"panelIndex\":\"e40e6077-f799-4c66-9bf8-1664121d8069\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f46d1729-4bd5-4219-9973-01913c208fef\",\"accessors\":[\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f46d1729-4bd5-4219-9973-01913c208fef\":{\"columns\":{\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"800c3857-3c9c-4fc5-a403-3fcbede05599\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\",\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events by Time\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":42,\"w\":48,\"h\":4,\"i\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},\"panelIndex\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":46,\"w\":24,\"h\":15,\"i\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},\"panelIndex\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logon events (filter by LogonId)\",\"panelRefName\":\"panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":46,\"w\":24,\"h\":15,\"i\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\"},\"panelIndex\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logoff events (correlate to logon events)\",\"panelRefName\":\"panel_bb42b25e-f934-485b-854c-440cc1b3ebee\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":24,\"h\":15,\"i\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"},\"panelIndex\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"In person vs Remote logons\",\"panelRefName\":\"panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"}]","timeRestore":false,"title":"User HR 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d:panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d","type":"links"},{"id":"logs-*","name":"c8d3e871-1f5d-40bd-a0f9-5441a58cad32:indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093","type":"index-pattern"},{"id":"logs-*","name":"69771c75-8536-49b2-a835-c134ada8cd8d:indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2","type":"index-pattern"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"ab726ae4-6c98-4f26-8cd3-07bf2808b704:panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704","type":"visualization"},{"id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","name":"f2f654b0-42ef-403c-bee2-7e26499f809a:panel_f2f654b0-42ef-403c-bee2-7e26499f809a","type":"visualization"},{"id":"logs-*","name":"e40e6077-f799-4c66-9bf8-1664121d8069:indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef","type":"index-pattern"},{"id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","name":"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e:panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e","type":"visualization"},{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"755f30aa-d6ad-46d9-b2c3-7425c02ed03e:panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e","type":"search"},{"id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","name":"bb42b25e-f934-485b-854c-440cc1b3ebee:panel_bb42b25e-f934-485b-854c-440cc1b3ebee","type":"search"},{"id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","name":"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f:panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MSwxXQ=="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":123,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/elastic/user_security_2_0.ndjson b/dashboards/elastic/user_security_2_0.ndjson index ce1e6e72..762624f7 100644 --- a/dashboards/elastic/user_security_2_0.ndjson +++ b/dashboards/elastic/user_security_2_0.ndjson @@ -1,43 +1,124 @@ -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Dashboard Menu","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Dashboard Menu\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"[Computer Software Overview](#/dashboard/33f0d3b0-8b8a-11ea-b1c6-a5bf39283f12)\\n| [Process Explorer](#/dashboard/f2cbc110-8400-11ee-a3de-f1bc0525ad6c)\\n| [Security log](#/dashboard/51186cd0-e8e9-11e9-9070-f78ae052729a) \\n| [Sysmon summary](#/dashboard/d2c73990-e5d4-11e9-8f1d-73a2ea4cc3ed) \\n| [User Security](#/dashboard/e5f203f0-6182-11ee-b035-d5f231e90733) \\n| [User HR](#/dashboard/618bc5d0-84f8-11ee-9838-ff0db128d8b2)\\n| [ Credential Access logs](#/dashboard/403259b0-42ff-11ef-ad69-a315bc8e9abb)\\n| [ Privilege Access logs](#/dashboard/ff4536e0-439c-11ef-bb7f-8131442929d4)\\n| [ Policy Changes & System Activity](#/dashboard/b9590350-4ad6-11ef-b548-fb0fe2537bf7)\\n| [ Identity access Management](#/dashboard/99145260-4618-11ef-af9e-99159f20f35b)\\n\\n\",\"openLinksInNewTab\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"dec45d9f-11a2-4e39-ae58-4fc7885ce7dd","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMDksMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"4a675166-ce19-4836-9567-eda4ab46b3d5","managed":false,"references":[{"id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","name":"control_0_index_pattern","type":"index-pattern"},{"id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTEsMV0="} -{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"25aa14ff-d525-4751-a29d-290859861006","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - Filter Hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Filter Hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Event count\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"8d476795-134d-4689-9050-a24b57adaa90","managed":false,"references":[{"id":"25aa14ff-d525-4751-a29d-290859861006","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTMsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security - Select Host","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select Host\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588685297382\",\"fieldName\":\"\",\"parent\":\"\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","managed":false,"references":[{"id":"3b4066b6-77d5-404c-a7f7-b30ed6cb5ab0","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTQsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:34:04.109Z","id":"e3f24157-721c-4741-ac8f-8be48c22d612","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:34:04.109Z","version":"WzIwNjksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Logons Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logons Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Logons\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"4eccff45-c97a-480f-b593-4744922893e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTYsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"logs-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"64c636e6-00f6-469a-9315-1b8ae52c344f","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTcsMV0="} -{"attributes":{"fieldAttrs":"{\"host.name\":{\"count\":7},\"process.name\":{\"count\":6},\"winlog.computer_name\":{\"count\":5},\"winlog.event_data.ProcessName\":{\"count\":10},\"source.ip\":{\"count\":3},\"source.port\":{\"count\":3},\"winlog.event_data.IpAddress\":{\"count\":6},\"winlog.event_data.IpPort\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":2},\"process.pid\":{\"count\":1},\"winlog.event_data.ProcessId\":{\"count\":5},\"winlog.event_data.TargetDomainName\":{\"count\":9},\"client.user.domain\":{\"count\":1},\"client.user.name\":{\"count\":1},\"group.domain\":{\"count\":1},\"host.user.domain\":{\"count\":1},\"server.user.domain\":{\"count\":1},\"user.domain\":{\"count\":2},\"winlog.event_data.LogonType\":{\"count\":2},\"winlog.event_data.Status\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.TargetUserName\":{\"count\":3},\"winlog.event_data.WorkstationName\":{\"count\":1},\"winlog.logon.failure.status\":{\"count\":1},\"event.id\":{\"count\":1},\"winlog.event_data.ProcessID\":{\"count\":1},\"process.executable\":{\"count\":2},\"destination.ip\":{\"count\":1},\"destination.port\":{\"count\":1},\"network.transport\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.DestinationIp\":{\"count\":5},\"winlog.event_data.DestinationPort\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":3},\"winlog.event_data.SourcePort\":{\"count\":3},\"winlog.event_data.SourcePortName\":{\"count\":1},\"winlog.event_data.SubjectDomainName\":{\"count\":1},\"winlog.event_data.SubjectUserName\":{\"count\":2},\"winlog.event_data.TargetUser\":{\"count\":2}}","fieldFormatMap":"{\"winver\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"user.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"process.executable\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"host.name\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://elastic-lme.contoso.local\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}}}","fields":"[]","name":"winlogbeat-*","runtimeFieldMap":"{\"day_of_week\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())\"}},\"hour_of_day\":{\"type\":\"long\",\"script\":{\"source\":\"emit (doc['@timestamp'].value.getHour())\"}}}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTgsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human User Logon Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMTksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon attempts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon attempts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Login attempts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"3f7d1f53-6b70-4235-879a-f149d98c9063","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon events over time","uiStateJSON":"{\"vis\":{\"colors\":{\"Failed attempts\":\"#BF1B00\",\"Successful atempts\":\"#629E51\"}}}","version":1,"visState":"{\"title\":\"Security - Logon events over time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":1,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-23T08:41:59.000Z\",\"max\":\"2020-04-23T08:56:59.000Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"event.code:4625\",\"language\":\"lucene\"},\"label\":\"Failed attempts\"},{\"input\":{\"query\":\"event.code:4624\",\"language\":\"lucene\"},\"label\":\"Successful atempts\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15m\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"42ae3f23-386c-4ceb-bb84-98879107338b","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjEsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4,624, 4,625\",\"params\":[\"4624\",\"4625\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}},{\"match_phrase\":{\"event.code\":\"4625\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Computers\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","managed":false,"references":[{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjMsMV0="} -{"attributes":{"columns":["event.code","host.name","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.IpAddress","event.action","event.outcome","winlog.event_data.LogonType"],"description":"","grid":{"columns":{"user.domain":{"width":119},"user.name":{"width":134}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human Logon & Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Network Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Network Connections\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"80b03097-c117-44d0-8413-3c932d0886a2","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjUsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id : \\\"3\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"All network activity ","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"f02a3c3d-eb39-4347-91f7-d62bece13128","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjYsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Activity Line","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Activity Line\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Connections\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Connections\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Connections\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-24T15:29:10.918Z\",\"max\":\"2020-04-24T15:44:10.918Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"aa741894-2140-4529-a488-6d34ed57abef","managed":false,"references":[{"id":"f02a3c3d-eb39-4347-91f7-d62bece13128","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjcsMV0="} -{"attributes":{"columns":["winlog.event_data.DestinationHostname","destination.ip","winlog.event_data.DestinationIsIpv6","network.","process.executable","winlog.event_data.DestinationPort","winlog.event_data.Protocol","winlog.user.name","winlog.user.type","source.ip","winlog.event_data.SourceIsIpv6","source.port","network.protocol"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_non_browsers_connection","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"50b150ad-5aff-4706-9229-d9bcb38255ef","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-23T15:24:04.448Z","version":"WzI1MzksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Process List","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Network Process List\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.DestinationIp\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Destination IP\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":false,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logged on user\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":4,\"direction\":\"asc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"date\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"e45875a5-d1ae-4c92-9683-86392f740aae","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMjksMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network connections area ","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network connections area \",\"type\":\"area\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":false,\"type\":\"terms\",\"params\":{\"field\":\"network.protocol\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"labels\":{},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"48405764-dc21-463c-bef1-3c0da9a0e42a","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Overview - Processes with unusual network activity","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Overview - Processes with unusual network activity\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"params\":{\"field\":\"winlog.event_data.ProcessId\",\"size\":10,\"include\":\"\",\"json\":\"\",\"customLabel\":\"Process\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"string\"},\"params\":{},\"label\":\"Process\",\"aggType\":\"significant_terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzEsMV0="} -{"attributes":{"columns":["host.name","winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{"columns":{"winlog.event_data.SubjectDomainName":{"width":216}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_non_private_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","managed":false,"references":[{"id":"25aa14ff-d525-4751-a29d-290859861006","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Processes Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Processes Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Processes & Powershell\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzMsMV0="} -{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.User","winlog.event_data.ProcessId","winlog.event_data.ProcessName","winlog.event_data.Hashes","process.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawns","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzQsMV0="} -{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.command_line","process.parent.executable","process.parent.command_line","file.path","event.code"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\" OR process.command_line.text:\\\"powershell\\\" OR parent.process.command_line.text:\\\"powershell\\\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_powershell_run","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell Run Count","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Security - Powershell Run Count\",\"type\":\"metric\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzYsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell runs over time","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now/w\",\"to\":\"now/w\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}],\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\"},\"title\":\"Security - Powershell runs over time\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Power shell hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"title\":\"Security - Power shell hosts pie\",\"type\":\"pie\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzgsMV0="} -{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.args","process.parent.executable","process.parent.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND process.command_line.text:(\\\"invoke\\\" or \\\"bypass\\\" or \\\"iex\\\" or \\\"ex\\\" or \\\"icm\\\" or \\\"new-object\\\" or \\\"set\\\" or \\\"get\\\" or \\\"write\\\" or \\\"out\\\" or \\\"download\\\" or \\\"encoded\\\")\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Potentially Suspicious Powershell","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwMzksMV0="} -{"attributes":{"columns":["user.domain","user.name","host.name","destination.domain","destination.ip"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND (process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_powershell_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"04c60a34-98a9-4073-8538-97996e80855f","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDAsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Files title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Files title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Files\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDEsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"file.path.text: \\\"tmp\\\" OR file.path.text:\\\"temp\\\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"file.path\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"exists\":{\"field\":\"file.path\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"TEMP & %TEMP%","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"d3792434-6184-44ed-bad4-830249085d68","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDIsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"TEMP & %TEMP%","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target File\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":30,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Hostname\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"TEMP & %TEMP%\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","managed":false,"references":[{"id":"d3792434-6184-44ed-bad4-830249085d68","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDMsMV0="} -{"attributes":{"columns":["@timestamp","user.domain","user.name","host.name","process.executable","winlog.event_data.ProcessId"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: \\\"9\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Raw Access Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDQsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Windows Defender Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Windows Defender Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Windows Defender\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"a2cdbce1-9070-4851-909f-774a80d2875a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDUsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:(1006 or 1007 or 1008 or 1009 or 1116 or 1117 or 1118 or 1119)\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - AV Events Count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - AV Events Count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Windows AV Events\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"6ac9a9da-1772-483c-8c32-b049f0273186","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDYsMV0="} -{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_id\",\"value\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"params\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"negate\":false,\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_id\":\"1006\"}},{\"match_phrase\":{\"winlog.event_id\":\"1007\"}},{\"match_phrase\":{\"winlog.event_id\":\"1008\"}},{\"match_phrase\":{\"winlog.event_id\":\"1009\"}},{\"match_phrase\":{\"winlog.event_id\":\"1116\"}},{\"match_phrase\":{\"winlog.event_id\":\"1117\"}},{\"match_phrase\":{\"winlog.event_id\":\"1118\"}},{\"match_phrase\":{\"winlog.event_id\":\"1119\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"AV Detection event","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDcsMV0="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"AV Hits (Count)","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"AV Hits (Count)\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"AV Detection hits\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"fe86395f-474e-43a1-a772-34d1306373e0","managed":false,"references":[{"id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDgsMV0="} -{"attributes":{"columns":["winlog.event_data.Detection User","host.name","winlog.event_data.Path","winlog.event_data.FWLink"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: 1116\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"Microsoft-Windows-Windows Defender\"},\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"match_phrase\":{\"event.provider\":{\"query\":\"Microsoft-Windows-Windows Defender\"}}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Defender AV Detections","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-22T21:22:39.376Z","id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","managed":false,"references":[{"id":"64c636e6-00f6-469a-9315-1b8ae52c344f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"04bfaff0-0ab7-4110-83cd-4e3a46766985","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"8.0.0","updated_at":"2024-10-22T21:22:39.376Z","version":"WzIwNDksMV0="} -{"attributes":{"description":"User Security overview, filtered by Domain / Username or hostname","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":48,\"h\":3,\"i\":\"bd9e6265-dae7-493b-88b0-e3dee8508541\"},\"panelIndex\":\"bd9e6265-dae7-493b-88b0-e3dee8508541\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_bd9e6265-dae7-493b-88b0-e3dee8508541\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":3,\"w\":23,\"h\":7,\"i\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},\"panelIndex\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search users\",\"panelRefName\":\"panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},{\"type\":\"visualization\",\"gridData\":{\"x\":23,\"y\":3,\"w\":25,\"h\":7,\"i\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\"},\"panelIndex\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Filter hosts\",\"panelRefName\":\"panel_62ea04ec-0776-46c0-9b8c-cf2915600337\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":10,\"w\":23,\"h\":7,\"i\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\"},\"panelIndex\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search hosts\",\"panelRefName\":\"panel_45ac8571-ae44-4bb5-a237-cd230ede51d5\"},{\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":10,\"w\":25,\"h\":7,\"i\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\"},\"panelIndex\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"e3f24157-721c-4741-ac8f-8be48c22d612\",\"name\":\"indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\",\"isTransposed\":false},{\"columnId\":\"26752485-2aa5-4908-b400-504d6e7ef451\",\"isTransposed\":false},{\"columnId\":\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"layerType\":\"data\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d123adeb-fd39-4176-b3c9-69c88d2852d5\":{\"columns\":{\"6f33ff19-9959-4c43-b791-939582a0b3d2\":{\"label\":\"Event Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"26752485-2aa5-4908-b400-504d6e7ef451\":{\"label\":\"Filters\",\"dataType\":\"string\",\"operationType\":\"filters\",\"scale\":\"ordinal\",\"isBucketed\":true,\"params\":{\"filters\":[{\"label\":\"\",\"input\":{\"query\":\"\\\"log\\\" : *\",\"language\":\"kuery\"}}]}},\"cc4e45f6-be3a-4de0-a416-e21043b601bb\":{\"label\":\"Top 3 values of user.domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"user.domain\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"26752485-2aa5-4908-b400-504d6e7ef451\",\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"6f33ff19-9959-4c43-b791-939582a0b3d2\"],\"sampling\":1,\"indexPatternId\":\"a2ce5204-8ea0-4af2-a2d7-daf564ce2841\",\"incompleteColumns\":{}}},\"currentIndexPatternId\":\"a2ce5204-8ea0-4af2-a2d7-daf564ce2841\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter users\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":17,\"w\":48,\"h\":4,\"i\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},\"panelIndex\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":9,\"h\":7,\"i\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\"},\"panelIndex\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_e5de9fc4-5863-470c-8246-0a86f5af897e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":9,\"y\":21,\"w\":20,\"h\":14,\"i\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},\"panelIndex\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logon attempts\",\"panelRefName\":\"panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},{\"type\":\"visualization\",\"gridData\":{\"x\":29,\"y\":21,\"w\":19,\"h\":14,\"i\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},\"panelIndex\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logged on computers\",\"panelRefName\":\"panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":28,\"w\":9,\"h\":7,\"i\":\"0d1c0533-598a-4304-80be-c22047edcbe1\"},\"panelIndex\":\"0d1c0533-598a-4304-80be-c22047edcbe1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0d1c0533-598a-4304-80be-c22047edcbe1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":17,\"i\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},\"panelIndex\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User Logon & Logoff Events\",\"panelRefName\":\"panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":52,\"w\":48,\"h\":4,\"i\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\"},\"panelIndex\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0fab3d76-5411-46e4-982f-4d4626c977b8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":56,\"w\":48,\"h\":14,\"i\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},\"panelIndex\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"All network connections\",\"panelRefName\":\"panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":70,\"w\":24,\"h\":15,\"i\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},\"panelIndex\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}},\"enhancements\":{}},\"title\":\"Network connections from non-browser processes\",\"panelRefName\":\"panel_f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":70,\"w\":24,\"h\":15,\"i\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},\"panelIndex\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network connection by protocol\",\"panelRefName\":\"panel_6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":85,\"w\":48,\"h\":15,\"i\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},\"panelIndex\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Unusual network connections from non-browser processes\",\"panelRefName\":\"panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":100,\"w\":48,\"h\":10,\"i\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\"},\"panelIndex\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network Connection Events (Sysmon ID 3)\",\"panelRefName\":\"panel_ea6ad677-7322-4c5c-8946-cac4dd983b26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":110,\"w\":48,\"h\":4,\"i\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\"},\"panelIndex\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_43b61744-5553-4fd1-894c-6e91a799f4a2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":114,\"w\":48,\"h\":14,\"i\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\"},\"panelIndex\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Spawned Processes\",\"panelRefName\":\"panel_9a522603-8d31-4ad6-ac4f-130a814f54fa\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":128,\"w\":10,\"h\":15,\"i\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},\"panelIndex\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell Events\",\"panelRefName\":\"panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":10,\"y\":128,\"w\":20,\"h\":15,\"i\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},\"panelIndex\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events over time\",\"panelRefName\":\"panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":30,\"y\":128,\"w\":18,\"h\":15,\"i\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\"},\"panelIndex\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events by computer\",\"panelRefName\":\"panel_ed7a59ea-caa7-4396-89b7-90c6b8363800\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":143,\"w\":25,\"h\":16,\"i\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},\"panelIndex\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Potentially suspicious powershell\",\"panelRefName\":\"panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},{\"type\":\"search\",\"gridData\":{\"x\":25,\"y\":143,\"w\":23,\"h\":16,\"i\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\"},\"panelIndex\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell network connections\",\"panelRefName\":\"panel_9587ef7f-3554-4886-be6a-fae4648e87dd\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":159,\"w\":48,\"h\":4,\"i\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},\"panelIndex\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":163,\"w\":24,\"h\":15,\"i\":\"4988f659-a275-4317-b071-8a350087a4e6\"},\"panelIndex\":\"4988f659-a275-4317-b071-8a350087a4e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"References to temporary files\",\"panelRefName\":\"panel_4988f659-a275-4317-b071-8a350087a4e6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":163,\"w\":24,\"h\":15,\"i\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},\"panelIndex\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"RawAccessRead (Sysmon Event 9)\",\"panelRefName\":\"panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":178,\"w\":48,\"h\":4,\"i\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},\"panelIndex\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":182,\"w\":12,\"h\":14,\"i\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},\"panelIndex\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Defender event count\",\"panelRefName\":\"panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},{\"type\":\"visualization\",\"gridData\":{\"x\":12,\"y\":182,\"w\":12,\"h\":14,\"i\":\"30454a55-0210-43d2-af3d-822c5b519033\"},\"panelIndex\":\"30454a55-0210-43d2-af3d-822c5b519033\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_30454a55-0210-43d2-af3d-822c5b519033\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":182,\"w\":24,\"h\":14,\"i\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"},\"panelIndex\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"AV Detections (Event 1116)\",\"panelRefName\":\"panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"}]","timeRestore":false,"title":"User Security 2.0","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-10-23T15:24:54.858Z","id":"2fc36188-8461-4927-932e-0e452b7dc3ac","managed":false,"references":[{"id":"dec45d9f-11a2-4e39-ae58-4fc7885ce7dd","name":"bd9e6265-dae7-493b-88b0-e3dee8508541:panel_bd9e6265-dae7-493b-88b0-e3dee8508541","type":"visualization"},{"id":"4a675166-ce19-4836-9567-eda4ab46b3d5","name":"956d6ef1-5d6b-4ccc-a123-fa66805c15db:panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db","type":"visualization"},{"id":"8d476795-134d-4689-9050-a24b57adaa90","name":"62ea04ec-0776-46c0-9b8c-cf2915600337:panel_62ea04ec-0776-46c0-9b8c-cf2915600337","type":"visualization"},{"id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","name":"45ac8571-ae44-4bb5-a237-cd230ede51d5:panel_45ac8571-ae44-4bb5-a237-cd230ede51d5","type":"visualization"},{"id":"e3f24157-721c-4741-ac8f-8be48c22d612","name":"1324f39e-f215-45e9-b679-05b06e4fcb9d:indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5","type":"index-pattern"},{"id":"4eccff45-c97a-480f-b593-4744922893e5","name":"b453a1df-c025-430b-84e3-d6dc7a8c48f1:panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1","type":"visualization"},{"id":"3f7d1f53-6b70-4235-879a-f149d98c9063","name":"e5de9fc4-5863-470c-8246-0a86f5af897e:panel_e5de9fc4-5863-470c-8246-0a86f5af897e","type":"visualization"},{"id":"42ae3f23-386c-4ceb-bb84-98879107338b","name":"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48:panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48","type":"visualization"},{"id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","name":"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2:panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2","type":"visualization"},{"id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","name":"0d1c0533-598a-4304-80be-c22047edcbe1:panel_0d1c0533-598a-4304-80be-c22047edcbe1","type":"visualization"},{"id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","name":"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396:panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396","type":"search"},{"id":"80b03097-c117-44d0-8413-3c932d0886a2","name":"0fab3d76-5411-46e4-982f-4d4626c977b8:panel_0fab3d76-5411-46e4-982f-4d4626c977b8","type":"visualization"},{"id":"aa741894-2140-4529-a488-6d34ed57abef","name":"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305:panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305","type":"visualization"},{"id":"e45875a5-d1ae-4c92-9683-86392f740aae","name":"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c:panel_f068f3e0-1c90-4f9d-93ca-a7e7c96df39c","type":"visualization"},{"id":"48405764-dc21-463c-bef1-3c0da9a0e42a","name":"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b:panel_6da7d5e7-a679-42d4-b2f7-bb3c958ab16b","type":"visualization"},{"id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","name":"6d5d4b74-133b-4fef-8ae5-14d2e7037a78:panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78","type":"visualization"},{"id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","name":"ea6ad677-7322-4c5c-8946-cac4dd983b26:panel_ea6ad677-7322-4c5c-8946-cac4dd983b26","type":"search"},{"id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","name":"43b61744-5553-4fd1-894c-6e91a799f4a2:panel_43b61744-5553-4fd1-894c-6e91a799f4a2","type":"visualization"},{"id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","name":"9a522603-8d31-4ad6-ac4f-130a814f54fa:panel_9a522603-8d31-4ad6-ac4f-130a814f54fa","type":"search"},{"id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","name":"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6:panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6","type":"visualization"},{"id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","name":"68d75f76-3806-4d15-81e9-d0dcfa34c9b9:panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9","type":"visualization"},{"id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","name":"ed7a59ea-caa7-4396-89b7-90c6b8363800:panel_ed7a59ea-caa7-4396-89b7-90c6b8363800","type":"visualization"},{"id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","name":"cfe390f9-80a7-4a11-9a8c-7d599e41e38a:panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a","type":"search"},{"id":"04c60a34-98a9-4073-8538-97996e80855f","name":"9587ef7f-3554-4886-be6a-fae4648e87dd:panel_9587ef7f-3554-4886-be6a-fae4648e87dd","type":"search"},{"id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","name":"7cfff19f-bf9d-4101-be63-4d9b8ea78e26:panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26","type":"visualization"},{"id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","name":"4988f659-a275-4317-b071-8a350087a4e6:panel_4988f659-a275-4317-b071-8a350087a4e6","type":"visualization"},{"id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","name":"bfae12f4-b2fd-471f-a111-daf49cd25ed3:panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3","type":"search"},{"id":"a2cdbce1-9070-4851-909f-774a80d2875a","name":"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b:panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b","type":"visualization"},{"id":"6ac9a9da-1772-483c-8c32-b049f0273186","name":"e8c5ac63-42b4-4081-85e3-378c85c0b4cb:panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb","type":"visualization"},{"id":"fe86395f-474e-43a1-a772-34d1306373e0","name":"30454a55-0210-43d2-af3d-822c5b519033:panel_30454a55-0210-43d2-af3d-822c5b519033","type":"visualization"},{"id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","name":"6ff4d4db-16b6-4c80-8bb6-95e009803d1d:panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d","type":"search"}],"type":"dashboard","typeMigrationVersion":"8.9.0","updated_at":"2024-10-23T15:24:54.858Z","version":"WzI1NDIsMV0="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":42,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - MITRE Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - MITRE Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### MITRE ATT&CK Technique\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"63587a03-5f00-4678-b1fa-99b31a719c25","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OSwxXQ=="} +{"attributes":{"allowHidden":false,"allowNoIndex":true,"fieldAttrs":"{\"event.action\":{\"count\":2},\"process.name\":{\"count\":1},\"user.name\":{\"count\":1},\"winlog.event_data.KeyFilePath\":{\"count\":2},\"file.path\":{\"count\":1},\"event.code\":{\"count\":1},\"event.provider\":{\"count\":1}}","fieldFormatMap":"{}","fields":"[]","name":"logs-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"logs-*"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:37.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"logs-*","managed":true,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:37.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzEzNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"high\\\" or signal.rule.severity : \\\"critical\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Critical Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"133f677c-628d-4684-af5f-0c906e4101cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Mitre Technique Table2","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Mitre Technique Table2\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"MITRE ID\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.reference\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Reference\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":true,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1993dc60-efe8-46ec-952d-cc4d513cee72","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(signal.rule.severity : \\\"medium\\\" or signal.rule.severity : \\\"low\\\") and signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Suspicious Alerts","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Signals Overview","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signals Overview\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Suspicious Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","managed":false,"references":[{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Signal guage","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Signal guage\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signal Gauge\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Signals Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Signals Overview\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Signals Data Table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Signals Data Table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":105,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Rule Name\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.tactic.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":500,\"otherBucket\":false,\"otherBucketLabel\":\"Uncatergorised\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Tactic\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.severity\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Severity\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.threat.technique.name\",\"orderBy\":\"_key\",\"order\":\"desc\",\"size\":11,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Uncatergorised\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Technique\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Rule Name\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Uncatergorised\",\"otherBucketLabel\":\"Uncatergorised\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Tactic\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Severity\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\",\"parsedUrl\":{\"basePath\":\"\",\"origin\":\"\",\"pathname\":\"/app/kibana\"}}},\"label\":\"Technique\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":true,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"Alerting - Signals Details","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Signals Details\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"### Signals Details \\n[View alerts dashboard](/app/security/alerts)\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alerting - Further Signals Info","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Alerting - Further Signals Info\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"signal.rule.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":250,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\".\"},\"schema\":\"split\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"event.created\",\"timeRange\":{\"from\":\"now-24h\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30m\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No host data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Hostname\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No User Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No Data\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"1\"},\"schema\":\"bucket\"},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column2\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"2\"},\"schema\":\"bucket\"},{\"id\":\"8\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"Column3\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"json\":\"\",\"customLabel\":\"3\"},\"schema\":\"bucket\"}],\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":1,\"aggType\":\"date_histogram\",\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm\"}},\"label\":\"event.created per 30 minutes\",\"params\":{}},{\"accessor\":2,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No host data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"Hostname\",\"params\":{}},{\"accessor\":3,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No User Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"User\",\"params\":{}},{\"accessor\":4,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"No Data\",\"otherBucketLabel\":\"Other\"}},\"label\":\"1\",\"params\":{}},{\"accessor\":5,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"2\",\"params\":{}},{\"accessor\":6,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\"3\",\"params\":{}}],\"metrics\":[{\"accessor\":7,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"label\":\"Count\",\"params\":{}}],\"splitRow\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"label\":\".\",\"params\":{}}]},\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\",\"row\":true,\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Alerting - Event Log Label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alerting - Event Log Label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### Full Event Logs\",\"openLinksInNewTab\":false,\"fontSize\":12}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE4OSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"signal.status : \\\"open\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Alerting - Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MCwxXQ=="} +{"attributes":{"color":"#e5e289","description":"Logging Made Easy Custom Dashboards","name":"Logging Made Easy"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"05484269-a438-43a1-8114-4f32479f51c4","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2MywxXQ=="} +{"attributes":{"description":"Alerting Overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":false,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":true}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":28,\"i\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},\"panelIndex\":\"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":0,\"w\":10,\"h\":4,\"i\":\"02fa17ed-1419-415c-9a27-f90684d5645f\"},\"panelIndex\":\"02fa17ed-1419-415c-9a27-f90684d5645f\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Critical Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":0,\"w\":27,\"h\":5,\"i\":\"3832099d-1166-44f0-a766-270f65ae20c3\"},\"panelIndex\":\"3832099d-1166-44f0-a766-270f65ae20c3\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_3832099d-1166-44f0-a766-270f65ae20c3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":11,\"y\":4,\"w\":10,\"h\":21,\"i\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\"},\"panelIndex\":\"33d73051-f4d8-4ca0-826c-3d7060fa75da\",\"embeddableConfig\":{\"savedVis\":{\"title\":\"\",\"description\":\"\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"Labels\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":1},{\"type\":\"range\",\"from\":1,\"to\":20000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":true,\"subText\":\"\",\"fontSize\":120}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"uiState\":{},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Critical Signals\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"enhancements\":{},\"hidePanelTitles\":false,\"description\":\"This panel shows critical signals\"},\"title\":\"Signals Overview\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":5,\"w\":27,\"h\":17,\"i\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},\"panelIndex\":\"2ab0a53c-c5c7-4116-afff-e0d119aeefa9\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":28,\"w\":11,\"h\":4,\"i\":\"8459632e-bab5-491a-aad4-d40a09d9589e\"},\"panelIndex\":\"8459632e-bab5-491a-aad4-d40a09d9589e\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":true,\"markdown\":\"### Suspicious Signal Overview\"},\"uiState\":{},\"data\":{\"aggs\":[],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":32,\"w\":11,\"h\":21,\"i\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\"},\"panelIndex\":\"543e736d-1e0e-4096-a02d-a00b7a145ad8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_543e736d-1e0e-4096-a02d-a00b7a145ad8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":22,\"w\":27,\"h\":4,\"i\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\"},\"panelIndex\":\"1688fd32-5aa8-4358-8587-d46f4e11613e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_1688fd32-5aa8-4358-8587-d46f4e11613e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":21,\"y\":26,\"w\":27,\"h\":25,\"i\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\"},\"panelIndex\":\"739bc01e-ec0f-4565-92e3-1af95510fc60\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"\",\"description\":\"\",\"type\":\"gauge\",\"params\":{\"type\":\"gauge\",\"addTooltip\":true,\"addLegend\":true,\"isDisplayWarning\":false,\"gauge\":{\"alignment\":\"automatic\",\"extendRange\":true,\"percentageMode\":false,\"gaugeType\":\"Arc\",\"gaugeStyle\":\"Full\",\"backStyle\":\"Full\",\"orientation\":\"vertical\",\"colorSchema\":\"Green to Red\",\"gaugeColorMode\":\"Labels\",\"colorsRange\":[{\"from\":0,\"to\":50},{\"from\":50,\"to\":75},{\"from\":75,\"to\":100}],\"invertColors\":false,\"labels\":{\"show\":true,\"color\":\"black\"},\"scale\":{\"show\":true,\"labels\":false,\"color\":\"rgba(105,112,125,0.2)\"},\"type\":\"meter\",\"style\":{\"bgWidth\":0.9,\"width\":0.9,\"mask\":false,\"bgMask\":false,\"maskBars\":50,\"bgFill\":\"rgba(105,112,125,0.2)\",\"bgColor\":true,\"subText\":\"\",\"fontSize\":60}}},\"uiState\":{\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"}}},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"}],\"searchSource\":{}}},\"hidePanelTitles\":false,\"enhancements\":{},\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(0,104,55)\",\"50 - 75\":\"rgb(254,254,189)\",\"75 - 100\":\"rgb(165,0,38)\"},\"legendOpen\":false}},\"title\":\"Alert Gauge\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":53,\"w\":21,\"h\":5,\"i\":\"93136da7-3849-4932-92f2-a443350636f2\"},\"panelIndex\":\"93136da7-3849-4932-92f2-a443350636f2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_93136da7-3849-4932-92f2-a443350636f2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":58,\"w\":21,\"h\":17,\"i\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\"},\"panelIndex\":\"aa385ced-e59f-4096-8b49-ad0014c0087c\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_aa385ced-e59f-4096-8b49-ad0014c0087c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":75,\"w\":48,\"h\":8,\"i\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},\"panelIndex\":\"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":83,\"w\":48,\"h\":21,\"i\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\"},\"panelIndex\":\"a7f758eb-65c6-4202-86a3-b8b4a169845c\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"asc\"}}},\"enhancements\":{}},\"panelRefName\":\"panel_a7f758eb-65c6-4202-86a3-b8b4a169845c\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":104,\"w\":48,\"h\":6,\"i\":\"25f49696-70e2-472e-9992-287665c7db7d\"},\"panelIndex\":\"25f49696-70e2-472e-9992-287665c7db7d\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_25f49696-70e2-472e-9992-287665c7db7d\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":110,\"w\":48,\"h\":28,\"i\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\"},\"panelIndex\":\"38cb573e-5533-48f8-874d-5cfd5929d68a\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"panelRefName\":\"panel_38cb573e-5533-48f8-874d-5cfd5929d68a\"}]","refreshInterval":{"pause":true,"value":0},"timeFrom":"now-7d/d","timeRestore":true,"timeTo":"now","title":"Alerting Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"baa4f981-0c75-43da-b96e-1107f171dfaa","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0:panel_53bdc61b-f1bd-42f1-9cb4-09c0ed6f9fe0","type":"links"},{"id":"63587a03-5f00-4678-b1fa-99b31a719c25","name":"3832099d-1166-44f0-a766-270f65ae20c3:panel_3832099d-1166-44f0-a766-270f65ae20c3","type":"visualization"},{"id":"133f677c-628d-4684-af5f-0c906e4101cb","name":"33d73051-f4d8-4ca0-826c-3d7060fa75da:search_0","type":"search"},{"id":"1993dc60-efe8-46ec-952d-cc4d513cee72","name":"2ab0a53c-c5c7-4116-afff-e0d119aeefa9:panel_2ab0a53c-c5c7-4116-afff-e0d119aeefa9","type":"visualization"},{"id":"66d751dd-4051-465c-9c5f-3252dd85cbd1","name":"543e736d-1e0e-4096-a02d-a00b7a145ad8:panel_543e736d-1e0e-4096-a02d-a00b7a145ad8","type":"visualization"},{"id":"7407079c-8feb-4f50-a0e3-cfe0fef09e19","name":"1688fd32-5aa8-4358-8587-d46f4e11613e:panel_1688fd32-5aa8-4358-8587-d46f4e11613e","type":"visualization"},{"id":"b204db6d-2cd3-44b0-b9bc-a9bbb4fa2911","name":"739bc01e-ec0f-4565-92e3-1af95510fc60:search_0","type":"search"},{"id":"1bd7cab0-9cb3-4f37-a632-fbae52c385c1","name":"93136da7-3849-4932-92f2-a443350636f2:panel_93136da7-3849-4932-92f2-a443350636f2","type":"visualization"},{"id":"69c44acb-86b7-4f08-bdb7-3d08a33bfe6b","name":"aa385ced-e59f-4096-8b49-ad0014c0087c:panel_aa385ced-e59f-4096-8b49-ad0014c0087c","type":"visualization"},{"id":"d5ed4f70-63e2-49d3-be4a-9cf47bb7338a","name":"94c57cf9-5c91-4c27-a1a2-176e1d3bc30b:panel_94c57cf9-5c91-4c27-a1a2-176e1d3bc30b","type":"visualization"},{"id":"6ed4d268-cda2-42fd-924d-bd3ece3b1567","name":"a7f758eb-65c6-4202-86a3-b8b4a169845c:panel_a7f758eb-65c6-4202-86a3-b8b4a169845c","type":"visualization"},{"id":"e1bfbf21-9bf1-4fe4-a681-9f85d06ea160","name":"25f49696-70e2-472e-9992-287665c7db7d:panel_25f49696-70e2-472e-9992-287665c7db7d","type":"visualization"},{"id":"b77c6f05-6a0b-48c6-9df1-7140f33379f0","name":"38cb573e-5533-48f8-874d-5cfd5929d68a:panel_38cb573e-5533-48f8-874d-5cfd5929d68a","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_host_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_chc_host_count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"vis_chc_filter_hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_filter_hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Events\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"Host name\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ae4d4888-b29b-459a-a369-ece810d70325","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{}"},"title":"title_chc_software","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"title_chc_software\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Software\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"65c534a3-beee-4140-83ef-d511662e9ffa","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.param1","winlog.event_data.param11","winlog.event_data.param12","winlog.provider_name"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1000 or event.code:1002\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_proc_crash","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6c264739-59d8-4fd3-af36-27332178d08f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_proc_crashes","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_proc_crashes\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"0ms\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{},\"customLabel\":\"Date\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"interpolate\":\"linear\",\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_chc_crash_table","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_chc_crash_table\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user_data.param1\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Application\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"winlog.event_data.param1: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3cf72536-3546-4c88-9b4b-46cede29474f","managed":false,"references":[{"id":"6c264739-59d8-4fd3-af36-27332178d08f","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5NywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SourceImage","winlog.event_data.TargetImage"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:8 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_chc_create_remote_thread","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OCwxXQ=="} +{"attributes":{"description":"Shows software running on hosts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":21,\"i\":\"23406828-78ea-414f-b7eb-b1c76db1a992\"},\"panelIndex\":\"23406828-78ea-414f-b7eb-b1c76db1a992\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_23406828-78ea-414f-b7eb-b1c76db1a992\"},{\"type\":\"visualization\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":21,\"i\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\"},\"panelIndex\":\"67acd3d3-1fe1-4027-8e0d-17369b15986f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Host Count\",\"panelRefName\":\"panel_67acd3d3-1fe1-4027-8e0d-17369b15986f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":21,\"i\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\"},\"panelIndex\":\"bde0ab63-0219-412e-90b3-029fc58aa2df\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Filter Hosts\",\"panelRefName\":\"panel_bde0ab63-0219-412e-90b3-029fc58aa2df\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":4,\"i\":\"974eebf8-3870-403f-b4b8-0151e57408e1\"},\"panelIndex\":\"974eebf8-3870-403f-b4b8-0151e57408e1\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":true},\"panelRefName\":\"panel_974eebf8-3870-403f-b4b8-0151e57408e1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":25,\"w\":24,\"h\":15,\"i\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},\"panelIndex\":\"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging\",\"panelRefName\":\"panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":25,\"w\":24,\"h\":15,\"i\":\"06f203bf-d632-4f1a-b024-67ec7373873b\"},\"panelIndex\":\"06f203bf-d632-4f1a-b024-67ec7373873b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Application Crashing and Hanging Count\",\"panelRefName\":\"panel_06f203bf-d632-4f1a-b024-67ec7373873b\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":56,\"w\":48,\"h\":15,\"i\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},\"panelIndex\":\"9f671b0e-5ffb-46b6-af00-9dbc4d241121\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"CreateRemoteThread events\",\"panelRefName\":\"panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":16,\"i\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\"},\"panelIndex\":\"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273\"}],\"state\":{\"visualization\":{\"layerId\":\"f9c66ef1-e443-4a34-950c-5c9556714273\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"isTransposed\":false,\"isMetric\":false},{\"isTransposed\":false,\"columnId\":\"1b266c97-5508-45bb-bb55-40f392f3de3c\"},{\"isTransposed\":false,\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"}]},\"query\":{\"query\":\"event.code: \\\"1\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f9c66ef1-e443-4a34-950c-5c9556714273\":{\"columns\":{\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":100,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1b266c97-5508-45bb-bb55-40f392f3de3c\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"4cb11f91-8dcf-4ee5-a005-0b42853be15e\",\"1b266c97-5508-45bb-bb55-40f392f3de3c\",\"aa9ded8f-6f2d-4a4e-a640-a5b51aea2478\"],\"sampling\":1,\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Processes\"}]","timeRestore":false,"title":"Computer Software Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"23406828-78ea-414f-b7eb-b1c76db1a992:panel_23406828-78ea-414f-b7eb-b1c76db1a992","type":"links"},{"id":"57f79cfd-58f7-47c7-b4cd-bf33161ace99","name":"67acd3d3-1fe1-4027-8e0d-17369b15986f:panel_67acd3d3-1fe1-4027-8e0d-17369b15986f","type":"visualization"},{"id":"ae4d4888-b29b-459a-a369-ece810d70325","name":"bde0ab63-0219-412e-90b3-029fc58aa2df:panel_bde0ab63-0219-412e-90b3-029fc58aa2df","type":"visualization"},{"id":"65c534a3-beee-4140-83ef-d511662e9ffa","name":"974eebf8-3870-403f-b4b8-0151e57408e1:panel_974eebf8-3870-403f-b4b8-0151e57408e1","type":"visualization"},{"id":"f34d26a2-3c15-4f4d-9efe-bec6cef0dd08","name":"51ceeb3b-ee9e-430d-9dfd-bc6f6125631f:panel_51ceeb3b-ee9e-430d-9dfd-bc6f6125631f","type":"visualization"},{"id":"3cf72536-3546-4c88-9b4b-46cede29474f","name":"06f203bf-d632-4f1a-b024-67ec7373873b:panel_06f203bf-d632-4f1a-b024-67ec7373873b","type":"visualization"},{"id":"8253ae95-f7f1-4bbf-a97e-265a5991a9a1","name":"9f671b0e-5ffb-46b6-af00-9dbc4d241121:panel_9f671b0e-5ffb-46b6-af00-9dbc4d241121","type":"search"},{"id":"logs-*","name":"b6527795-2d8f-4a80-a0a7-f6e1ab07aa5f:indexpattern-datasource-layer-f9c66ef1-e443-4a34-950c-5c9556714273","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE5OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1bb35497-6257-4b29-95fa-579306bda91a\"},\"panelIndex\":\"1bb35497-6257-4b29-95fa-579306bda91a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1bb35497-6257-4b29-95fa-579306bda91a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\"},\"panelIndex\":\"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2\",\"embeddableConfig\":{\"enhancements\":{},\"attributes\":{\"title\":\"Audit logons\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b\"}],\"state\":{\"visualization\":{\"layers\":[{\"categoryDisplay\":\"default\",\"layerId\":\"9da2d10b-4d81-4f9b-abbc-d950139a209b\",\"layerType\":\"data\",\"legendDisplay\":\"default\",\"metrics\":[\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"nestedLegend\":false,\"numberDisplay\":\"percent\",\"primaryGroups\":[\"2609b197-b493-4da4-9526-21b71512702a\"]}],\"shape\":\"donut\"},\"query\":{\"language\":\"kuery\",\"query\":\"4624\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9da2d10b-4d81-4f9b-abbc-d950139a209b\":{\"columnOrder\":[\"2609b197-b493-4da4-9526-21b71512702a\",\"ca9653b4-9247-4c13-98e0-beeb95821de0\"],\"columns\":{\"2609b197-b493-4da4-9526-21b71512702a\":{\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"Top 5 values of host.name\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"ca9653b4-9247-4c13-98e0-beeb95821de0\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"host.name\"},\"ca9653b4-9247-4c13-98e0-beeb95821de0\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"}},\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":15,\"i\":\"6c884475-eba9-42bb-bcb7-145a5be31420\"},\"panelIndex\":\"6c884475-eba9-42bb-bcb7-145a5be31420\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos ticket - Failed attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"a40bb6e7-f754-425d-92c6-f94e9601af3c\",\"seriesType\":\"line\",\"xAccessor\":\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"splitAccessor\":\"fa882916-213f-40d3-b79e-216a43c16a72\",\"accessors\":[\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4769\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a40bb6e7-f754-425d-92c6-f94e9601af3c\":{\"columns\":{\"fa882916-213f-40d3-b79e-216a43c16a72\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"cb6cedeb-8521-4443-8bbc-c372817d75d7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fa882916-213f-40d3-b79e-216a43c16a72\",\"cb6cedeb-8521-4443-8bbc-c372817d75d7\",\"5699f8d8-8790-4583-a01e-ec86b36ae0dd\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":15,\"w\":24,\"h\":7,\"i\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\"},\"panelIndex\":\"62e638ae-d23f-47dd-834b-bdcb2902f527\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Account lockout -attempts\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1\"}],\"state\":{\"visualization\":{\"layerId\":\"42d33e36-7a47-4658-9792-5eff5f4918d1\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"ee31adc4-0bbd-40e0-86de-df6578c560b9\"},{\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4625\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"42d33e36-7a47-4658-9792-5eff5f4918d1\":{\"columns\":{\"ee31adc4-0bbd-40e0-86de-df6578c560b9\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ee31adc4-0bbd-40e0-86de-df6578c560b9\",\"f6a0659c-1196-4cd2-ae9e-682cf372cd1f\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":7,\"i\":\"17865857-b6e0-4e72-bf28-44b64f154df7\"},\"panelIndex\":\"17865857-b6e0-4e72-bf28-44b64f154df7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Special logon-attempts\",\"description\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707\"}],\"state\":{\"visualization\":{\"layerId\":\"67cdda05-ae7c-41b9-8a85-1e49828e9707\",\"layerType\":\"data\",\"metricAccessor\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\",\"breakdownByAccessor\":\"83a5ad17-791e-4869-bbb3-1a7465716837\"},\"query\":{\"language\":\"kuery\",\"query\":\"4672\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67cdda05-ae7c-41b9-8a85-1e49828e9707\":{\"columns\":{\"83a5ad17-791e-4869-bbb3-1a7465716837\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"83a5ad17-791e-4869-bbb3-1a7465716837\",\"6fc7ee36-f2f1-44a2-9119-dcb780f0cb96\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":22,\"w\":24,\"h\":12,\"i\":\"face26df-a171-4753-8cda-79dea7b83ab6\"},\"panelIndex\":\"face26df-a171-4753-8cda-79dea7b83ab6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Kerberos auth request\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"d29fda24-60a4-4ddd-bf19-67175ef85af2\",\"primaryGroups\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\"],\"metrics\":[\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"default\",\"legendDisplay\":\"default\",\"nestedLegend\":false,\"layerType\":\"data\"}]},\"query\":{\"query\":\"4768\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d29fda24-60a4-4ddd-bf19-67175ef85af2\":{\"columns\":{\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a20bff59-6317-4758-ab4f-0bec099cd004\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"a20bff59-6317-4758-ab4f-0bec099cd004\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc7d79ea-049f-405b-8f56-6acd9cb796e1\",\"a20bff59-6317-4758-ab4f-0bec099cd004\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":24,\"h\":12,\"i\":\"29494e18-b33e-457b-9a07-664463eaf1e6\"},\"panelIndex\":\"29494e18-b33e-457b-9a07-664463eaf1e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Other logon /logoff-Disconnection attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"splitAccessor\":\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"accessors\":[\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4779\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"acbe60a2-c4c3-45be-aa7b-ec7d5845c317\":{\"columns\":{\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"3d892de1-e1ef-4ec5-ac6f-0909b921bcf2\",\"f0e3a655-e9e0-4cce-aaaa-66ceb9d736b4\",\"18e6b925-e3bc-4f01-b5b3-e1b2f287d034\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":34,\"w\":24,\"h\":15,\"i\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\"},\"panelIndex\":\"f2c86900-93cc-4480-bd84-f63f0cb0ac79\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Credential validation- attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"79c23cfd-619e-4bc7-bbca-d2564165f04b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"splitAccessor\":\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"accessors\":[\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4776\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"79c23cfd-619e-4bc7-bbca-d2564165f04b\":{\"columns\":{\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c4de01ed-8a99-4230-9cc5-6889447a60b6\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a016fc9c-abf7-4fc3-ba16-6252ea45461f\",\"c4de01ed-8a99-4230-9cc5-6889447a60b6\",\"b97c8683-dc1f-4648-b58f-3f8f5a96a56c\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":24,\"h\":15,\"i\":\"b819c130-6164-41e4-8188-984964e44e39\"},\"panelIndex\":\"b819c130-6164-41e4-8188-984964e44e39\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon attempts by hosts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_horizontal_stacked\",\"layers\":[{\"layerId\":\"d8138ff4-5996-4544-9b28-98739cc15747\",\"seriesType\":\"bar_horizontal_stacked\",\"xAccessor\":\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"accessors\":[\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4624\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d8138ff4-5996-4544-9b28-98739cc15747\":{\"columns\":{\"d0dd77ee-78c7-457b-ad0d-ebe327215549\":{\"label\":\" host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"d0dd77ee-78c7-457b-ad0d-ebe327215549\",\"42a50868-2f28-4bb5-be55-e8eaf790c7b4\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":55,\"w\":24,\"h\":15,\"i\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\"},\"panelIndex\":\"0d81bae9-3b04-4344-98f0-49202a2258ce\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Logon-using explicit credential attempts\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"accessors\":[\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\",\"color\":\"#6092c0\"}]}]},\"query\":{\"query\":\"4648\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c65a658d-4007-4b5f-88b8-6a139aa1e32b\":{\"columns\":{\"c19cba52-bfca-46e4-9ff9-e46579e4d378\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"},\"orderDirection\":\"asc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"c19cba52-bfca-46e4-9ff9-e46579e4d378\",\"a7cae77b-157b-4acb-bb70-a5ee8ccf0050\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}}]","timeRestore":false,"title":"Credential Access logs Dashboard 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e4d7b207-99aa-4410-8a2e-03487222bda1","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1bb35497-6257-4b29-95fa-579306bda91a:panel_1bb35497-6257-4b29-95fa-579306bda91a","type":"links"},{"id":"logs-*","name":"8dbb9a1a-2c28-41d5-bddf-24e8bda1e4e2:indexpattern-datasource-layer-9da2d10b-4d81-4f9b-abbc-d950139a209b","type":"index-pattern"},{"id":"logs-*","name":"6c884475-eba9-42bb-bcb7-145a5be31420:indexpattern-datasource-layer-a40bb6e7-f754-425d-92c6-f94e9601af3c","type":"index-pattern"},{"id":"logs-*","name":"62e638ae-d23f-47dd-834b-bdcb2902f527:indexpattern-datasource-layer-42d33e36-7a47-4658-9792-5eff5f4918d1","type":"index-pattern"},{"id":"logs-*","name":"17865857-b6e0-4e72-bf28-44b64f154df7:indexpattern-datasource-layer-67cdda05-ae7c-41b9-8a85-1e49828e9707","type":"index-pattern"},{"id":"logs-*","name":"face26df-a171-4753-8cda-79dea7b83ab6:indexpattern-datasource-layer-d29fda24-60a4-4ddd-bf19-67175ef85af2","type":"index-pattern"},{"id":"logs-*","name":"29494e18-b33e-457b-9a07-664463eaf1e6:indexpattern-datasource-layer-acbe60a2-c4c3-45be-aa7b-ec7d5845c317","type":"index-pattern"},{"id":"logs-*","name":"f2c86900-93cc-4480-bd84-f63f0cb0ac79:indexpattern-datasource-layer-79c23cfd-619e-4bc7-bbca-d2564165f04b","type":"index-pattern"},{"id":"logs-*","name":"b819c130-6164-41e4-8188-984964e44e39:indexpattern-datasource-layer-d8138ff4-5996-4544-9b28-98739cc15747","type":"index-pattern"},{"id":"logs-*","name":"0d81bae9-3b04-4344-98f0-49202a2258ce:indexpattern-datasource-layer-c65a658d-4007-4b5f-88b8-6a139aa1e32b","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Alpha - Health Check - Total Hosts - Metric","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Alpha - Health Check - Total Hosts - Metric\",\"type\":\"metric\",\"aggs\":[{\"id\":\"3\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Total Hosts\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f0e888d4-b9e1-402f-8481-4195773d8a82","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Events by machine","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Events by machine\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Number of events seen\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"segment\"}],\"params\":{\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"62711d6d-17f8-4c2d-aa37-b11717455e53","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Users seen","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Users seen\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"params\":{\"field\":\"winlog.user.name\",\"customLabel\":\"Users seen (total)\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8c34636f-01f4-4b46-b519-3120e5fe1731","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Unexpected Power Off","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Unexpected shutdowns","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Unexpected shutdowns\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.computer_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":50,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":true,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","managed":false,"references":[{"id":"3a6f2d21-ab96-4977-9543-2b845fcc3465","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNSwxXQ=="} +{"attributes":{"description":"Health Check overview","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},\"panelIndex\":\"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":11,\"i\":\"ba924baf-3793-418e-a1de-ff805560f85b\"},\"panelIndex\":\"ba924baf-3793-418e-a1de-ff805560f85b\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Total Hosts\",\"panelRefName\":\"panel_ba924baf-3793-418e-a1de-ff805560f85b\"},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":12,\"h\":21,\"i\":\"2b349db3-6677-43de-99ff-111253bee020\"},\"panelIndex\":\"2b349db3-6677-43de-99ff-111253bee020\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Alpha - Health Check - Number of Admins - Metric (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\",\"shouldTruncate\":true,\"maxLines\":5,\"legendStats\":[\"currentAndLastValue\"]},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"bf39875d-159e-4950-8c3d-803a61d82313\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"accessors\":[\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"winlog.event_id:1 and winlog.event_data.IntegrityLevel : \\\"High\\\" and not \\\"NT VIRTUAL MACHINE\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"1aab2c4b-51a1-4b7a-8173-1d0c9fb242a5\",\"key\":\"winlog.user.name\",\"field\":\"winlog.user.name\",\"type\":\"exists\"},\"query\":{\"exists\":{\"field\":\"winlog.user.name\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bf39875d-159e-4950-8c3d-803a61d82313\":{\"columns\":{\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"cf94e195-c66f-4040-9aee-44a0c719091a\":{\"label\":\"Unique Count of Admin Users\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}}},\"customLabel\":true}},\"columnOrder\":[\"f2d64ded-4380-46ff-8ff3-301d33e2c9c2\",\"cf94e195-c66f-4040-9aee-44a0c719091a\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Number of Admins\"},{\"type\":\"visualization\",\"gridData\":{\"x\":28,\"y\":0,\"w\":17,\"h\":21,\"i\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},\"panelIndex\":\"9479b8b7-fd3b-4160-8d3a-d7e4685c5819\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":8,\"h\":10,\"i\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},\"panelIndex\":\"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":45,\"h\":12,\"i\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"},\"panelIndex\":\"c4bcdc99-aaf7-4555-8ed0-d99f701396f2\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"panelRefName\":\"panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2\"}]","timeRestore":false,"title":"HealthCheck Dashboard - Overview 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fff78bfe-2758-4fa1-939f-362380fc607d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"c44fc9a0-b331-41a1-a58e-e1e0e140ea1a:panel_c44fc9a0-b331-41a1-a58e-e1e0e140ea1a","type":"links"},{"id":"f0e888d4-b9e1-402f-8481-4195773d8a82","name":"ba924baf-3793-418e-a1de-ff805560f85b:panel_ba924baf-3793-418e-a1de-ff805560f85b","type":"visualization"},{"id":"logs-*","name":"2b349db3-6677-43de-99ff-111253bee020:indexpattern-datasource-layer-bf39875d-159e-4950-8c3d-803a61d82313","type":"index-pattern"},{"id":"62711d6d-17f8-4c2d-aa37-b11717455e53","name":"9479b8b7-fd3b-4160-8d3a-d7e4685c5819:panel_9479b8b7-fd3b-4160-8d3a-d7e4685c5819","type":"visualization"},{"id":"8c34636f-01f4-4b46-b519-3120e5fe1731","name":"7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118:panel_7a2e3d19-3a4c-43eb-a9bc-ffe8a745b118","type":"visualization"},{"id":"bfdf5b46-fc8f-4bde-a631-f0dec81c4e53","name":"c4bcdc99-aaf7-4555-8ed0-d99f701396f2:panel_c4bcdc99-aaf7-4555-8ed0-d99f701396f2","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"password_resets_and_changes logs","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwNywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"user_lockouts","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:1502\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_default_domain_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIwOSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},\"panelIndex\":\"1fafa69c-12b3-49eb-b4dc-cd14591eb597\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":28,\"h\":21,\"i\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\"},\"panelIndex\":\"68d682d0-f9a5-44c1-a0a0-9f731f970cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\",\"accessors\":[\"40ece351-d270-400e-8da5-c469d428770f\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\"}]},\"query\":{\"query\":\"winlog.event_id:4657\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c\":{\"columns\":{\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"40ece351-d270-400e-8da5-c469d428770f\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"ebdfcfbf-78d7-4449-b9ac-3bbc6b853f60\",\"40ece351-d270-400e-8da5-c469d428770f\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Registry Object Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":36,\"y\":0,\"w\":12,\"h\":21,\"i\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\"},\"panelIndex\":\"d5d99e08-12e4-4f56-8a89-9b9e52b6a007\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df\"}],\"state\":{\"visualization\":{\"layerId\":\"8d620430-5405-4088-949e-1c7c369784df\",\"accessor\":\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4698\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8d620430-5405-4088-949e-1c7c369784df\":{\"columns\":{\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\":{\"label\":\"New Scheduled Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"winlog.event_id\",\"params\":{\"emptyAsNull\":false},\"customLabel\":true}},\"columnOrder\":[\"ca9b0eaa-9e0e-4c25-9a2e-5489723e3de1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"New Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"c4767fa6-123a-4f2c-958f-504253babada\"},\"panelIndex\":\"c4767fa6-123a-4f2c-958f-504253babada\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Password Resets and Changes Logs\",\"panelRefName\":\"panel_c4767fa6-123a-4f2c-958f-504253babada\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\"},\"panelIndex\":\"15b71263-a739-41f2-bc7c-38a5586aec9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2\"}],\"state\":{\"visualization\":{\"layerId\":\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\",\"accessor\":\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:\\\"4702\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"8cc8e090-3116-4ce4-aba1-1d822a5e40f2\":{\"columns\":{\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\":{\"label\":\"Updated Scheduler Jobs\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ad085a4a-1e8f-4297-b8eb-32e3d242bd48\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Updated Scheduler Jobs\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":36,\"w\":24,\"h\":15,\"i\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},\"panelIndex\":\"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"User Lockouts\",\"panelRefName\":\"panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":36,\"w\":24,\"h\":15,\"i\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\"},\"panelIndex\":\"35f07da3-7a63-455b-b393-adf2032d5a7a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\",\"accessors\":[\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"baf404fd-0f09-4df0-a861-2f15b539ca51\"}]},\"query\":{\"query\":\"winlog.event_id:4724 or winlog.event_id:4723\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c844c3ea-3a5b-4a87-a04c-c92bf15777bd\":{\"columns\":{\"baf404fd-0f09-4df0-a861-2f15b539ca51\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"51979016-6414-4ce0-aa1e-bb07e33110c0\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"baf404fd-0f09-4df0-a861-2f15b539ca51\",\"51979016-6414-4ce0-aa1e-bb07e33110c0\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Resets and Changes\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":51,\"w\":24,\"h\":15,\"i\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\"},\"panelIndex\":\"ce9cad31-6b06-472c-b249-d0ad1efcb5cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\",\"accessors\":[\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"8e283438-d965-48a0-b803-cea59d83d093\"}]},\"query\":{\"query\":\"winlog.event_id:4782\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"80bd6b7f-b23f-486a-a01c-7167f6007cdf\":{\"columns\":{\"8e283438-d965-48a0-b803-cea59d83d093\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"96f3ed8f-397d-4947-ab3c-789a15fb329c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"8e283438-d965-48a0-b803-cea59d83d093\",\"96f3ed8f-397d-4947-ab3c-789a15fb329c\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Password Hash Access\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":51,\"w\":24,\"h\":15,\"i\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\"},\"panelIndex\":\"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\",\"accessors\":[\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\"}]},\"query\":{\"query\":\"winlog.event_id:4740\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5c4810d9-ce40-4db2-8203-2c1502ebb89c\":{\"columns\":{\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"fdeb8146-7143-4fce-9c1c-672f9b13e5b4\",\"fcf27b70-4f1c-4788-bcf5-aa6862d133e3\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"User Lockouts\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":66,\"w\":24,\"h\":15,\"i\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\"},\"panelIndex\":\"ac85c23f-b911-474e-b45e-cbbf1456c9a9\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Changes to Default Domain Policy\",\"panelRefName\":\"panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9\"}]","timeRestore":false,"title":"Identity Access Management 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1fafa69c-12b3-49eb-b4dc-cd14591eb597:panel_1fafa69c-12b3-49eb-b4dc-cd14591eb597","type":"links"},{"id":"logs-*","name":"68d682d0-f9a5-44c1-a0a0-9f731f970cd0:indexpattern-datasource-layer-9d8b7cdf-dfc1-4ff1-ae5e-ba13e614e28c","type":"index-pattern"},{"id":"logs-*","name":"d5d99e08-12e4-4f56-8a89-9b9e52b6a007:indexpattern-datasource-layer-8d620430-5405-4088-949e-1c7c369784df","type":"index-pattern"},{"id":"7ed49a44-79df-4070-aae6-801cb8c1bcdd","name":"c4767fa6-123a-4f2c-958f-504253babada:panel_c4767fa6-123a-4f2c-958f-504253babada","type":"search"},{"id":"logs-*","name":"15b71263-a739-41f2-bc7c-38a5586aec9d:indexpattern-datasource-layer-8cc8e090-3116-4ce4-aba1-1d822a5e40f2","type":"index-pattern"},{"id":"79904c79-a5b7-43d9-9fe3-4327679b5c98","name":"bfc98d12-c8ba-4f4f-893d-0fa17f5efe81:panel_bfc98d12-c8ba-4f4f-893d-0fa17f5efe81","type":"search"},{"id":"logs-*","name":"35f07da3-7a63-455b-b393-adf2032d5a7a:indexpattern-datasource-layer-c844c3ea-3a5b-4a87-a04c-c92bf15777bd","type":"index-pattern"},{"id":"logs-*","name":"ce9cad31-6b06-472c-b249-d0ad1efcb5cf:indexpattern-datasource-layer-80bd6b7f-b23f-486a-a01c-7167f6007cdf","type":"index-pattern"},{"id":"logs-*","name":"c9e593c5-6bc0-4be7-ab77-6d46a0c75e72:indexpattern-datasource-layer-5c4810d9-ce40-4db2-8203-2c1502ebb89c","type":"index-pattern"},{"id":"80364ffd-2e61-49e7-8c30-043ffbd4ff0b","name":"ac85c23f-b911-474e-b45e-cbbf1456c9a9:panel_ac85c23f-b911-474e-b45e-cbbf1456c9a9","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:\\\"4946\\\" or winlog.event_id:\\\"4947\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"new_or_modified_exception_list_rules","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4950\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_settings","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4954\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_firewall_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"7b4c9843-87d7-42b9-935e-ff4713840de3","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxMywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5024 or winlog.event_id:5033\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned on","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:5025 or winlog.event_id:5034\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Firewall turned off","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"53b18c74-3370-4237-a524-90fd7489bf47","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4719\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_audit_policy","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"26bac78a-07ef-4925-9473-4e2f60e5c151","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"winlog.event_id:4713\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"changes_to_kerberos","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxNywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},\"panelIndex\":\"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":14,\"h\":21,\"i\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\"},\"panelIndex\":\"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f\"}],\"state\":{\"visualization\":{\"layerId\":\"b64767f2-cf92-4fc3-b001-8e256e39314f\",\"accessor\":\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b64767f2-cf92-4fc3-b001-8e256e39314f\":{\"columns\":{\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\":{\"label\":\"RPC Connection Attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true,\"format\":{\"id\":\"number\",\"params\":{\"decimals\":2}}},\"customLabel\":true}},\"columnOrder\":[\"a3d9dd31-e19e-40d4-88d4-9c20c50b5dff\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"RPC Connection Attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":14,\"h\":21,\"i\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\"},\"panelIndex\":\"638a3409-963c-41bf-b44c-5c84631ed0d5\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee\"}],\"state\":{\"visualization\":{\"layerId\":\"44404bd2-1430-4712-9667-3fa30aed28ee\",\"accessor\":\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4946 or winlog.event_id:4947\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"44404bd2-1430-4712-9667-3fa30aed28ee\":{\"columns\":{\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\":{\"label\":\"Added or Updated Rules to Firewall Exception List\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"cd67aaa6-4096-4cf6-8386-e4c5aefe7657\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":14,\"i\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\"},\"panelIndex\":\"0c81b645-b5a7-4c63-a4df-34be3cd2bad3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"357c66cc-ad43-42ef-807c-5911c93ab357\",\"accessors\":[\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\"}]},\"query\":{\"query\":\"winlog.event_id:5712\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"357c66cc-ad43-42ef-807c-5911c93ab357\":{\"columns\":{\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"ecc638ab-21e8-4123-a662-cf612107dedd\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e1a1e71-a0c9-479d-b1ef-7d960c829a0b\",\"ecc638ab-21e8-4123-a662-cf612107dedd\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"RPC Connections\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":15,\"i\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},\"panelIndex\":\"ec3a6d47-cc36-440f-ad19-1482eb9f5b68\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Added or Updated Exception Firewall Rules\",\"panelRefName\":\"panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":50,\"w\":24,\"h\":15,\"i\":\"955799aa-0778-4034-9624-2d258c7ee7d5\"},\"panelIndex\":\"955799aa-0778-4034-9624-2d258c7ee7d5\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Setting Changes\",\"panelRefName\":\"panel_955799aa-0778-4034-9624-2d258c7ee7d5\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":50,\"w\":24,\"h\":15,\"i\":\"73173146-a695-4da9-8760-f327c3d39b5f\"},\"panelIndex\":\"73173146-a695-4da9-8760-f327c3d39b5f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Policy Changes\",\"panelRefName\":\"panel_73173146-a695-4da9-8760-f327c3d39b5f\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":65,\"w\":24,\"h\":15,\"i\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},\"panelIndex\":\"59995b8c-7f7f-4d12-998f-ae94ef27ed89\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned On\",\"panelRefName\":\"panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":65,\"w\":24,\"h\":15,\"i\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},\"panelIndex\":\"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Firewall Turned Off\",\"panelRefName\":\"panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":80,\"w\":24,\"h\":15,\"i\":\"8ee424e6-e3df-4389-838c-4923da9036f6\"},\"panelIndex\":\"8ee424e6-e3df-4389-838c-4923da9036f6\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Audit Policy Changes\",\"panelRefName\":\"panel_8ee424e6-e3df-4389-838c-4923da9036f6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":80,\"w\":24,\"h\":15,\"i\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},\"panelIndex\":\"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Kerberos Policy Changes\",\"panelRefName\":\"panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":95,\"w\":24,\"h\":15,\"i\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\"},\"panelIndex\":\"39bc0b92-1ba5-46a6-a527-094f749c86cf\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\",\"accessors\":[\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"c970c28f-4b0f-4560-be20-691ef6ff7722\"}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fdb96bd7-3da0-40b0-bf74-6612b88919fb\":{\"columns\":{\"c970c28f-4b0f-4560-be20-691ef6ff7722\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c85c4fcc-e896-4607-bf76-4531ea13358e\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"c970c28f-4b0f-4560-be20-691ef6ff7722\",\"c85c4fcc-e896-4607-bf76-4531ea13358e\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Start Up\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":95,\"w\":24,\"h\":15,\"i\":\"cde6896d-e694-4467-915c-a40f8a96e072\"},\"panelIndex\":\"cde6896d-e694-4467-915c-a40f8a96e072\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"646160c2-9253-4e43-b062-e99092afccb2\",\"accessors\":[\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"bc53a3ce-785a-48be-b77c-4f54950fd843\"}]},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"646160c2-9253-4e43-b062-e99092afccb2\":{\"columns\":{\"bc53a3ce-785a-48be-b77c-4f54950fd843\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"18118859-447e-4ddc-aab9-7a6193e562f1\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"bc53a3ce-785a-48be-b77c-4f54950fd843\",\"18118859-447e-4ddc-aab9-7a6193e562f1\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shut Down\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":110,\"w\":24,\"h\":15,\"i\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\"},\"panelIndex\":\"95d5d91c-454a-477b-a2a2-c12df98091ab\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c\"}],\"state\":{\"visualization\":{\"layerId\":\"b14413de-d521-4fae-9803-61bb7bb0481c\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\",\"isTransposed\":false},{\"columnId\":\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"isTransposed\":false}]},\"query\":{\"query\":\"winlog.event_id:4608\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b14413de-d521-4fae-9803-61bb7bb0481c\":{\"columns\":{\"26c59d98-b16d-4231-b7f0-9cf5738531ab\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"43a09ae6-c67c-41ab-a028-590677c0fbb0\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"43a09ae6-c67c-41ab-a028-590677c0fbb0\",\"26c59d98-b16d-4231-b7f0-9cf5738531ab\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Startups\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":110,\"w\":24,\"h\":15,\"i\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\"},\"panelIndex\":\"6f9bce5a-19c2-4f12-ba21-6066488a01c3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"isTransposed\":false},{\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\",\"isTransposed\":false}],\"layerId\":\"a4076119-449b-4671-b641-1576ea6b1a4d\",\"layerType\":\"data\"},\"query\":{\"query\":\"winlog.event_id:4609\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a4076119-449b-4671-b641-1576ea6b1a4d\":{\"columns\":{\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\":{\"label\":\"Computers\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":1000,\"orderBy\":{\"type\":\"column\",\"columnId\":\"310e557f-37b5-406a-85e6-7eabac7c522b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"310e557f-37b5-406a-85e6-7eabac7c522b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"9bf9d41c-c7a9-4fc1-b807-7df7beed4688\",\"310e557f-37b5-406a-85e6-7eabac7c522b\"],\"sampling\":1,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"PC Shutdowns\"}]","timeRestore":false,"title":"Policy Changes and System Activity 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"614a8392-17b5-49c4-9397-bc3cac526c61","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8cb88002-d2c6-44e5-b1ed-e2a58d3e223a:panel_8cb88002-d2c6-44e5-b1ed-e2a58d3e223a","type":"links"},{"id":"logs-*","name":"ef1b14bc-8e2d-4de5-a7f3-6a27dd66e5bd:indexpattern-datasource-layer-b64767f2-cf92-4fc3-b001-8e256e39314f","type":"index-pattern"},{"id":"logs-*","name":"638a3409-963c-41bf-b44c-5c84631ed0d5:indexpattern-datasource-layer-44404bd2-1430-4712-9667-3fa30aed28ee","type":"index-pattern"},{"id":"logs-*","name":"0c81b645-b5a7-4c63-a4df-34be3cd2bad3:indexpattern-datasource-layer-357c66cc-ad43-42ef-807c-5911c93ab357","type":"index-pattern"},{"id":"7a60dc77-0039-437e-ba6a-edb9e40c93a8","name":"ec3a6d47-cc36-440f-ad19-1482eb9f5b68:panel_ec3a6d47-cc36-440f-ad19-1482eb9f5b68","type":"search"},{"id":"ec568427-71e3-4570-b4ba-417c0d5ba26f","name":"955799aa-0778-4034-9624-2d258c7ee7d5:panel_955799aa-0778-4034-9624-2d258c7ee7d5","type":"search"},{"id":"7b4c9843-87d7-42b9-935e-ff4713840de3","name":"73173146-a695-4da9-8760-f327c3d39b5f:panel_73173146-a695-4da9-8760-f327c3d39b5f","type":"search"},{"id":"b622cb3c-fa1f-4153-b90c-08cbce94ac76","name":"59995b8c-7f7f-4d12-998f-ae94ef27ed89:panel_59995b8c-7f7f-4d12-998f-ae94ef27ed89","type":"search"},{"id":"53b18c74-3370-4237-a524-90fd7489bf47","name":"3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8:panel_3bd73b60-ebbe-4f7e-906a-d2d3e0872cb8","type":"search"},{"id":"26bac78a-07ef-4925-9473-4e2f60e5c151","name":"8ee424e6-e3df-4389-838c-4923da9036f6:panel_8ee424e6-e3df-4389-838c-4923da9036f6","type":"search"},{"id":"d8cb6ffc-7a6c-416c-aa04-e0f59b9e3e8d","name":"c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e:panel_c0858a0c-e5e9-4a8d-bac1-d6b8aef0597e","type":"search"},{"id":"logs-*","name":"39bc0b92-1ba5-46a6-a527-094f749c86cf:indexpattern-datasource-layer-fdb96bd7-3da0-40b0-bf74-6612b88919fb","type":"index-pattern"},{"id":"logs-*","name":"cde6896d-e694-4467-915c-a40f8a96e072:indexpattern-datasource-layer-646160c2-9253-4e43-b062-e99092afccb2","type":"index-pattern"},{"id":"logs-*","name":"95d5d91c-454a-477b-a2a2-c12df98091ab:indexpattern-datasource-layer-b14413de-d521-4fae-9803-61bb7bb0481c","type":"index-pattern"},{"id":"logs-*","name":"6f9bce5a-19c2-4f12-ba21-6066488a01c3:indexpattern-datasource-layer-a4076119-449b-4671-b641-1576ea6b1a4d","type":"index-pattern"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOCwxXQ=="} +{"attributes":{"columns":[],"description":"This dashboard will audit, privileged use and detailed tracking processes. ","grid":{},"hideChart":false,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"refreshInterval":{"pause":true,"value":5000},"sort":[["@timestamp","desc"]],"timeRange":{"from":"now-30d/d","to":"now"},"timeRestore":true,"title":"Privileged Activity dashboard ","usesAdHocDataView":false},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":6,\"h\":25,\"i\":\"8048e972-d666-4403-ba50-805ec6552a2e\"},\"panelIndex\":\"8048e972-d666-4403-ba50-805ec6552a2e\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_8048e972-d666-4403-ba50-805ec6552a2e\"},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":0,\"w\":21,\"h\":13,\"i\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\"},\"panelIndex\":\"c98b5f54-1c52-4163-8cba-8e09e9765c61\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"f8e3a2b3-9937-415f-b405-27363667b11e\",\"seriesType\":\"line\",\"xAccessor\":\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"accessors\":[\"ed03924f-84eb-434a-834b-1f074954b815\"],\"layerType\":\"data\"}]},\"query\":{\"query\":\"4688\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f8e3a2b3-9937-415f-b405-27363667b11e\":{\"columns\":{\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"ed03924f-84eb-434a-834b-1f074954b815\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"ed03924f-84eb-434a-834b-1f074954b815\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"eab4d0e3-df52-489d-8d15-a7cb4a19c1d6\",\"ed03924f-84eb-434a-834b-1f074954b815\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":0,\"w\":19,\"h\":13,\"i\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\"},\"panelIndex\":\"1a605ecf-f244-4680-a9da-55de9afc96fe\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process termination\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873\"},{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"splitAccessor\":\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"accessors\":[\"8580666f-56c1-4af5-80fd-6178148354be\"],\"layerType\":\"data\"},{\"layerId\":\"3293242f-292b-4b40-9a26-d77cf1ae570c\",\"layerType\":\"data\",\"accessors\":[],\"seriesType\":\"bar_stacked\"}]},\"query\":{\"language\":\"kuery\",\"query\":\"4689\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a2ca0cb8-2465-405f-acb4-ae9bc1578873\":{\"columns\":{\"57566510-cf0e-4e35-b01d-8b5821f389fc\":{\"label\":\"Top 5 values of host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8580666f-56c1-4af5-80fd-6178148354be\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"e3910605-fe72-4ac8-9250-49d64f1cba7b\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"8580666f-56c1-4af5-80fd-6178148354be\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"57566510-cf0e-4e35-b01d-8b5821f389fc\",\"e3910605-fe72-4ac8-9250-49d64f1cba7b\",\"8580666f-56c1-4af5-80fd-6178148354be\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"},\"3293242f-292b-4b40-9a26-d77cf1ae570c\":{\"linkToLayers\":[],\"columns\":{},\"columnOrder\":[],\"sampling\":1,\"ignoreGlobalFilters\":false,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":6,\"y\":13,\"w\":21,\"h\":12,\"i\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\"},\"panelIndex\":\"0a90ec8c-687d-4165-9ab1-327baf40fb82\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Audit Sensitive privilege Use\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"layers\":[{\"accessors\":[\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"layerId\":\"unifiedHistogram\",\"layerType\":\"data\",\"seriesType\":\"bar_stacked\",\"xAccessor\":\"date_column\"}],\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"preferredSeriesType\":\"bar_stacked\",\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\"},\"query\":{\"language\":\"kuery\",\"query\":\"4673\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"date_column\",\"1ec9d305-2ddb-4c55-99db-549c767142a1\"],\"columns\":{\"1ec9d305-2ddb-4c55-99db-549c767142a1\":{\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count of records\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"date_column\":{\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Privilege service attempts \"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":13,\"w\":19,\"h\":12,\"i\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\"},\"panelIndex\":\"8d4ac232-4cce-46b1-b1de-ffbbc839a958\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Token assigned to process\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882\"}],\"state\":{\"visualization\":{\"layerId\":\"9ab8eb11-2529-4e5e-a153-834e29cc7882\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"aa267d47-4c05-4d62-9e91-523fd042b1d0\"},{\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"}]},\"query\":{\"query\":\"4696\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"9ab8eb11-2529-4e5e-a153-834e29cc7882\":{\"columns\":{\"aa267d47-4c05-4d62-9e91-523fd042b1d0\":{\"label\":\"Host.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"feeda031-4d04-4512-bb90-f78038ef4666\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"feeda031-4d04-4512-bb90-f78038ef4666\":{\"label\":\"Counts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"aa267d47-4c05-4d62-9e91-523fd042b1d0\",\"feeda031-4d04-4512-bb90-f78038ef4666\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Assigned Token \"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":25,\"w\":27,\"h\":13,\"i\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\"},\"panelIndex\":\"ace01c88-d563-4633-a8d3-b26ec8eca790\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Non-sensitive privilege event\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\"}],\"state\":{\"visualization\":{\"layerId\":\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\",\"accessor\":\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":2714.66},{\"color\":\"#d6bf57\",\"stop\":5429.33},{\"color\":\"#cc5642\",\"stop\":8144}],\"continuity\":\"above\",\"maxSteps\":5,\"colorStops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":2714.66},{\"color\":\"#cc5642\",\"stop\":5429.33}]}},\"textAlign\":\"center\",\"titlePosition\":\"bottom\",\"size\":\"l\"},\"query\":{\"query\":\"4674\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6\":{\"columns\":{\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"559c7280-ccb6-4bab-9bcf-3eaaff2d07ee\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Non-sensitive privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":27,\"y\":25,\"w\":19,\"h\":13,\"i\":\"f3f34099-a467-4343-9985-2b1fb741c78f\"},\"panelIndex\":\"f3f34099-a467-4343-9985-2b1fb741c78f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Edit visualization\",\"description\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-unifiedHistogram\"}],\"state\":{\"visualization\":{\"layerId\":\"unifiedHistogram\",\"accessor\":\"count_column\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"type\":\"palette\",\"name\":\"status\",\"params\":{\"name\":\"status\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":0,\"rangeMax\":1048.5,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#209280\",\"stop\":0},{\"color\":\"#d6bf57\",\"stop\":466},{\"color\":\"#cc5642\",\"stop\":932}],\"steps\":3,\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"l\",\"titlePosition\":\"bottom\"},\"query\":{\"language\":\"kuery\",\"query\":\"4674\"},\"filters\":[{\"meta\":{\"index\":\"c1678fe0-175c-4aa3-abcc-ee8260800574\",\"type\":\"exists\",\"key\":\"@timestamp\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"@timestamp\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"unifiedHistogram\":{\"columnOrder\":[\"count_column\"],\"columns\":{\"count_column\":{\"label\":\"Number of attempts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"@timestamp\",\"isBucketed\":false,\"params\":{\"format\":{\"id\":\"number\",\"params\":{\"decimals\":0}},\"emptyAsNull\":true},\"customLabel\":true}},\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Sensitive Privilege attempts\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":38,\"w\":27,\"h\":13,\"i\":\"7423841b-4470-4aee-ad93-a1a558c54d80\"},\"panelIndex\":\"7423841b-4470-4aee-ad93-a1a558c54d80\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"attributes\":{\"title\":\"Process creation\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\"}],\"state\":{\"visualization\":{\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"curveType\":\"LINEAR\",\"fittingFunction\":\"None\",\"gridlinesVisibilitySettings\":{\"x\":false,\"yLeft\":false,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":-90},\"layers\":[{\"accessors\":[\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"isHistogram\":true,\"layerId\":\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\",\"layerType\":\"data\",\"palette\":{\"name\":\"kibana_palette\",\"type\":\"palette\"},\"seriesType\":\"bar_stacked\",\"simpleView\":false,\"splitAccessor\":\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"xAccessor\":\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"xScaleType\":\"time\",\"yConfig\":[{\"axisMode\":\"left\",\"forAccessor\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"}]}],\"legend\":{\"isVisible\":true,\"legendSize\":\"auto\",\"maxLines\":1,\"position\":\"right\",\"shouldTruncate\":true,\"showSingleSeries\":true,\"legendStats\":[]},\"preferredSeriesType\":\"bar_stacked\",\"showCurrentTimeMarker\":false,\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"valueLabels\":\"hide\",\"yLeftExtent\":{\"enforce\":true,\"mode\":\"full\"},\"yLeftScale\":\"linear\",\"yRightScale\":\"linear\",\"yTitle\":\"Count\"},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8b4cb83-9391-483f-8f3d-5dc0b7fcc743\":{\"columnOrder\":[\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\",\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\",\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\"],\"columns\":{\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\":{\"customLabel\":true,\"dataType\":\"number\",\"isBucketed\":false,\"label\":\"Count\",\"operationType\":\"count\",\"params\":{\"emptyAsNull\":true},\"scale\":\"ratio\",\"sourceField\":\"___records___\"},\"afb5c4a8-66ae-498c-a39e-d1650bb938eb\":{\"customLabel\":true,\"dataType\":\"string\",\"isBucketed\":true,\"label\":\"winlog.event_data.User: Descending\",\"operationType\":\"terms\",\"params\":{\"exclude\":[],\"excludeIsRegex\":false,\"include\":[],\"includeIsRegex\":false,\"missingBucket\":false,\"orderBy\":{\"columnId\":\"abf3ba23-af81-4b6a-b241-b74cc362ee8c\",\"type\":\"column\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"size\":5},\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.User\"},\"d5b6f686-0fa9-447c-986f-7bc20060d5e1\":{\"customLabel\":true,\"dataType\":\"date\",\"isBucketed\":true,\"label\":\"@timestamp\",\"operationType\":\"date_histogram\",\"params\":{\"dropPartials\":false,\"includeEmptyRows\":false,\"interval\":\"auto\"},\"scale\":\"interval\",\"sourceField\":\"@timestamp\"}},\"ignoreGlobalFilters\":false,\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}}},\"title\":\"Process creation-Activities\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"4d293281-b115-4bf5-8143-be056b148c25\"},\"panelIndex\":\"4d293281-b115-4bf5-8143-be056b148c25\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Privilege Activity entry \",\"panelRefName\":\"panel_4d293281-b115-4bf5-8143-be056b148c25\"}]","timeRestore":false,"title":"Privileged Activity log Dashboards 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"8048e972-d666-4403-ba50-805ec6552a2e:panel_8048e972-d666-4403-ba50-805ec6552a2e","type":"links"},{"id":"logs-*","name":"c98b5f54-1c52-4163-8cba-8e09e9765c61:indexpattern-datasource-layer-f8e3a2b3-9937-415f-b405-27363667b11e","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-a2ca0cb8-2465-405f-acb4-ae9bc1578873","type":"index-pattern"},{"id":"logs-*","name":"1a605ecf-f244-4680-a9da-55de9afc96fe:indexpattern-datasource-layer-3293242f-292b-4b40-9a26-d77cf1ae570c","type":"index-pattern"},{"id":"logs-*","name":"0a90ec8c-687d-4165-9ab1-327baf40fb82:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"8d4ac232-4cce-46b1-b1de-ffbbc839a958:indexpattern-datasource-layer-9ab8eb11-2529-4e5e-a153-834e29cc7882","type":"index-pattern"},{"id":"logs-*","name":"ace01c88-d563-4633-a8d3-b26ec8eca790:indexpattern-datasource-layer-3d6ff3fb-75f2-4791-a6bb-041a43a7fdb6","type":"index-pattern"},{"id":"logs-*","name":"f3f34099-a467-4343-9985-2b1fb741c78f:indexpattern-datasource-layer-unifiedHistogram","type":"index-pattern"},{"id":"logs-*","name":"7423841b-4470-4aee-ad93-a1a558c54d80:indexpattern-datasource-layer-a8b4cb83-9391-483f-8f3d-5dc0b7fcc743","type":"index-pattern"},{"id":"ee920656-b76c-41ef-a7cd-b91e1c6bfa16","name":"4d293281-b115-4bf5-8143-be056b148c25:panel_4d293281-b115-4bf5-8143-be056b148c25","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Process - hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Total Processes\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\",\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/kibana\",\"basePath\":\"\"}}},\"params\":{},\"label\":\"host.name: Descending\",\"aggType\":\"terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIxOSwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.ProcessId","winlog.event_data.ParentProcessId","winlog.event_data.CommandLine","winlog.event_data.User","winlog.event_data.IntegrityLevel"],"description":"","grid":{"columns":{"host.name":{"width":202},"winlog.event_data.IntegrityLevel":{"width":238},"winlog.event_data.ParentProcessId":{"width":141},"winlog.event_data.ProcessId":{"width":116}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:1 AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawn Event Logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2a069ea5-946c-4c62-9e95-a4801299794d","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Process - Spawned area ","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Spawned area \",\"type\":\"area\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15w\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"1d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"area\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"labels\":{},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD\"}},\"params\":{\"date\":true,\"interval\":\"P1D\",\"intervalESValue\":1,\"intervalESUnit\":\"d\",\"format\":\"YYYY-MM-DD\",\"bounds\":{\"min\":\"2020-01-22T16:30:25.973Z\",\"max\":\"2020-05-06T15:30:25.973Z\"}},\"label\":\"@timestamp per day\",\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","managed":false,"references":[{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Process - Users bar","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Process - Users bar\",\"type\":\"histogram\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d/d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"12h\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"user.name: Descending\",\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\",\"radiusRatio\":0,\"truncateLegend\":true,\"maxLegendLines\":1}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMiwxXQ=="} +{"attributes":{"columns":["host.name","event.action","process.name","user.name","file.path"],"description":"","grid":{"columns":{"@timestamp":{"width":240},"event.code":{"width":148},"event.provider":{"width":260},"host.name":{"width":168},"winlog.event_data.TargetFilename":{"width":630}}},"hideChart":true,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"event.action: \\\"creation\\\" AND file.path.text: \\\"*\\\\\\\\Downloads\\\\\\\\*\\\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"rowHeight":1,"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Download Test 2","usesAdHocDataView":false,"viewMode":"documents"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyMywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.EventType","winlog.event_data.TargetObject","winlog.event_data.Details"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:12 or event.code:13 or event.code:14) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process - Registry events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8584f0da-88c3-478e-bd13-fff76a975897","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\"},\"panelIndex\":\"429e5318-e2ae-4637-ac70-eb4a12f191e6\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_429e5318-e2ae-4637-ac70-eb4a12f191e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":40,\"h\":21,\"i\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},\"panelIndex\":\"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Hosts\",\"panelRefName\":\"panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":15,\"i\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},\"panelIndex\":\"2cb3c5a0-bf16-43b4-a69d-73012062f55b\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Process spawns over time\",\"panelRefName\":\"panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":21,\"w\":24,\"h\":15,\"i\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\"},\"panelIndex\":\"b6b8e77e-67f7-42ce-a835-650ad795834f\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Processes created by users over time\",\"panelRefName\":\"panel_b6b8e77e-67f7-42ce-a835-650ad795834f\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":15,\"i\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\"},\"panelIndex\":\"9a28d907-c8ef-4815-8ebc-ac897b19ab48\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Process - Users (converted)\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500\"}],\"state\":{\"visualization\":{\"layerId\":\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\",\"alignment\":\"left\",\"hidden\":true},{\"columnId\":\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"alignment\":\"left\"},{\"columnId\":\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"alignment\":\"left\"}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b43b035f-4bf5-4166-a5f4-dbfb6d30f500\":{\"columns\":{\"12f20e93-46d3-4931-926b-91fbf9177d4e\":{\"label\":\"Domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\":{\"label\":\"Username\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.user.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"alphabetical\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"12f20e93-46d3-4931-926b-91fbf9177d4e\",\"91a8b04b-519b-49c6-a9be-bb1f0cd17431\",\"48e5a1a9-04d8-4411-a5c9-5588d10dd562\"],\"incompleteColumns\":{},\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Users\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":51,\"w\":48,\"h\":17,\"i\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},\"panelIndex\":\"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\",\"embeddableConfig\":{\"enhancements\":{},\"columns\":[\"@timestamp\",\"host.name\",\"winlog.event_data.CommandLine\",\"winlog.event_data.User\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ParentProcessId\"]},\"title\":\"Process spawn event logs (Sysmon ID 1)\",\"panelRefName\":\"panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":68,\"w\":48,\"h\":14,\"i\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},\"panelIndex\":\"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\",\"embeddableConfig\":{\"hidePanelTitles\":false,\"description\":\"Shows all the files created in Downloads Directory.\",\"rowHeight\":1,\"enhancements\":{}},\"title\":\"Files created (in Downloads)\",\"panelRefName\":\"panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":82,\"w\":48,\"h\":15,\"i\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\"},\"panelIndex\":\"502494bd-c9c5-4f2a-a85f-ffc27cec088e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Registry events (Sysmon 12, 13, 14)\",\"panelRefName\":\"panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e\"}]","timeRestore":false,"title":"Process Explorer 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"429e5318-e2ae-4637-ac70-eb4a12f191e6:panel_429e5318-e2ae-4637-ac70-eb4a12f191e6","type":"links"},{"id":"9283ec37-91bf-44f0-9da7-0e35417ebe94","name":"78123b3a-baaa-497b-b1f3-d1fb1ce5a50f:panel_78123b3a-baaa-497b-b1f3-d1fb1ce5a50f","type":"visualization"},{"id":"f4f144c4-456a-406a-80b4-a7e4f525c44f","name":"2cb3c5a0-bf16-43b4-a69d-73012062f55b:panel_2cb3c5a0-bf16-43b4-a69d-73012062f55b","type":"visualization"},{"id":"d20a92e6-6d68-43c9-acf2-3358487b56aa","name":"b6b8e77e-67f7-42ce-a835-650ad795834f:panel_b6b8e77e-67f7-42ce-a835-650ad795834f","type":"visualization"},{"id":"logs-*","name":"9a28d907-c8ef-4815-8ebc-ac897b19ab48:indexpattern-datasource-layer-b43b035f-4bf5-4166-a5f4-dbfb6d30f500","type":"index-pattern"},{"id":"2a069ea5-946c-4c62-9e95-a4801299794d","name":"be6f4ac3-8e87-417b-9083-0f5eb11e8cdd:panel_be6f4ac3-8e87-417b-9083-0f5eb11e8cdd","type":"search"},{"id":"e34912a4-8d9c-4488-8602-616dd87cdd4c","name":"fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10:panel_fc1d2d9a-555b-4cac-870b-0e4e7bd9ee10","type":"search"},{"id":"8584f0da-88c3-478e-bd13-fff76a975897","name":"502494bd-c9c5-4f2a-a85f-ffc27cec088e:panel_502494bd-c9c5-4f2a-a85f-ffc27cec088e","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNSwxXQ=="} +{"attributes":{"columns":["event.code","event.action","winlog.logon.type","host.name","winlog.event_data.LogonProcessName","winlog.logon.id","winlog.event_data.SubjectUserName","winlog.event_data.IpAddress","winlog.event_data.TargetDomainName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_logs","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Vis_sd_security_log_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Vis_sd_security_log_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Count\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1005636a-f473-4a39-a905-ec18aa855ce1","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_id","winlog.event_data.TokenElevationType","winlog.event_data.MandatoryLabel","winlog.event_data.ProcessId","winlog.event_data.ProcessName","process.parent.executable","process.executable"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code: \\\"4688\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4688_process_creation","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOCwxXQ=="} +{"attributes":{"columns":["winlog.user_data.SubjectDomainName","winlog.user_data.SubjectUserName","host.name","event.code","winlog.user_data.Channel","event.module"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1102\\\" OR event.code:\\\"104\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_1102_security_log_cleared","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIyOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:2\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_2","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"92562206-3ca8-4227-8dc3-c69d56598302","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_2_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_2_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"logon created locally\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","managed":false,"references":[{"id":"92562206-3ca8-4227-8dc3-c69d56598302","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"winlog.channel\",\"negate\":false,\"params\":{\"query\":\"Security\"},\"type\":\"phrase\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"winlog.channel\":{\"query\":\"Security\"}}}}]}"},"title":"vis_sd_security_4624_picker","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_picker\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1570446686972\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Computername\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"21038ddc-61bb-4709-9a06-e9d399ada64a","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMiwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:3\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_3","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"0d2b506b-85b9-4624-924c-a588072e5ad7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzMywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"not user.name:*$\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_3_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_3_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Network logon created for user\"},\"schema\":\"bucket\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"network logon by user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","managed":false,"references":[{"id":"0d2b506b-85b9-4624-924c-a588072e5ad7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:5\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_5","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"08f51fba-7f74-4724-a424-d90fd6f433e6","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_5_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_5_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Service account used\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"_key\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Logon as service with user\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":16,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4752d143-4f0a-4685-b890-7a19e29a0efa","managed":false,"references":[{"id":"08f51fba-7f74-4724-a424-d90fd6f433e6","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.TargetUserName","winlog.event_data.TargetLogonId","host.name","winlog.task","winlog.event_id","winlog.event_data.LogonType","process.name","source.ip","source.port","winlog.event_data.LogonProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4624 and winlog.event_data.LogonType:8\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4624_logon_type_8","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bbed4a2c-015d-44db-ad34-de2173a81668","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4624_logon_type_8_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4624_logon_type_8_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Credentials sent in clear text\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7c34827-8829-4c45-81ad-26ffff747efe","managed":false,"references":[{"id":"bbed4a2c-015d-44db-ad34-de2173a81668","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzNywxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.WorkstationName","winlog.event_data.TargetUserName","winlog.event_data.LogonType","winlog.event_data.IpAddress","winlog.event_data.Status","winlog.event_data.SubStatus"],"description":"New settings test 9/29/2023 16:44","grid":{"columns":{"winlog.event_data.Status":{"width":221}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4625\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4625_failed_logon","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc86684-4065-45c3-9847-2d4c241ec544","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f754ea3-d5cc-4060-8b99-c330f973d797","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzIzOSwxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectUserName","winlog.computer_name","winlog.task","winlog.event_id","winlog.event_data.PrivilegeList"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4672\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4672_special_privileges_assigned","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":\"NT AUTHORITY, Window Manager, Font Driver Host\",\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4672_special_privileges_assigned_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_security_4672_special_privileges_assigned_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computername\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"asc\",\"size\":1,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"User assigned special privileges logged on\"},\"schema\":\"split\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetDomainName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Domain\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"9058d77f-3f30-4d94-90a0-6b28e0b61084","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_types_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_types_label\",\"type\":\"markdown\",\"params\":{\"markdown\":\"|Logon Type|Logon Title|Description|\\n| :-: | :- | :- |\\n| 2 | Interactive | A user logged on to this computer. |\\n| 3 | Network | A user or computer logged on to this computer from the network. |\\n| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |\\n| 5 | Service | A service was started by the Service Control Manager. |\\n| 7 | Unlock | This workstation was unlocked. |\\n| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |\\n| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |\\n| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |\\n| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_4625_failed_logon_status_codes_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_codes_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.LogonType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.Status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.SubStatus\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":true,\"truncateLegend\":true,\"maxLegendLines\":5,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","managed":false,"references":[{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_security_4625_failed_logon_status_label","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_security_4625_failed_logon_status_label\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| Code | Description |\\n| :- | :- |\\n| 0XC000005E | There are currently no logon servers available to service the logon request. |\\n| 0xC0000064 | User logon with misspelled or bad user account |\\n| 0xC000006A | User logon with misspelled or bad password |\\n| 0XC000006D | This is either due to a bad username or authentication information |\\n| 0XC000006E | Unknown user name or bad password. |\\n| 0xC000006F | User logon outside authorized hours |\\n| 0xC0000070 | User logon from unauthorized workstation |\\n| 0xC0000071 | User logon with expired password |\\n| 0xC0000072 | User logon to account disabled by administrator |\\n| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |\\n| 0XC0000133 | Clocks between DC and other computer too far out of sync |\\n| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |\\n| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |\\n| 0XC0000192 | An attempt was made to logon, but the Netlogon service was not started. |\\n| 0xC0000193 | User logon with expired account |\\n| 0XC0000224 | User is required to change password at next logon |\\n| 0XC0000225 | Evidently a bug in Windows and not a risk |\\n| 0xC0000234 | User logon with account locked |\\n| 0XC00002EE | Failure Reason: An Error occurred during Logon |\\n| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |\\n| 0x0 | Status OK. |\\n\\nFor more information see *https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625*\",\"openLinksInNewTab\":false,\"fontSize\":10}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.SubjectUserName","winlog.event_data.TargetUserName","winlog.event_data.TargetServerName","winlog.event_data.SubjectDomainName","winlog.event_data.TargetDomainName","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:Security and winlog.event_id:4648 \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_security_4648_logon_explicit_creds_running_as_different_user","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_security_logs_computernames_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Logged events\"}},{\"id\":\"2\",\"enabled\":false,\"type\":\"filters\",\"schema\":\"bucket\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_id : 4624\",\"language\":\"kuery\"},\"label\":\"EventID 4624\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":1000,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Computername\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"vis_sd_security_logs_computernames_datatable\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a7410752-98c4-4145-adb4-1c39506f58ca","managed":false,"references":[{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NiwxXQ=="} +{"attributes":{"description":"Security log related events","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security logs events\",\"panelRefName\":\"panel_1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":137,\"w\":48,\"h\":17,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Process creation - event ID 4688\",\"panelRefName\":\"panel_2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":112,\"w\":48,\"h\":8,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Log Cleared - event ID 1102 or 104\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":154,\"w\":48,\"h\":18,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logon created - Logon type 2\",\"panelRefName\":\"panel_6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":8,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select a computer to filter the below results. Leave blank for all\",\"panelRefName\":\"panel_7\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":172,\"w\":48,\"h\":15,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - network logon created - Logon type 3\",\"panelRefName\":\"panel_8\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":120,\"w\":48,\"h\":17,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log events - Detail\",\"panelRefName\":\"panel_9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":48,\"h\":17,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - logon as a service - Logon type 5\",\"panelRefName\":\"panel_10\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":204,\"w\":48,\"h\":15,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Credential sent as clear text - Logon type 8\",\"panelRefName\":\"panel_11\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":15,\"i\":\"15\"},\"panelIndex\":\"15\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon attempts\",\"panelRefName\":\"panel_15\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":219,\"w\":48,\"h\":18,\"i\":\"19\"},\"panelIndex\":\"19\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Security log - Logons with special privileges assigned - event ID 4672\",\"panelRefName\":\"panel_19\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":36,\"w\":48,\"h\":18,\"i\":\"21\"},\"panelIndex\":\"21\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon type codes\",\"panelRefName\":\"panel_21\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":54,\"w\":48,\"h\":16,\"i\":\"22\"},\"panelIndex\":\"22\",\"embeddableConfig\":{\"enhancements\":{},\"description\":\"\"},\"title\":\"Failed logon and reason (see table for explanations)\",\"panelRefName\":\"panel_22\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":70,\"w\":48,\"h\":26,\"i\":\"23\"},\"panelIndex\":\"23\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed logon status codes\",\"panelRefName\":\"panel_23\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":237,\"w\":48,\"h\":15,\"i\":\"28\"},\"panelIndex\":\"28\",\"embeddableConfig\":{\"enhancements\":{},\"sort\":[]},\"title\":\"Security log - Process started with different credentials- event ID 4648 [could be RUNAS, scheduled tasks]\",\"panelRefName\":\"panel_28\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":8,\"w\":24,\"h\":13,\"i\":\"30\"},\"panelIndex\":\"30\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"title\":\"Select a computername to filter\",\"panelRefName\":\"panel_30\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"69421b10-759e-477d-8f28-adf6e198c8b5\"},\"panelIndex\":\"69421b10-759e-477d-8f28-adf6e198c8b5\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_69421b10-759e-477d-8f28-adf6e198c8b5\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":96,\"w\":48,\"h\":16,\"i\":\"96010259-5ae8-4632-bcce-34078573b1cd\"},\"panelIndex\":\"96010259-5ae8-4632-bcce-34078573b1cd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Failed Logons\",\"panelRefName\":\"panel_96010259-5ae8-4632-bcce-34078573b1cd\"}]","timeRestore":false,"title":"Security Dashboard - Security Log 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"beeeb066-d497-4b2a-99d3-44d741238bd1","managed":false,"references":[{"id":"1005636a-f473-4a39-a905-ec18aa855ce1","name":"1:panel_1","type":"visualization"},{"id":"754b3596-ffcc-41dd-96f6-081f4b7ecc44","name":"2:panel_2","type":"search"},{"id":"1e97e80a-ab77-44eb-9cf9-6b6cd1566017","name":"3:panel_3","type":"search"},{"id":"eb90968d-fed5-4d22-a21d-bcb58a3787cd","name":"6:panel_6","type":"visualization"},{"id":"21038ddc-61bb-4709-9a06-e9d399ada64a","name":"7:panel_7","type":"visualization"},{"id":"e60c6ec4-f943-44cb-b6ce-f93138fdf660","name":"8:panel_8","type":"visualization"},{"id":"59f2d4f2-9d6a-4fe9-a631-ce9050992206","name":"9:panel_9","type":"search"},{"id":"4752d143-4f0a-4685-b890-7a19e29a0efa","name":"10:panel_10","type":"visualization"},{"id":"a7c34827-8829-4c45-81ad-26ffff747efe","name":"11:panel_11","type":"visualization"},{"id":"3f754ea3-d5cc-4060-8b99-c330f973d797","name":"15:panel_15","type":"visualization"},{"id":"ce7bf80b-284c-4130-a4b8-c6d5b93f601c","name":"19:panel_19","type":"visualization"},{"id":"e473e94b-5e50-4ff8-ad7d-c1fe232b17ea","name":"21:panel_21","type":"visualization"},{"id":"bb4bdce0-0c10-4fc2-b0a7-47842a298301","name":"22:panel_22","type":"visualization"},{"id":"cdea8dc0-034c-4249-b90d-0bd1b400e305","name":"23:panel_23","type":"visualization"},{"id":"50bdd4e0-8ef8-4a5f-96aa-6aa6eac3b6f0","name":"28:panel_28","type":"search"},{"id":"a7410752-98c4-4145-adb4-1c39506f58ca","name":"30:panel_30","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"69421b10-759e-477d-8f28-adf6e198c8b5:panel_69421b10-759e-477d-8f28-adf6e198c8b5","type":"links"},{"id":"2fc86684-4065-45c3-9847-2d4c241ec544","name":"96010259-5ae8-4632-bcce-34078573b1cd:panel_96010259-5ae8-4632-bcce-34078573b1cd","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0NywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.channel:\\\"Microsoft-Windows-Sysmon/Operational\\\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_sysmon_all_events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI0OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_pie","uiStateJSON":"{\"vis\":{\"legendOpen\":true}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":false,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":0},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_events_datatable\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"showToolbar\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event code\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"90a5fcee-d3fb-4969-a336-869ab6808777","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"vis_sd_sysmon_all_host_events_datatable","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"vis_sd_sysmon_all_host_events_datatable\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":23,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Event code\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Missing computer name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer name\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"split\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Missing computer name\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}],\"splitRow\":[{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"row\":true,\"percentageCol\":\"\",\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","managed":false,"references":[{"id":"dbdf206a-c32e-4018-8883-79eb67f10bc4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"vis_sd_sysmon_event_code_reference","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"| \\tEvent ID\\t | \\tEvent\\t | \\tDescription\\t |\\n| \\t:-:\\t | \\t:-\\t | \\t-\\t |\\n| \\t1\\t | \\tProcess creation\\t | \\tThe process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.\\t |\\n| \\t2\\t | \\tA process changed a file creation time\\t | \\tThe change file creation time event is registered when a file creation time is explicitly modified by a process. This event helps tracking the real creation time of a file. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.\\t |\\n| \\t3\\t | \\tNetwork connection\\t | \\tThe network connection event logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGUID fields. The event also contains the source and destination host names IP addresses, port numbers and IPv6 status.\\t |\\n| \\t4\\t | \\tSysmon service state changed\\t | \\tThe service state change event reports the state of the Sysmon service (started or stopped).\\t |\\n| \\t5\\t | \\tProcess terminated\\t | \\tThe process terminate event reports when a process terminates. It provides the UtcTime, ProcessGuid and ProcessId of the process.\\t |\\n| \\t6\\t | \\tDriver loaded\\t | \\tThe driver loaded events provides information about a driver being loaded on the system. The configured hashes are provided as well as signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading.\\t |\\n| \\t7\\t | \\tImage loaded\\t | \\tThe image loaded event logs when a module is loaded in a specific process. This event is disabled by default and needs to be configured with the �l option. It indicates the process in which the module is loaded, hashes and signature information. The signature is created asynchronously for performance reasons and indicates if the file was removed after loading. This event should be configured carefully, as monitoring all image load events will generate a large number of events.\\t |\\n| \\t8\\t | \\tCreateRemoteThread\\t | \\tThe CreateRemoteThread event detects when a process creates a thread in another process. This technique is used by malware to inject code and hide in other processes. The event indicates the source and target process. It gives information on the code that will be run in the new thread: StartAddress, StartModule and StartFunction. Note that StartModule and StartFunction fields are inferred, they might be empty if the starting address is outside loaded modules or known exported functions.\\t |\\n| \\t9\\t | \\tRawAccessRead\\t | \\tThe RawAccessRead event detects when a process conducts reading operations from the drive using the \\\\\\\\\\\\\\\\.\\\\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.\\t |\\n| \\t10\\t | \\tProcessAccess\\t | \\tThe process accessed event reports when a process opens another process, an operation that�s often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks. Enabling it can generate significant amounts of logging if there are diagnostic utilities active that repeatedly open processes to query their state, so it generally should only be done so with filters that remove expected accesses.\\t |\\n| \\t11\\t | \\tFileCreate\\t | \\tFile create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.\\t |\\n| \\t12\\t | \\tRegistryEvent (Object create and delete)\\t | \\tRegistry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications. Sysmon uses abbreviated versions of Registry root key names, with the following mappings: |\\n|||**Key name**                                                                                          **Abbreviation**|\\n|||HKEY_LOCAL_MACHINE                                                                  HKLM|\\n|||HKEY_USERS                                                                                     HKU|\\n|||HKEY_LOCAL_MACHINE\\\\System\\\\ControlSet00x                          HKLM\\\\System\\\\CurrentControlSet|\\n|||HKEY_LOCAL_MACHINE\\\\Classes                                                    HKCR|\\n| \\t13\\t | \\tRegistryEvent (Value Set)\\t | \\tThis Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.\\t |\\n| \\t14\\t | \\tRegistryEvent (Key and Value Rename)\\t | \\tRegistry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.\\t |\\n| \\t15\\t | \\tFileCreateStreamHash\\t | \\tThis event logs when a named file stream is created, and it generates events that log the hash of the contents of the file to which the stream is assigned (the unnamed stream), as well as the contents of the named stream. There are malware variants that drop their executables or configuration settings via browser downloads, and this event is aimed at capturing that based on the browser attaching a Zone.Identifier �mark of the web� stream.\\t |\\n| \\t16\\t | \\tServiceConfigurationChange\\t | \\tThis event logs changes in the Sysmon configuration - for example when the filtering rules are updated.\\t |\\n| \\t17\\t | \\tPipeEvent (Pipe Created)\\t | \\tThis event generates when a named pipe is created. Malware often uses named pipes for interprocess communication.\\t |\\n| \\t18\\t | \\tPipeEvent (Pipe Connected)\\t | \\tThis event logs when a named pipe connection is made between a client and a server.\\t |\\n| \\t19\\t | \\tWmiEvent (WmiEventFilter activity detected)\\t | \\tWhen a WMI event filter is registered, which is a method used by malware to execute, this event logs the WMI namespace, filter name and filter expression.\\t |\\n| \\t20\\t | \\tWmiEvent (WmiEventConsumer activity detected)\\t | \\tThis event logs the registration of WMI consumers, recording the consumer name, log, and destination.\\t |\\n| \\t21\\t | \\tWmiEvent (WmiEventConsumerToFilter activity detected)\\t | \\tWhen a consumer binds to a filter, this event logs the consumer name and filter path.\\t |\\n| \\t22\\t | \\tDNSEvent (DNS query)\\t | \\tThis event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.\\t |\\n| \\t23\\t | \\tFileDelete (A file delete was detected)\\t | \\tA file was deleted.\\t |\\n| \\t24\\t | \\tClipboardChange (New content in the clipboard)\\t | \\tThis event is generated when the system clipboard contents change.\\t |\\n| \\t25\\t | \\tProcessTampering (Process image change)\\t | \\tThis event is generated when a process image is changed from an external source, such as a different process.\\t |\\n| \\t255\\t | \\tError\\t | \\tThis event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the Sysinternals forum or over Twitter (@markrussinovich).\\t |\\n\\nFor more information see *https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon*\",\"openLinksInNewTab\":false,\"fontSize\":10},\"title\":\"vis_sd_sysmon_event_code_reference\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"88efefcc-de0a-4a08-9a17-3d09423092e0","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1MywxXQ=="} +{"attributes":{"description":"Summarizes collected Sysmon event data","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":16,\"h\":21,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Total number of Sysmon events found\",\"panelRefName\":\"panel_2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":13,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"vis\":{\"legendOpen\":true}},\"title\":\"Percentage of Sysmon events by event code\",\"panelRefName\":\"panel_3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":24,\"h\":18,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Count of Sysmon events by event code\",\"panelRefName\":\"panel_4\"},{\"type\":\"visualization\",\"gridData\":{\"x\":24,\"y\":13,\"w\":24,\"h\":18,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"asc\"}}},\"enhancements\":{}},\"title\":\"Top 10 hosts generating the most Sysmon data\",\"panelRefName\":\"panel_5\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":39,\"w\":48,\"h\":21,\"i\":\"7\"},\"panelIndex\":\"7\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Sysmon event code reference\",\"panelRefName\":\"panel_7\"},{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\"},\"panelIndex\":\"4fb34c82-2e7f-43cb-88ca-54b304bc2550\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550\"}]","timeRestore":false,"title":"Sysmon Summary 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","managed":false,"references":[{"id":"20bb3ded-d4fd-495f-b831-c0eba8ce5839","name":"2:panel_2","type":"visualization"},{"id":"d4e39b2b-a2b2-4410-b9fb-a4ce0e67d31f","name":"3:panel_3","type":"visualization"},{"id":"90a5fcee-d3fb-4969-a336-869ab6808777","name":"4:panel_4","type":"visualization"},{"id":"73ab1d36-5a16-42f4-8bba-85d161dcba93","name":"5:panel_5","type":"visualization"},{"id":"88efefcc-de0a-4a08-9a17-3d09423092e0","name":"7:panel_7","type":"visualization"},{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"4fb34c82-2e7f-43cb-88ca-54b304bc2550:panel_4fb34c82-2e7f-43cb-88ca-54b304bc2550","type":"links"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - User activity title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - User activity title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## All user activity\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"HR - Logon title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Logon title\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"## Logon / Logoff events\"},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1NywxXQ=="} +{"attributes":{"columns":["winlog.event_data.SubjectDomainName","winlog.event_data.TargetUserName","host.name","winlog.event_data.TargetLogonId"],"description":"","grid":{"columns":{"user.name":{"width":193},"winlog.event_data.SubjectDomainName":{"width":193}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"4624\\\" and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_data.LogonType\",\"value\":[\"2\",\"10\",\"11\",\"7\"],\"params\":[\"2\",\"10\",\"11\",\"7\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_data.LogonType\":\"2\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"10\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"11\"}},{\"match_phrase\":{\"winlog.event_data.LogonType\":\"7\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Interactive Logon search","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{"columns":{"winlog.event_data.TargetDomainName":{"width":241},"winlog.event_data.TargetUserName":{"width":241}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:\\\"4634\\\" OR event.code:\\\"4647\\\" ) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI1OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"HR - Interactive v Remote pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"HR - Interactive v Remote pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"params\":{\"filters\":[{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"2\\\"\",\"language\":\"lucene\"},\"label\":\"Interactive\"},{\"input\":{\"query\":\"winlog.event_data.LogonType:\\\"10\\\"\\n\",\"language\":\"lucene\"},\"label\":\"RemoteInteractive\"}]},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{},\"params\":{},\"label\":\"filters\",\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","managed":false,"references":[{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MCwxXQ=="} +{"attributes":{"description":"Overview of user activity for Human Resources\n","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":24,\"i\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},\"panelIndex\":\"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":20,\"h\":12,\"i\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\"},\"panelIndex\":\"c8d3e871-1f5d-40bd-a0f9-5441a58cad32\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\",\"accessors\":[\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"splitAccessor\":\"fc23a029-309e-40a7-aeca-309fd8423ced\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"23f1f6ab-b8b6-47e2-a508-4b3f368cb093\":{\"columns\":{\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\":{\"label\":\"Top 5 values of winlog.event_data.SubjectDomainName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.SubjectDomainName\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"fc23a029-309e-40a7-aeca-309fd8423ced\":{\"label\":\"Top 3 values of winlog.event_data.TargetUserName\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.event_data.TargetUserName\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5a238afa-9ffa-4568-8a43-6167c0a76b67\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"cd51b883-1c2b-42c5-95e4-d1ef8aa38fc7\",\"fc23a029-309e-40a7-aeca-309fd8423ced\",\"5a238afa-9ffa-4568-8a43-6167c0a76b67\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Users\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":20,\"h\":12,\"i\":\"69771c75-8536-49b2-a835-c134ada8cd8d\"},\"panelIndex\":\"69771c75-8536-49b2-a835-c134ada8cd8d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\",\"accessors\":[\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"position\":\"top\",\"seriesType\":\"bar\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"22b4e313-2858-411e-a90b-911198fa34fe\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2\":{\"columns\":{\"22b4e313-2858-411e-a90b-911198fa34fe\":{\"label\":\"Top 5 values of winlog.computer_name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"winlog.computer_name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"22b4e313-2858-411e-a90b-911198fa34fe\",\"5d3a9e33-d23b-4f5d-b02c-260e5016d278\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter Computers\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":12,\"w\":40,\"h\":12,\"i\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},\"panelIndex\":\"ab726ae4-6c98-4f26-8cd3-07bf2808b704\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Select domain(s) and username(s)\",\"panelRefName\":\"panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":24,\"w\":48,\"h\":4,\"i\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\"},\"panelIndex\":\"f2f654b0-42ef-403c-bee2-7e26499f809a\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_f2f654b0-42ef-403c-bee2-7e26499f809a\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":28,\"w\":48,\"h\":14,\"i\":\"e40e6077-f799-4c66-9bf8-1664121d8069\"},\"panelIndex\":\"e40e6077-f799-4c66-9bf8-1664121d8069\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f46d1729-4bd5-4219-9973-01913c208fef\",\"accessors\":[\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f46d1729-4bd5-4219-9973-01913c208fef\":{\"columns\":{\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\":{\"label\":\"@timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"@timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"800c3857-3c9c-4fc5-a403-3fcbede05599\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"1e026cf2-cc40-41b2-a12f-c75d0058eac7\",\"800c3857-3c9c-4fc5-a403-3fcbede05599\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"logs-*\"}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events by Time\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":42,\"w\":48,\"h\":4,\"i\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},\"panelIndex\":\"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":46,\"w\":24,\"h\":15,\"i\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},\"panelIndex\":\"755f30aa-d6ad-46d9-b2c3-7425c02ed03e\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logon events (filter by LogonId)\",\"panelRefName\":\"panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":46,\"w\":24,\"h\":15,\"i\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\"},\"panelIndex\":\"bb42b25e-f934-485b-854c-440cc1b3ebee\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User logoff events (correlate to logon events)\",\"panelRefName\":\"panel_bb42b25e-f934-485b-854c-440cc1b3ebee\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":24,\"h\":15,\"i\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"},\"panelIndex\":\"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"In person vs Remote logons\",\"panelRefName\":\"panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f\"}]","timeRestore":false,"title":"User HR 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"ecd4d739-f7d2-4c79-abb9-af3fd2a6806d:panel_ecd4d739-f7d2-4c79-abb9-af3fd2a6806d","type":"links"},{"id":"logs-*","name":"c8d3e871-1f5d-40bd-a0f9-5441a58cad32:indexpattern-datasource-layer-23f1f6ab-b8b6-47e2-a508-4b3f368cb093","type":"index-pattern"},{"id":"logs-*","name":"69771c75-8536-49b2-a835-c134ada8cd8d:indexpattern-datasource-layer-f67bbe9f-ae2f-4601-8fec-3a935e9f9ff2","type":"index-pattern"},{"id":"a64ec020-84b4-11ea-b7fb-01bea49d9239","name":"ab726ae4-6c98-4f26-8cd3-07bf2808b704:panel_ab726ae4-6c98-4f26-8cd3-07bf2808b704","type":"visualization"},{"id":"eafe31b0-8a22-11ea-9ff6-ed89e356f0e4","name":"f2f654b0-42ef-403c-bee2-7e26499f809a:panel_f2f654b0-42ef-403c-bee2-7e26499f809a","type":"visualization"},{"id":"logs-*","name":"e40e6077-f799-4c66-9bf8-1664121d8069:indexpattern-datasource-layer-f46d1729-4bd5-4219-9973-01913c208fef","type":"index-pattern"},{"id":"20387200-8a23-11ea-9ff6-ed89e356f0e4","name":"8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e:panel_8fc3d2d7-94e5-468d-9fa1-6ee2901ceb2e","type":"visualization"},{"id":"2fa5fa00-8a1e-11ea-9ff6-ed89e356f0e4","name":"755f30aa-d6ad-46d9-b2c3-7425c02ed03e:panel_755f30aa-d6ad-46d9-b2c3-7425c02ed03e","type":"search"},{"id":"e02eb1f0-8a1e-11ea-9ff6-ed89e356f0e4","name":"bb42b25e-f934-485b-854c-440cc1b3ebee:panel_bb42b25e-f934-485b-854c-440cc1b3ebee","type":"search"},{"id":"b4cccab0-8a23-11ea-9ff6-ed89e356f0e4","name":"9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f:panel_9cdb2eb7-3c55-4e81-ba4b-9b4f1b31c59f","type":"visualization"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MSwxXQ=="} +{"attributes":{"layout":"vertical","links":[{"destinationRefName":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","id":"f002a04e-05b9-4b0e-862a-b0737b0fcc7d","order":0,"type":"dashboardLink"},{"destinationRefName":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","id":"fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1","order":1,"type":"dashboardLink"},{"destinationRefName":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","id":"4a789d96-55a1-4d28-9e97-950bb150397f","order":2,"type":"dashboardLink"},{"destinationRefName":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","id":"1a2ef245-e023-4af9-8798-6a012ac5a9ac","order":3,"type":"dashboardLink"},{"destinationRefName":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","id":"bd24a361-4123-4d7a-82b6-a2c7c20414f2","order":4,"type":"dashboardLink"},{"destinationRefName":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","id":"49b455da-4a39-4c33-ac97-006a2a64c22e","order":5,"type":"dashboardLink"},{"destinationRefName":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","id":"585265f5-693a-4f0e-a824-d0e36ae2f821","order":6,"type":"dashboardLink"},{"destinationRefName":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","id":"706a6fd1-1a22-46dc-829a-960f1897b511","order":7,"type":"dashboardLink"},{"destinationRefName":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","id":"0dde1941-a105-4eb7-ade8-054e4465a9cb","order":8,"type":"dashboardLink"},{"destinationRefName":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","id":"5dc55829-39b3-439d-b18d-2327c4def786","order":9,"type":"dashboardLink"},{"destinationRefName":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","id":"ff056d48-316f-439e-94d6-95af7324ad81","order":10,"type":"dashboardLink"},{"destinationRefName":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","id":"a3da514f-4d57-473a-a3cd-8b5eb6793adf","order":11,"type":"dashboardLink"}],"title":"Logging Made Easy Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","managed":false,"references":[{"id":"baa4f981-0c75-43da-b96e-1107f171dfaa","name":"link_f002a04e-05b9-4b0e-862a-b0737b0fcc7d_dashboard","type":"dashboard"},{"id":"ce98c19b-587f-4d76-9c49-2e9acee257d5","name":"link_fe1daec6-0f7a-46ad-8228-c39f1ac2e5d1_dashboard","type":"dashboard"},{"id":"e4d7b207-99aa-4410-8a2e-03487222bda1","name":"link_4a789d96-55a1-4d28-9e97-950bb150397f_dashboard","type":"dashboard"},{"id":"fff78bfe-2758-4fa1-939f-362380fc607d","name":"link_1a2ef245-e023-4af9-8798-6a012ac5a9ac_dashboard","type":"dashboard"},{"id":"32ed7a33-b22e-4c4b-b4bd-a55c2cf4c0d0","name":"link_bd24a361-4123-4d7a-82b6-a2c7c20414f2_dashboard","type":"dashboard"},{"id":"614a8392-17b5-49c4-9397-bc3cac526c61","name":"link_49b455da-4a39-4c33-ac97-006a2a64c22e_dashboard","type":"dashboard"},{"id":"09d32fc8-e1d1-418a-8793-507ed5430d3d","name":"link_585265f5-693a-4f0e-a824-d0e36ae2f821_dashboard","type":"dashboard"},{"id":"cf38381a-e9e1-4b28-914e-0819fb59e53c","name":"link_706a6fd1-1a22-46dc-829a-960f1897b511_dashboard","type":"dashboard"},{"id":"beeeb066-d497-4b2a-99d3-44d741238bd1","name":"link_0dde1941-a105-4eb7-ade8-054e4465a9cb_dashboard","type":"dashboard"},{"id":"3e1721f1-7056-4a8e-8b63-f75a9bbb37b5","name":"link_5dc55829-39b3-439d-b18d-2327c4def786_dashboard","type":"dashboard"},{"id":"ff0170e5-e0ef-4ca1-8188-c7bb9d736898","name":"link_ff056d48-316f-439e-94d6-95af7324ad81_dashboard","type":"dashboard"},{"id":"2fc36188-8461-4927-932e-0e452b7dc3ac","name":"link_a3da514f-4d57-473a-a3cd-8b5eb6793adf_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"},"title":"Security - Select User","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select User\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1587572089136\",\"label\":\"Domain(s)\",\"options\":{\"dynamicOptions\":true,\"multiselect\":true,\"order\":\"desc\",\"size\":5,\"type\":\"terms\"},\"parent\":\"\",\"type\":\"list\",\"fieldName\":\"winlog.user.domain\",\"indexPatternRefName\":\"control_0_index_pattern\"},{\"id\":\"1587713561601\",\"fieldName\":\"winlog.user.name\",\"parent\":\"1587572089136\",\"label\":\"Username(s)\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_1_index_pattern\"}],\"pinFilters\":false,\"updateFiltersOnChange\":false,\"useTimeFilter\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4a675166-ce19-4836-9567-eda4ab46b3d5","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"},{"id":"logs-*","name":"control_1_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - Filter Hosts","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Security - Filter Hosts\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Event count\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Host name\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"8d476795-134d-4689-9050-a24b57adaa90","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"title":"Security - Select Host","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Select Host\",\"type\":\"input_control_vis\",\"aggs\":[],\"params\":{\"controls\":[{\"id\":\"1588685297382\",\"fieldName\":\"host.name\",\"parent\":\"\",\"label\":\"Host\",\"type\":\"list\",\"options\":{\"type\":\"terms\",\"multiselect\":true,\"dynamicOptions\":true,\"size\":5,\"order\":\"desc\"},\"indexPatternRefName\":\"control_0_index_pattern\"}],\"updateFiltersOnChange\":false,\"useTimeFilter\":false,\"pinFilters\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","managed":false,"references":[{"id":"logs-*","name":"control_0_index_pattern","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Logons Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logons Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Logons\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"4eccff45-c97a-480f-b593-4744922893e5","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NSwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"user.domain\",\"value\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"params\":[\"NT AUTHORITY\",\"Window Manager\",\"Font Driver Host\"],\"alias\":null,\"negate\":true,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"user.domain\":\"NT AUTHORITY\"}},{\"match_phrase\":{\"user.domain\":\"Window Manager\"}},{\"match_phrase\":{\"user.domain\":\"Font Driver Host\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human User Logon Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon attempts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon attempts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Login attempts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3f7d1f53-6b70-4235-879a-f149d98c9063","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon events over time","uiStateJSON":"{\"vis\":{\"colors\":{\"Failed attempts\":\"#BF1B00\",\"Successful atempts\":\"#629E51\"}}}","version":1,"visState":"{\"title\":\"Security - Logon events over time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":1,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-23T08:41:59.000Z\",\"max\":\"2020-04-23T08:56:59.000Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":0,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"legendSize\":\"auto\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"event.code:4625\",\"language\":\"lucene\"},\"label\":\"Failed attempts\"},{\"input\":{\"query\":\"event.code:4624\",\"language\":\"lucene\"},\"label\":\"Successful atempts\"}]}},{\"id\":\"3\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15m\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"42ae3f23-386c-4ceb-bb84-98879107338b","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4,624, 4,625\",\"params\":[\"4624\",\"4625\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}},{\"match_phrase\":{\"event.code\":\"4625\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts pie\",\"type\":\"pie\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Computers\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"winlog.event_data.TargetUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":25,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true,\"customLabel\":\"Computer\"},\"schema\":\"segment\"}],\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\",\"nestedLegend\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"emptySizeRatio\":0.3}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"},{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI2OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Logon hosts","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Logon hosts\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host.name\",\"customLabel\":\"Hosts\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","managed":false,"references":[{"id":"ca236bdc-289e-4f9d-8f5e-05d0c3da14f7","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MCwxXQ=="} +{"attributes":{"columns":["event.code","host.name","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.IpAddress","event.action","event.outcome","winlog.event_data.LogonType"],"description":"","grid":{"columns":{"user.domain":{"width":119},"user.name":{"width":134}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(event.code:4624 OR event.code:4625) and not user.name:*$\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Human Logon & Logoff events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Network Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Network Connections\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"80b03097-c117-44d0-8413-3c932d0886a2","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MiwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id : \\\"3\\\" and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"All network activity ","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"f02a3c3d-eb39-4347-91f7-d62bece13128","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3MywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Network Activity Line","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Network Activity Line\",\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Connections\",\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"30d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"}],\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Connections\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Connections\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#34130C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"HH:mm:ss\"}},\"params\":{\"date\":true,\"interval\":\"PT30S\",\"format\":\"HH:mm:ss\",\"bounds\":{\"min\":\"2020-04-24T15:29:10.918Z\",\"max\":\"2020-04-24T15:44:10.918Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}]},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\",\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"aa741894-2140-4529-a488-6d34ed57abef","managed":false,"references":[{"id":"f02a3c3d-eb39-4347-91f7-d62bece13128","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.DestinationHostname","destination.ip","winlog.event_data.DestinationIsIpv6","network.","process.executable","winlog.event_data.DestinationPort","winlog.event_data.Protocol","winlog.user.name","winlog.user.type","source.ip","winlog.event_data.SourceIsIpv6","source.port","network.protocol"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destionation.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_non_browsers_connection","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"50b150ad-5aff-4706-9229-d9bcb38255ef","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Overview - Processes with unusual network activity","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"title\":\"Overview - Processes with unusual network activity\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"params\":{\"field\":\"process.name\",\"size\":10,\"include\":\"\",\"json\":\"\",\"customLabel\":\"Process\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"string\"},\"params\":{},\"label\":\"Process\",\"aggType\":\"significant_terms\"}]},\"showToolbar\":true,\"autoFitRowToContent\":false}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","managed":false,"references":[{"id":"50b150ad-5aff-4706-9229-d9bcb38255ef","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NiwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetUserName","winlog.event_data.TargetDomainName","winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.ProcessId","winlog.event_data.ProcessName"],"description":"","grid":{"columns":{"winlog.event_data.SubjectDomainName":{"width":216}}},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") and event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_non_private_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Processes Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Processes Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Processes & Powershell\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OCwxXQ=="} +{"attributes":{"columns":["host.name","winlog.event_data.TargetDomainName","winlog.event_data.User","winlog.event_data.ProcessId","winlog.event_data.ProcessName","winlog.event_data.Hashes","process.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"event.code:\\\"1\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Process Spawns","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI3OSwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.command_line","process.parent.executable","process.parent.command_line","file.path","event.code"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"kuery\",\"query\":\"process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\" OR process.command_line.text:\\\"powershell\\\" OR parent.process.command_line.text:\\\"powershell\\\"\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_sd_powershell_run","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell Run Count","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Security - Powershell Run Count\",\"type\":\"metric\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Powershell runs over time","uiStateJSON":"{}","version":1,"visState":"{\"type\":\"line\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now/w\",\"to\":\"now/w\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"dimensions\":{\"x\":null,\"y\":[{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"normal\",\"show\":\"true\",\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#34130C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}],\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"isVislibVis\":true,\"detailedTooltip\":true,\"fittingFunction\":\"zero\",\"legendSize\":\"auto\"},\"title\":\"Security - Powershell runs over time\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"Security - Power shell hosts pie","uiStateJSON":"{}","version":1,"visState":"{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"host.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":0,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\",\"legendSize\":\"auto\"},\"title\":\"Security - Power shell hosts pie\",\"type\":\"pie\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","managed":false,"references":[{"id":"dd7d1b84-be2f-4dd5-bff9-5dc3d41cca62","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","process.executable","process.args","process.parent.executable","process.parent.args"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"(process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND process.command_line.text:(\\\"invoke\\\" or \\\"bypass\\\" or \\\"iex\\\" or \\\"ex\\\" or \\\"icm\\\" or \\\"new-object\\\" or \\\"set\\\" or \\\"get\\\" or \\\"write\\\" or \\\"out\\\" or \\\"download\\\" or \\\"encoded\\\")\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Potentially Suspicious Powershell","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MiwxXQ=="} +{"attributes":{"columns":["user.domain","user.name","host.name","destination.domain","destination.ip"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id:3 AND (process.parent.name:\\\"powershell.exe\\\" OR process.name:\\\"powershell.exe\\\" OR winlog.event_data.OriginalFileName:\\\"PowerShell.EXE\\\") AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"srch_uds_powershell_network","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"04c60a34-98a9-4073-8538-97996e80855f","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE3NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Files title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Files title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Files\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4MywxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"file.path.text: \\\"tmp\\\" OR file.path.text:\\\"temp\\\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"file.path\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"exists\":{\"field\":\"file.path\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"TEMP & %TEMP%","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d3792434-6184-44ed-bad4-830249085d68","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NCwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"TEMP & %TEMP%","uiStateJSON":"{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}","version":1,"visState":"{\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"file.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target File\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"host.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":30,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Hostname\"}}],\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"percentageCol\":\"\",\"showToolbar\":true},\"title\":\"TEMP & %TEMP%\"}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","managed":false,"references":[{"id":"d3792434-6184-44ed-bad4-830249085d68","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NSwxXQ=="} +{"attributes":{"columns":["@timestamp","user.domain","user.name","host.name","process.executable","winlog.event_data.ProcessId"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: \\\"9\\\" AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Raw Access Events","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NiwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"title":"Security - Windows Defender Title","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - Windows Defender Title\",\"type\":\"markdown\",\"params\":{\"markdown\":\"## Windows Defender\",\"openLinksInNewTab\":false,\"fontSize\":12},\"aggs\":[]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"a2cdbce1-9070-4851-909f-774a80d2875a","managed":false,"references":[],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4NywxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"title":"Security - AV Events Count","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"Security - AV Events Count\",\"type\":\"metric\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"customLabel\":\"Windows AV Events\",\"emptyAsNull\":false},\"schema\":\"metric\"}],\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"}}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"6ac9a9da-1772-483c-8c32-b049f0273186","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OCwxXQ=="} +{"attributes":{"columns":[],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"winlog.event_id\",\"value\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"params\":[\"1006\",\"1007\",\"1008\",\"1009\",\"1116\",\"1117\",\"1118\",\"1119\"],\"negate\":false,\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"winlog.event_id\":\"1006\"}},{\"match_phrase\":{\"winlog.event_id\":\"1007\"}},{\"match_phrase\":{\"winlog.event_id\":\"1008\"}},{\"match_phrase\":{\"winlog.event_id\":\"1009\"}},{\"match_phrase\":{\"winlog.event_id\":\"1116\"}},{\"match_phrase\":{\"winlog.event_id\":\"1117\"}},{\"match_phrase\":{\"winlog.event_id\":\"1118\"}},{\"match_phrase\":{\"winlog.event_id\":\"1119\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"AV Detection event","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI4OSwxXQ=="} +{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"},"savedSearchRefName":"search_0","title":"AV Hits (Count)","uiStateJSON":"{}","version":1,"visState":"{\"title\":\"AV Hits (Count)\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"AV Detection hits\"}}]}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"fe86395f-474e-43a1-a772-34d1306373e0","managed":false,"references":[{"id":"60f38e0b-274f-44d6-9b66-fa83080c88bb","name":"search_0","type":"search"}],"type":"visualization","typeMigrationVersion":"8.5.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MCwxXQ=="} +{"attributes":{"columns":["winlog.event_data.Detection User","host.name","winlog.event_data.Path","winlog.event_data.FWLink"],"description":"","grid":{},"hideChart":false,"hits":0,"isTextBasedQuery":false,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"winlog.event_id: 1116\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"negate\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"Microsoft-Windows-Windows Defender\"},\"disabled\":false,\"alias\":null,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"$state\":{\"store\":\"appState\"},\"query\":{\"match_phrase\":{\"event.provider\":{\"query\":\"Microsoft-Windows-Windows Defender\"}}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"},"sort":[["@timestamp","desc"]],"timeRestore":false,"title":"Defender AV Detections","usesAdHocDataView":false,"version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","managed":false,"references":[{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"logs-*","name":"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index","type":"index-pattern"}],"type":"search","typeMigrationVersion":"10.4.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MSwxXQ=="} +{"attributes":{"description":"User Security overview, filtered by Domain / Username or hostname","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":21,\"i\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},\"panelIndex\":\"1dd50c7d-7e5d-439d-9071-544339f6ef3f\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":0,\"w\":15,\"h\":11,\"i\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},\"panelIndex\":\"956d6ef1-5d6b-4ccc-a123-fa66805c15db\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search users\",\"panelRefName\":\"panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db\"},{\"type\":\"visualization\",\"gridData\":{\"x\":23,\"y\":0,\"w\":25,\"h\":11,\"i\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\"},\"panelIndex\":\"62ea04ec-0776-46c0-9b8c-cf2915600337\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Filter hosts\",\"panelRefName\":\"panel_62ea04ec-0776-46c0-9b8c-cf2915600337\"},{\"type\":\"visualization\",\"gridData\":{\"x\":8,\"y\":11,\"w\":15,\"h\":10,\"i\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\"},\"panelIndex\":\"45ac8571-ae44-4bb5-a237-cd230ede51d5\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Search hosts\",\"panelRefName\":\"panel_45ac8571-ae44-4bb5-a237-cd230ede51d5\"},{\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":11,\"w\":25,\"h\":10,\"i\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\"},\"panelIndex\":\"1324f39e-f215-45e9-b679-05b06e4fcb9d\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\",\"isTransposed\":false},{\"columnId\":\"26752485-2aa5-4908-b400-504d6e7ef451\",\"isTransposed\":false},{\"columnId\":\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d123adeb-fd39-4176-b3c9-69c88d2852d5\",\"layerType\":\"data\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d123adeb-fd39-4176-b3c9-69c88d2852d5\":{\"columns\":{\"6f33ff19-9959-4c43-b791-939582a0b3d2\":{\"label\":\"Event Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"26752485-2aa5-4908-b400-504d6e7ef451\":{\"label\":\"Filters\",\"dataType\":\"string\",\"operationType\":\"filters\",\"scale\":\"ordinal\",\"isBucketed\":true,\"params\":{\"filters\":[{\"label\":\"\",\"input\":{\"query\":\"\\\"log\\\" : *\",\"language\":\"kuery\"}}]}},\"cc4e45f6-be3a-4de0-a416-e21043b601bb\":{\"label\":\"Top 3 values of user.domain\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"user.domain\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"6f33ff19-9959-4c43-b791-939582a0b3d2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"26752485-2aa5-4908-b400-504d6e7ef451\",\"cc4e45f6-be3a-4de0-a416-e21043b601bb\",\"6f33ff19-9959-4c43-b791-939582a0b3d2\"],\"sampling\":1,\"indexPatternId\":\"logs-*\",\"incompleteColumns\":{}}},\"currentIndexPatternId\":\"logs-*\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Filter users\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":21,\"w\":48,\"h\":5,\"i\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},\"panelIndex\":\"b453a1df-c025-430b-84e3-d6dc7a8c48f1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":26,\"w\":9,\"h\":7,\"i\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\"},\"panelIndex\":\"e5de9fc4-5863-470c-8246-0a86f5af897e\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_e5de9fc4-5863-470c-8246-0a86f5af897e\"},{\"type\":\"visualization\",\"gridData\":{\"x\":9,\"y\":26,\"w\":20,\"h\":14,\"i\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},\"panelIndex\":\"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logon attempts\",\"panelRefName\":\"panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48\"},{\"type\":\"visualization\",\"gridData\":{\"x\":29,\"y\":26,\"w\":19,\"h\":14,\"i\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},\"panelIndex\":\"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Logged on computers\",\"panelRefName\":\"panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":33,\"w\":9,\"h\":7,\"i\":\"0d1c0533-598a-4304-80be-c22047edcbe1\"},\"panelIndex\":\"0d1c0533-598a-4304-80be-c22047edcbe1\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0d1c0533-598a-4304-80be-c22047edcbe1\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":40,\"w\":48,\"h\":17,\"i\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},\"panelIndex\":\"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"User Logon & Logoff Events\",\"panelRefName\":\"panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":57,\"w\":48,\"h\":4,\"i\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\"},\"panelIndex\":\"0fab3d76-5411-46e4-982f-4d4626c977b8\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_0fab3d76-5411-46e4-982f-4d4626c977b8\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":61,\"w\":48,\"h\":14,\"i\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},\"panelIndex\":\"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"All network connections\",\"panelRefName\":\"panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305\"},{\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":75,\"w\":24,\"h\":15,\"i\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\"},\"panelIndex\":\"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network Process List (converted)\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\"}],\"state\":{\"visualization\":{\"layerId\":\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\",\"layerType\":\"data\",\"columns\":[{\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\",\"alignment\":\"left\"},{\"columnId\":\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"alignment\":\"left\"},{\"columnId\":\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"alignment\":\"left\"},{\"columnId\":\"f467badb-5f40-4b21-bdaf-f378db834902\",\"isTransposed\":false,\"isMetric\":false}],\"paging\":{\"enabled\":true,\"size\":10},\"rowHeight\":\"single\",\"headerRowHeight\":\"single\"},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f\":{\"ignoreGlobalFilters\":false,\"columns\":{\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\":{\"label\":\"Destination IP\",\"dataType\":\"ip\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"destination.ip\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\":{\"label\":\"Computer\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"host.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5330e606-7244-4d38-a5a3-d94d5c6412c2\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"f467badb-5f40-4b21-bdaf-f378db834902\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"3a907ac1-e9b4-4f44-b86a-38e8f6fccac0\",\"c9a8438c-c0bd-4612-91a5-bc8b656c0aeb\",\"f467badb-5f40-4b21-bdaf-f378db834902\",\"5330e606-7244-4d38-a5a3-d94d5c6412c2\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network Process List\"},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":75,\"w\":24,\"h\":15,\"i\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\"},\"panelIndex\":\"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Security - Network connections area (converted)\",\"description\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"logs-*\",\"name\":\"indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar\",\"layers\":[{\"layerId\":\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\",\"seriesType\":\"bar\",\"xAccessor\":\"70a3abae-7040-4287-97d3-550088410400\",\"accessors\":[\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"layerType\":\"data\",\"colorMapping\":{\"assignments\":[],\"specialAssignments\":[{\"rule\":{\"type\":\"other\"},\"color\":{\"type\":\"loop\"},\"touched\":false}],\"paletteId\":\"eui_amsterdam_color_blind\",\"colorMode\":{\"type\":\"categorical\"}}}]},\"query\":{\"query\":\"winlog.event_id:3 AND NOT (destination.ip:\\\"10.0.0.0/8\\\" OR destination.ip:\\\"172.16.0.0/16\\\" OR destination.ip:\\\"192.168.0.0/16\\\" OR destination.ip:\\\"224.0.0.0/24\\\" OR destination.ip:\\\"169.254.0.0/16\\\" OR destination.ip:\\\"127.0.0.1\\\" OR destination.ip:\\\"fe80::/10\\\" OR destination.ip:\\\"fc00::/7\\\") AND NOT (process.name:iexplore.exe OR process.name:chrome.exe OR process.name:firefox.exe OR process.name:opera.exe) AND event.provider : \\\"Microsoft-Windows-Sysmon\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c40c5dde-12e2-41c1-b839-9a6e82c70ad9\":{\"ignoreGlobalFilters\":false,\"columns\":{\"70a3abae-7040-4287-97d3-550088410400\":{\"label\":\"Process Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"process.name\",\"isBucketed\":true,\"params\":{\"size\":10,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0fbfe911-4334-4e6f-8256-b72f2a280259\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"0fbfe911-4334-4e6f-8256-b72f2a280259\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"70a3abae-7040-4287-97d3-550088410400\",\"0fbfe911-4334-4e6f-8256-b72f2a280259\"],\"incompleteColumns\":{}}}},\"indexpattern\":{\"layers\":{}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"description\":\"\",\"enhancements\":{}},\"title\":\"Security - Network connections area\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":90,\"w\":48,\"h\":15,\"i\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},\"panelIndex\":\"6d5d4b74-133b-4fef-8ae5-14d2e7037a78\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Unusual network connections from non-browser processes\",\"panelRefName\":\"panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":105,\"w\":48,\"h\":10,\"i\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\"},\"panelIndex\":\"ea6ad677-7322-4c5c-8946-cac4dd983b26\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Network Connection Events (Sysmon ID 3)\",\"panelRefName\":\"panel_ea6ad677-7322-4c5c-8946-cac4dd983b26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":115,\"w\":48,\"h\":4,\"i\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\"},\"panelIndex\":\"43b61744-5553-4fd1-894c-6e91a799f4a2\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_43b61744-5553-4fd1-894c-6e91a799f4a2\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":119,\"w\":48,\"h\":14,\"i\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\"},\"panelIndex\":\"9a522603-8d31-4ad6-ac4f-130a814f54fa\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Spawned Processes\",\"panelRefName\":\"panel_9a522603-8d31-4ad6-ac4f-130a814f54fa\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":133,\"w\":10,\"h\":15,\"i\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},\"panelIndex\":\"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell Events\",\"panelRefName\":\"panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6\"},{\"type\":\"visualization\",\"gridData\":{\"x\":10,\"y\":133,\"w\":20,\"h\":15,\"i\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},\"panelIndex\":\"68d75f76-3806-4d15-81e9-d0dcfa34c9b9\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events over time\",\"panelRefName\":\"panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9\"},{\"type\":\"visualization\",\"gridData\":{\"x\":30,\"y\":133,\"w\":18,\"h\":15,\"i\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\"},\"panelIndex\":\"ed7a59ea-caa7-4396-89b7-90c6b8363800\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell events by computer\",\"panelRefName\":\"panel_ed7a59ea-caa7-4396-89b7-90c6b8363800\"},{\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":148,\"w\":25,\"h\":16,\"i\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},\"panelIndex\":\"cfe390f9-80a7-4a11-9a8c-7d599e41e38a\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Potentially suspicious powershell\",\"panelRefName\":\"panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a\"},{\"type\":\"search\",\"gridData\":{\"x\":25,\"y\":148,\"w\":23,\"h\":16,\"i\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\"},\"panelIndex\":\"9587ef7f-3554-4886-be6a-fae4648e87dd\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Powershell network connections\",\"panelRefName\":\"panel_9587ef7f-3554-4886-be6a-fae4648e87dd\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":164,\"w\":48,\"h\":4,\"i\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},\"panelIndex\":\"7cfff19f-bf9d-4101-be63-4d9b8ea78e26\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":168,\"w\":24,\"h\":15,\"i\":\"4988f659-a275-4317-b071-8a350087a4e6\"},\"panelIndex\":\"4988f659-a275-4317-b071-8a350087a4e6\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"References to temporary files\",\"panelRefName\":\"panel_4988f659-a275-4317-b071-8a350087a4e6\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":168,\"w\":24,\"h\":15,\"i\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},\"panelIndex\":\"bfae12f4-b2fd-471f-a111-daf49cd25ed3\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"RawAccessRead (Sysmon Event 9)\",\"panelRefName\":\"panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":183,\"w\":48,\"h\":4,\"i\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},\"panelIndex\":\"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b\"},{\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":187,\"w\":12,\"h\":14,\"i\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},\"panelIndex\":\"e8c5ac63-42b4-4081-85e3-378c85c0b4cb\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"Defender event count\",\"panelRefName\":\"panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb\"},{\"type\":\"visualization\",\"gridData\":{\"x\":12,\"y\":187,\"w\":12,\"h\":14,\"i\":\"30454a55-0210-43d2-af3d-822c5b519033\"},\"panelIndex\":\"30454a55-0210-43d2-af3d-822c5b519033\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_30454a55-0210-43d2-af3d-822c5b519033\"},{\"type\":\"search\",\"gridData\":{\"x\":24,\"y\":187,\"w\":24,\"h\":14,\"i\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"},\"panelIndex\":\"6ff4d4db-16b6-4c80-8bb6-95e009803d1d\",\"embeddableConfig\":{\"enhancements\":{}},\"title\":\"AV Detections (Event 1116)\",\"panelRefName\":\"panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d\"}]","timeRestore":false,"title":"User Security 2.0","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-01T16:00:38.476Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"2fc36188-8461-4927-932e-0e452b7dc3ac","managed":false,"references":[{"id":"df98db90-8920-4a8a-ab3f-23e7ecb41f37","name":"1dd50c7d-7e5d-439d-9071-544339f6ef3f:panel_1dd50c7d-7e5d-439d-9071-544339f6ef3f","type":"links"},{"id":"4a675166-ce19-4836-9567-eda4ab46b3d5","name":"956d6ef1-5d6b-4ccc-a123-fa66805c15db:panel_956d6ef1-5d6b-4ccc-a123-fa66805c15db","type":"visualization"},{"id":"8d476795-134d-4689-9050-a24b57adaa90","name":"62ea04ec-0776-46c0-9b8c-cf2915600337:panel_62ea04ec-0776-46c0-9b8c-cf2915600337","type":"visualization"},{"id":"5c4b0b82-4972-40fe-b2ee-86c366342a98","name":"45ac8571-ae44-4bb5-a237-cd230ede51d5:panel_45ac8571-ae44-4bb5-a237-cd230ede51d5","type":"visualization"},{"id":"logs-*","name":"1324f39e-f215-45e9-b679-05b06e4fcb9d:indexpattern-datasource-layer-d123adeb-fd39-4176-b3c9-69c88d2852d5","type":"index-pattern"},{"id":"4eccff45-c97a-480f-b593-4744922893e5","name":"b453a1df-c025-430b-84e3-d6dc7a8c48f1:panel_b453a1df-c025-430b-84e3-d6dc7a8c48f1","type":"visualization"},{"id":"3f7d1f53-6b70-4235-879a-f149d98c9063","name":"e5de9fc4-5863-470c-8246-0a86f5af897e:panel_e5de9fc4-5863-470c-8246-0a86f5af897e","type":"visualization"},{"id":"42ae3f23-386c-4ceb-bb84-98879107338b","name":"8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48:panel_8f7f6de1-8c0f-4a35-8d03-1c4e01e72c48","type":"visualization"},{"id":"1e3228b7-ae0f-4e37-8586-558d4eb63d23","name":"c53cdf71-278e-4972-9e0d-cd9b3b75c2e2:panel_c53cdf71-278e-4972-9e0d-cd9b3b75c2e2","type":"visualization"},{"id":"b019f88f-c449-4d6f-b812-78ed5a9248a9","name":"0d1c0533-598a-4304-80be-c22047edcbe1:panel_0d1c0533-598a-4304-80be-c22047edcbe1","type":"visualization"},{"id":"e077e6a8-f42a-4444-bcb4-19b8916163fe","name":"1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396:panel_1a7e0e6d-e2dd-4bb3-8d5e-432d9ac12396","type":"search"},{"id":"80b03097-c117-44d0-8413-3c932d0886a2","name":"0fab3d76-5411-46e4-982f-4d4626c977b8:panel_0fab3d76-5411-46e4-982f-4d4626c977b8","type":"visualization"},{"id":"aa741894-2140-4529-a488-6d34ed57abef","name":"b0ec1bf9-7f59-4cc9-9f9c-40aba7375305:panel_b0ec1bf9-7f59-4cc9-9f9c-40aba7375305","type":"visualization"},{"id":"logs-*","name":"f068f3e0-1c90-4f9d-93ca-a7e7c96df39c:indexpattern-datasource-layer-bbc7aa87-f2fa-4604-a2ab-d2f3997ed32f","type":"index-pattern"},{"id":"logs-*","name":"6da7d5e7-a679-42d4-b2f7-bb3c958ab16b:indexpattern-datasource-layer-c40c5dde-12e2-41c1-b839-9a6e82c70ad9","type":"index-pattern"},{"id":"5e7314fa-49ae-4328-b799-017c6a3c4fbb","name":"6d5d4b74-133b-4fef-8ae5-14d2e7037a78:panel_6d5d4b74-133b-4fef-8ae5-14d2e7037a78","type":"visualization"},{"id":"e35a92e5-1ca7-4c49-8f92-bba46bb6b8f4","name":"ea6ad677-7322-4c5c-8946-cac4dd983b26:panel_ea6ad677-7322-4c5c-8946-cac4dd983b26","type":"search"},{"id":"b54164ff-6ee5-47d6-a42b-8ac2cec9cad9","name":"43b61744-5553-4fd1-894c-6e91a799f4a2:panel_43b61744-5553-4fd1-894c-6e91a799f4a2","type":"visualization"},{"id":"826cccdc-b0be-4819-aab4-4082eb2ea6b5","name":"9a522603-8d31-4ad6-ac4f-130a814f54fa:panel_9a522603-8d31-4ad6-ac4f-130a814f54fa","type":"search"},{"id":"bf65ea9e-3cf4-4394-ace6-e45968bdfaf6","name":"fad5ef2b-1cc8-47bd-832b-48aeb713f6e6:panel_fad5ef2b-1cc8-47bd-832b-48aeb713f6e6","type":"visualization"},{"id":"28a2a074-23e1-4739-a9c0-1f04e4416aab","name":"68d75f76-3806-4d15-81e9-d0dcfa34c9b9:panel_68d75f76-3806-4d15-81e9-d0dcfa34c9b9","type":"visualization"},{"id":"04061d59-6e1f-46f4-887b-e1877e32a7fc","name":"ed7a59ea-caa7-4396-89b7-90c6b8363800:panel_ed7a59ea-caa7-4396-89b7-90c6b8363800","type":"visualization"},{"id":"3617dcd4-57c2-404c-a865-74ef3cddf9cb","name":"cfe390f9-80a7-4a11-9a8c-7d599e41e38a:panel_cfe390f9-80a7-4a11-9a8c-7d599e41e38a","type":"search"},{"id":"04c60a34-98a9-4073-8538-97996e80855f","name":"9587ef7f-3554-4886-be6a-fae4648e87dd:panel_9587ef7f-3554-4886-be6a-fae4648e87dd","type":"search"},{"id":"77c2b538-1477-4bf8-bdde-6dcf0605b596","name":"7cfff19f-bf9d-4101-be63-4d9b8ea78e26:panel_7cfff19f-bf9d-4101-be63-4d9b8ea78e26","type":"visualization"},{"id":"45809ac4-b7f7-47b9-87c4-2317cfda1493","name":"4988f659-a275-4317-b071-8a350087a4e6:panel_4988f659-a275-4317-b071-8a350087a4e6","type":"visualization"},{"id":"bcf814ff-fe22-40ed-882d-2c77f3c3e7d5","name":"bfae12f4-b2fd-471f-a111-daf49cd25ed3:panel_bfae12f4-b2fd-471f-a111-daf49cd25ed3","type":"search"},{"id":"a2cdbce1-9070-4851-909f-774a80d2875a","name":"a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b:panel_a4f5d22b-fe87-4488-8d26-d0d9cdd10d6b","type":"visualization"},{"id":"6ac9a9da-1772-483c-8c32-b049f0273186","name":"e8c5ac63-42b4-4081-85e3-378c85c0b4cb:panel_e8c5ac63-42b4-4081-85e3-378c85c0b4cb","type":"visualization"},{"id":"fe86395f-474e-43a1-a772-34d1306373e0","name":"30454a55-0210-43d2-af3d-822c5b519033:panel_30454a55-0210-43d2-af3d-822c5b519033","type":"visualization"},{"id":"1344681a-24b5-4829-b4d6-ec18d2de5ba5","name":"6ff4d4db-16b6-4c80-8bb6-95e009803d1d:panel_6ff4d4db-16b6-4c80-8bb6-95e009803d1d","type":"search"},{"id":"05484269-a438-43a1-8114-4f32479f51c4","name":"tag-ref-05484269-a438-43a1-8114-4f32479f51c4","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-01T16:00:38.476Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzI5MiwxXQ=="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":123,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/wazuh/wazuh_incident_response.dumped.ndjson b/dashboards/wazuh/wazuh_incident_response.dumped.ndjson new file mode 100644 index 00000000..8dec1437 --- /dev/null +++ b/dashboards/wazuh/wazuh_incident_response.dumped.ndjson @@ -0,0 +1,9 @@ +{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-alerts-4.x-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"timestamp","title":"wazuh-alerts-4.x-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTQsMV0="} +{"attributes":{"color":"#3f38b0","description":"","name":"wazuh"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzUxLDFd"} +{"attributes":{"description":"Displays and categorizes Wazuh security related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":34,\"i\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\"},\"panelIndex\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d70ade40-d606-45b2-97e2-3f0e7612df49\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":5,\"i\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\"},\"panelIndex\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"accessor\":\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1E75B6\",\"stop\":300}],\"colorStops\":[{\"color\":\"#1E75B6\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\":{\"columns\":{\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\":{\"label\":\"Total\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":8,\"h\":5,\"i\":\"dc864252-a518-4187-80ca-b581ad14f1cb\"},\"panelIndex\":\"dc864252-a518-4187-80ca-b581ad14f1cb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"accessor\":\"65d5d9ac-208b-4393-b498-12f4351445bd\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#e57488\",\"stop\":8}],\"colorStops\":[{\"color\":\"#e57488\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"alias\":\"rule.level >= 12\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"range\\\":{\\\"rule.level\\\":{\\\"gte\\\":\\\"12\\\"}}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"range\":{\"rule.level\":{\"gte\":\"12\"}}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\":{\"columns\":{\"65d5d9ac-208b-4393-b498-12f4351445bd\":{\"label\":\"Level 12 or above alerts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.level >= 12\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"65d5d9ac-208b-4393-b498-12f4351445bd\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":8,\"h\":5,\"i\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\"},\"panelIndex\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"28318134-b7bd-4faa-b21e-b0a6665b526f\",\"accessor\":\"e1a6a50b-cffe-4c92-b756-bad658aee97d\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#d4458d\",\"stop\":4}],\"colorStops\":[{\"color\":\"#d4458d\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"alias\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"rule.groups\\\":\\\"authentication_failed\\\"}}],\\\"minimum_should_match\\\":1}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"win_authentication_failed\\\",\\\"lenient\\\":true}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"authentication_failures\\\",\\\"lenient\\\":true}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"term\":{\"rule.groups\":\"authentication_failed\"}}],\"minimum_should_match\":1}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"win_authentication_failed\",\"lenient\":true}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"authentication_failures\",\"lenient\":true}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"28318134-b7bd-4faa-b21e-b0a6665b526f\":{\"columns\":{\"e1a6a50b-cffe-4c92-b756-bad658aee97d\":{\"label\":\"Athentication failure\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"e1a6a50b-cffe-4c92-b756-bad658aee97d\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":0,\"w\":8,\"h\":5,\"i\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\"},\"panelIndex\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"accessor\":\"ea00d671-3e3a-434a-8813-1dfa3a023112\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1a938a\",\"stop\":2}],\"colorStops\":[{\"color\":\"#1a938a\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"exists\",\"key\":\"rule.groups\",\"value\":\"exists\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"rule.groups\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67c3da39-aad2-4ff4-812f-15cf135b2d12\":{\"columns\":{\"ea00d671-3e3a-434a-8813-1dfa3a023112\":{\"label\":\"Authentication success\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups: \\\"authentication_success\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ea00d671-3e3a-434a-8813-1dfa3a023112\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":5,\"w\":24,\"h\":14,\"i\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\"},\"panelIndex\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"accessors\":[\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"splitAccessor\":\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"xAccessor\":\"c5296771-93c8-48cb-bf57-cad19d8c829e\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"e8600050-5477-49a7-a28e-ce9a47ded5f5\":{\"columns\":{\"8d76d731-1e09-4706-b3d9-48108dd7dd32\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"c5296771-93c8-48cb-bf57-cad19d8c829e\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":false,\"dropPartials\":false}},\"3f2d0dea-171c-41ed-9452-29106c10a968\":{\"label\":\"Top 5 values of agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"c5296771-93c8-48cb-bf57-cad19d8c829e\",\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alerts evolution - Top 5 agents\"},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":5,\"w\":16,\"h\":14,\"i\":\"e35f33d0-784d-471a-842e-576523d0ca80\"},\"panelIndex\":\"e35f33d0-784d-471a-842e-576523d0ca80\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Top Mitre\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"pie\",\"layers\":[{\"layerId\":\"d2ef6c07-620f-431e-85f2-77175187e0fe\",\"primaryGroups\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\"],\"metrics\":[\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.3,\"legendSize\":\"xlarge\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d2ef6c07-620f-431e-85f2-77175187e0fe\":{\"columns\":{\"a676e778-cad9-431e-b520-3e87b3a0afb2\":{\"label\":\"Top 5 values of rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\",\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Top Mitre ATT&K tactics\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":19,\"w\":40,\"h\":15,\"i\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\"},\"panelIndex\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"isTransposed\":false,\"columnId\":\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\"},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"columnId\":\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"isTransposed\":false,\"oneClickFilter\":true}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c74264a6-eb65-4232-9444-a503723c6fdf\":{\"label\":\"rule.mitre.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Security Events","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d70ade40-d606-45b2-97e2-3f0e7612df49:panel_d70ade40-d606-45b2-97e2-3f0e7612df49","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"c90b5ced-c476-4336-8248-5f5eee09b7d3:indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:4cd727d8-200d-4869-b702-ff540bd3ff56","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:1b7728c2-28d0-40f9-81ed-74e77231242c","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:933a08d4-fd4c-4829-938c-df17bc87af15","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e:indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e35f33d0-784d-471a-842e-576523d0ca80:indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"ee6f5f4c-2a18-4733-a593-23c1f2a24376:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTUsMV0="} +{"attributes":{"allowHidden":false,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-states-vulnerabilities-wazuh-manager","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"vulnerability.detected_at","title":"wazuh-states-vulnerabilities-wazuh-manager"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:40:39.596Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:40:39.596Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE1NzIsMV0="} +{"attributes":{"controlGroupInput":{"chainingSystem":"HIERARCHICAL","controlStyle":"oneLine","ignoreParentSettingsJSON":"{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}","panelsJSON":"{\"ae4a6e83-4b41-41a1-ba66-baac4a181116\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ae4a6e83-4b41-41a1-ba66-baac4a181116\",\"fieldName\":\"agent.name\",\"title\":\"Host Name Filter\",\"grow\":true,\"width\":\"medium\",\"searchTechnique\":\"prefix\",\"selectedOptions\":[],\"exclude\":false,\"enhancements\":{}}}}","showApplySelections":false},"description":"Tracks wazuh's vulnerability related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":32,\"i\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},\"panelIndex\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":11,\"h\":5,\"i\":\"9931cceb-51f1-4e47-bd26-491e7a624592\"},\"panelIndex\":\"9931cceb-51f1-4e47-bd26-491e7a624592\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\"}],\"state\":{\"visualization\":{\"layerId\":\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\",\"layerType\":\"data\",\"metricAccessor\":\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\":{\"columns\":{\"fe99fb3f-debd-4796-9a1a-6277cae75abb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Critical Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":18,\"y\":0,\"w\":10,\"h\":5,\"i\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\"},\"panelIndex\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15\"}],\"state\":{\"visualization\":{\"layerId\":\"fd6049b6-e52c-449e-9775-ded5ac1eac15\",\"layerType\":\"data\",\"metricAccessor\":\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fd6049b6-e52c-449e-9775-ded5ac1eac15\":{\"columns\":{\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity: \\\"High\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"High Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":10,\"h\":5,\"i\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\"},\"panelIndex\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641\"}],\"state\":{\"visualization\":{\"layerId\":\"a8774fa0-5ae6-4746-94bd-cd21a0210641\",\"layerType\":\"data\",\"metricAccessor\":\"2a7bcb09-d553-456e-8af2-8194dff05293\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8774fa0-5ae6-4746-94bd-cd21a0210641\":{\"columns\":{\"2a7bcb09-d553-456e-8af2-8194dff05293\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Medium\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"2a7bcb09-d553-456e-8af2-8194dff05293\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Medium Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":38,\"y\":0,\"w\":10,\"h\":5,\"i\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\"},\"panelIndex\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3\"}],\"state\":{\"visualization\":{\"layerId\":\"a397e361-0b6a-4d18-b957-2afce890f6c3\",\"accessor\":\"33a61fcd-b356-40c3-9f38-ec1b6a607081\",\"layerType\":\"data\",\"colorMode\":\"None\",\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a397e361-0b6a-4d18-b957-2afce890f6c3\":{\"columns\":{\"33a61fcd-b356-40c3-9f38-ec1b6a607081\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Low\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"33a61fcd-b356-40c3-9f38-ec1b6a607081\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Low Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":5,\"w\":18,\"h\":14,\"i\":\"8fe06d85-091b-47aa-a809-aae9150a3314\"},\"panelIndex\":\"8fe06d85-091b-47aa-a809-aae9150a3314\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"CURVE_MONOTONE_X\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"47832b00-8a1a-4d99-8631-89379474c236\",\"accessors\":[\"32448531-8094-4131-89c9-38ed77a620ec\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"32448531-8094-4131-89c9-38ed77a620ec\",\"axisMode\":\"auto\"}],\"xAccessor\":\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"splitAccessor\":\"1cc61481-30d8-4719-b629-47daf49c7250\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"47832b00-8a1a-4d99-8631-89379474c236\":{\"columns\":{\"32448531-8094-4131-89c9-38ed77a620ec\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"00593c9d-f971-478e-98a6-78c781a6ae6d\":{\"label\":\"vulnerability.detected_at\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"vulnerability.detected_at\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1cc61481-30d8-4719-b629-47daf49c7250\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"32448531-8094-4131-89c9-38ed77a620ec\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"High\",\"Critical\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"1cc61481-30d8-4719-b629-47daf49c7250\",\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"32448531-8094-4131-89c9-38ed77a620ec\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert severity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":5,\"w\":23,\"h\":14,\"i\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\"},\"panelIndex\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsHeatmap\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\"}],\"state\":{\"visualization\":{\"shape\":\"heatmap\",\"layerId\":\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\",\"layerType\":\"data\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"type\":\"heatmap_legend\"},\"gridConfig\":{\"type\":\"heatmap_grid\",\"isCellLabelVisible\":false,\"isYAxisLabelVisible\":true,\"isXAxisLabelVisible\":true,\"isYAxisTitleVisible\":false,\"isXAxisTitleVisible\":true,\"yTitle\":\"\"},\"valueAccessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\",\"xAccessor\":\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"palette\":{\"type\":\"palette\",\"name\":\"positive\",\"params\":{\"name\":\"positive\",\"continuity\":\"above\",\"reverse\":false,\"stops\":[{\"color\":\"#d6e9e4\",\"stop\":0},{\"color\":\"#aed3ca\",\"stop\":20},{\"color\":\"#85bdb1\",\"stop\":40},{\"color\":\"#5aa898\",\"stop\":60},{\"color\":\"#209280\",\"stop\":80}],\"rangeMin\":0,\"rangeMax\":null},\"accessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"yAccessor\":\"fc5af013-78e6-40e3-8e64-8015aa4f721e\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\":{\"columns\":{\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":false},\"e8d69708-c954-444b-a94f-9eb1befd3197\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"fc5af013-78e6-40e3-8e64-8015aa4f721e\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\"],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"fc5af013-78e6-40e3-8e64-8015aa4f721e\",\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Vulnerabilities heat map\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":19,\"w\":41,\"h\":13,\"i\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\"},\"panelIndex\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"oneClickFilter\":true,\"width\":128.25},{\"isTransposed\":false,\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\",\"hidden\":true},{\"columnId\":\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"isTransposed\":false,\"isMetric\":false,\"width\":350},{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"7dcaf287-0461-4459-8009-4d870050dac4\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"e8f9533e-b4ee-4db5-a484-329645593766\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d94ddf3d-d285-450e-aba4-46057df55fb7\",\"layerType\":\"data\",\"paging\":{\"enabled\":true,\"size\":20},\"sorting\":{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"direction\":\"asc\"}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d94ddf3d-d285-450e-aba4-46057df55fb7\":{\"columns\":{\"542028d8-117e-4ee0-ba25-3ff4475940aa\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"f790607c-81f9-4567-82c3-feb4dc9126fe\":{\"label\":\"Vulnerability Severity Score\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"vulnerability.score.base\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"},\"customLabel\":true},\"4d9643e1-3799-4319-82a1-352650000378\":{\"label\":\"Vulnerability Severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"7dcaf287-0461-4459-8009-4d870050dac4\":{\"label\":\"Package Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"e8f9533e-b4ee-4db5-a484-329645593766\":{\"label\":\"Package Version\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.version\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"4d9643e1-3799-4319-82a1-352650000378\",\"7dcaf287-0461-4459-8009-4d870050dac4\",\"e8f9533e-b4ee-4db5-a484-329645593766\",\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Events\"}]","timeRestore":false,"title":"Wazuh Vulnerabilities","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"272fa8b1-b058-4d9b-945f-4369d2f8eb8c:panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c","type":"links"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"9931cceb-51f1-4e47-bd26-491e7a624592:indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"a0b05cdd-c4b5-46b0-af2e-32253bd965e6:indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"b22f2aba-370b-40f2-8f30-c7175fd21d84:indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"dad9436c-6a56-47cc-a52a-065c86d64c7f:indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"8fe06d85-091b-47aa-a809-aae9150a3314:indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"680cfedf-a868-4de2-8173-897f4df7f6d7:indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"5a8626af-2bc4-4317-ad7f-20622c16db0a:indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"controlGroup_ae4a6e83-4b41-41a1-ba66-baac4a181116:optionsListDataView","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T22:11:33.226Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2NjMsMV0="} +{"attributes":{"description":"This tracks Wazuh's malware related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":35,\"i\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},\"panelIndex\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":17,\"h\":14,\"i\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\"},\"panelIndex\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"LINEAR\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"accessors\":[\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"yConfig\":[{\"forAccessor\":\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\",\"color\":\"#40d4e0\"}]}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\":{\"columns\":{\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Emotet malware activity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":0,\"w\":23,\"h\":14,\"i\":\"cc5ad74e-c871-4ac3-9487-328adc286921\"},\"panelIndex\":\"cc5ad74e-c871-4ac3-9487-328adc286921\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"accessors\":[\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"splitAccessor\":\"52edc505-8c8a-4965-a3f3-46ca861738af\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5ccb00b3-1675-4c9f-a542-927c5930e66e\":{\"columns\":{\"52edc505-8c8a-4965-a3f3-46ca861738af\":{\"label\":\"Top 5 values of data.title\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.title\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]}},\"b662da8a-50ee-4dae-a2bb-25861753d95c\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"f001735e-ca2b-455d-a50a-b7f44b005f0b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"52edc505-8c8a-4965-a3f3-46ca861738af\",\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Rootkits activity over time\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":14,\"w\":40,\"h\":21,\"i\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\"},\"panelIndex\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\"},{\"isTransposed\":false,\"columnId\":\"1169cee0-a32f-48d2-8e12-2919736d710a\"},{\"isTransposed\":false,\"columnId\":\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"125edb0b-de81-41b8-9612-1d87188e2b12\"},{\"isTransposed\":false,\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\",\"hidden\":true},{\"columnId\":\"694278f2-f767-4450-90f5-4a95905e989f\",\"isTransposed\":false},{\"columnId\":\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"isTransposed\":false}],\"layerId\":\"777017d9-58d0-4f3f-8461-64af784d41a4\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"777017d9-58d0-4f3f-8461-64af784d41a4\":{\"columns\":{\"56e30fec-0d21-4af5-9751-7630c08713e8\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\":{\"label\":\"rule.mitre.technique\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.technique\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1169cee0-a32f-48d2-8e12-2919736d710a\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"23107287-fb86-49ea-bdea-79d55b5e7ea4\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"125edb0b-de81-41b8-9612-1d87188e2b12\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a1caa30b-78e1-493d-bb05-f29242d47609\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"694278f2-f767-4450-90f5-4a95905e989f\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1073b1b6-aa33-4e11-841b-0b6459a56603\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"694278f2-f767-4450-90f5-4a95905e989f\",\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\",\"1169cee0-a32f-48d2-8e12-2919736d710a\",\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"125edb0b-de81-41b8-9612-1d87188e2b12\",\"a1caa30b-78e1-493d-bb05-f29242d47609\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Malware Detection","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"3aa1520f-1ba9-4584-8f33-a2d86e020bc3:panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"847a1b06-c15d-41a2-9a08-73b056e959fb:indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"cc5ad74e-c871-4ac3-9487-328adc286921:indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e3873842-502a-4ba4-a3ab-d5bcdc9d908c:indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTcsMV0="} +{"attributes":{"description":"","layout":"vertical","links":[{"destinationRefName":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","id":"88df0698-f98d-410a-a44f-6c02b8c0bc16","label":"Wazuh Security Events","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":0,"type":"dashboardLink"},{"destinationRefName":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","id":"08f3674d-8a6c-477b-8eca-b274f271bf65","label":"Wazuh Vulnerabilities ","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":1,"type":"dashboardLink"},{"destinationRefName":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","id":"9df28651-90ee-42ff-b3a9-5d30443b781f","label":"Wazuh Malware Detection","order":2,"type":"dashboardLink"},{"destinationRefName":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","id":"ea41555a-331c-4ec6-92b7-29e1ceeafc11","label":"Wazuh Incident Response","order":3,"type":"dashboardLink"}],"title":"Wazuh Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","managed":false,"references":[{"id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","name":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","type":"dashboard"},{"id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","name":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","type":"dashboard"},{"id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","name":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","type":"dashboard"},{"id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","name":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTgsMV0="} +{"attributes":{"description":"Quick Display dashboard to view security event related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":27,\"i\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\"},\"panelIndex\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d08ddf45-10a2-4438-87c9-2162bea57d73\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":12,\"i\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\"},\"panelIndex\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"primaryGroups\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\"],\"metrics\":[\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"numberDisplay\":\"hidden\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.7,\"legendSize\":\"large\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\":{\"columns\":{\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"filter\":{\"query\":\"\",\"language\":\"kuery\"}},\"ccea2153-9f5c-4f65-9346-1feceb3783eb\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\",\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert groups\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":12,\"i\":\"115417e6-11a1-4a55-8055-220b69dad98e\"},\"panelIndex\":\"115417e6-11a1-4a55-8055-220b69dad98e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":false,\"position\":\"right\",\"showSingleSeries\":false},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"accessors\":[\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"splitAccessor\":\"a195fccb-9268-453a-b824-54f1e3f72d12\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"54e72470-df75-47d1-a7a6-3d2f807a39d1\":{\"columns\":{\"a195fccb-9268-453a-b824-54f1e3f72d12\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"audit\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"a195fccb-9268-453a-b824-54f1e3f72d12\",\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"sampling\":1,\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":12,\"w\":41,\"h\":15,\"i\":\"edc2487b-0a85-4975-b841-457471ee5cd0\"},\"panelIndex\":\"edc2487b-0a85-4975-b841-457471ee5cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\"},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\":{\"label\":\"rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":true},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Incident Response","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d08ddf45-10a2-4438-87c9-2162bea57d73:panel_d08ddf45-10a2-4438-87c9-2162bea57d73","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"caf3fb07-a3b0-4f51-b000-926f4b26ee4f:indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"115417e6-11a1-4a55-8055-220b69dad98e:indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"edc2487b-0a85-4975-b841-457471ee5cd0:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTksMV0="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":8,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/wazuh/wazuh_malware_detection.dumped.ndjson b/dashboards/wazuh/wazuh_malware_detection.dumped.ndjson new file mode 100644 index 00000000..af443c6b --- /dev/null +++ b/dashboards/wazuh/wazuh_malware_detection.dumped.ndjson @@ -0,0 +1,9 @@ +{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-alerts-4.x-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"timestamp","title":"wazuh-alerts-4.x-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTQsMV0="} +{"attributes":{"color":"#3f38b0","description":"","name":"wazuh"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzUxLDFd"} +{"attributes":{"description":"Displays and categorizes Wazuh security related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":34,\"i\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\"},\"panelIndex\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d70ade40-d606-45b2-97e2-3f0e7612df49\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":5,\"i\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\"},\"panelIndex\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"accessor\":\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1E75B6\",\"stop\":300}],\"colorStops\":[{\"color\":\"#1E75B6\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\":{\"columns\":{\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\":{\"label\":\"Total\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":8,\"h\":5,\"i\":\"dc864252-a518-4187-80ca-b581ad14f1cb\"},\"panelIndex\":\"dc864252-a518-4187-80ca-b581ad14f1cb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"accessor\":\"65d5d9ac-208b-4393-b498-12f4351445bd\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#e57488\",\"stop\":8}],\"colorStops\":[{\"color\":\"#e57488\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"alias\":\"rule.level >= 12\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"range\\\":{\\\"rule.level\\\":{\\\"gte\\\":\\\"12\\\"}}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"range\":{\"rule.level\":{\"gte\":\"12\"}}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\":{\"columns\":{\"65d5d9ac-208b-4393-b498-12f4351445bd\":{\"label\":\"Level 12 or above alerts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.level >= 12\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"65d5d9ac-208b-4393-b498-12f4351445bd\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":8,\"h\":5,\"i\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\"},\"panelIndex\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"28318134-b7bd-4faa-b21e-b0a6665b526f\",\"accessor\":\"e1a6a50b-cffe-4c92-b756-bad658aee97d\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#d4458d\",\"stop\":4}],\"colorStops\":[{\"color\":\"#d4458d\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"alias\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"rule.groups\\\":\\\"authentication_failed\\\"}}],\\\"minimum_should_match\\\":1}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"win_authentication_failed\\\",\\\"lenient\\\":true}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"authentication_failures\\\",\\\"lenient\\\":true}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"term\":{\"rule.groups\":\"authentication_failed\"}}],\"minimum_should_match\":1}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"win_authentication_failed\",\"lenient\":true}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"authentication_failures\",\"lenient\":true}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"28318134-b7bd-4faa-b21e-b0a6665b526f\":{\"columns\":{\"e1a6a50b-cffe-4c92-b756-bad658aee97d\":{\"label\":\"Athentication failure\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"e1a6a50b-cffe-4c92-b756-bad658aee97d\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":0,\"w\":8,\"h\":5,\"i\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\"},\"panelIndex\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"accessor\":\"ea00d671-3e3a-434a-8813-1dfa3a023112\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1a938a\",\"stop\":2}],\"colorStops\":[{\"color\":\"#1a938a\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"exists\",\"key\":\"rule.groups\",\"value\":\"exists\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"rule.groups\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67c3da39-aad2-4ff4-812f-15cf135b2d12\":{\"columns\":{\"ea00d671-3e3a-434a-8813-1dfa3a023112\":{\"label\":\"Authentication success\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups: \\\"authentication_success\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ea00d671-3e3a-434a-8813-1dfa3a023112\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":5,\"w\":24,\"h\":14,\"i\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\"},\"panelIndex\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"accessors\":[\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"splitAccessor\":\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"xAccessor\":\"c5296771-93c8-48cb-bf57-cad19d8c829e\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"e8600050-5477-49a7-a28e-ce9a47ded5f5\":{\"columns\":{\"8d76d731-1e09-4706-b3d9-48108dd7dd32\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"c5296771-93c8-48cb-bf57-cad19d8c829e\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":false,\"dropPartials\":false}},\"3f2d0dea-171c-41ed-9452-29106c10a968\":{\"label\":\"Top 5 values of agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"c5296771-93c8-48cb-bf57-cad19d8c829e\",\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alerts evolution - Top 5 agents\"},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":5,\"w\":16,\"h\":14,\"i\":\"e35f33d0-784d-471a-842e-576523d0ca80\"},\"panelIndex\":\"e35f33d0-784d-471a-842e-576523d0ca80\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Top Mitre\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"pie\",\"layers\":[{\"layerId\":\"d2ef6c07-620f-431e-85f2-77175187e0fe\",\"primaryGroups\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\"],\"metrics\":[\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.3,\"legendSize\":\"xlarge\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d2ef6c07-620f-431e-85f2-77175187e0fe\":{\"columns\":{\"a676e778-cad9-431e-b520-3e87b3a0afb2\":{\"label\":\"Top 5 values of rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\",\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Top Mitre ATT&K tactics\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":19,\"w\":40,\"h\":15,\"i\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\"},\"panelIndex\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"isTransposed\":false,\"columnId\":\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\"},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"columnId\":\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"isTransposed\":false,\"oneClickFilter\":true}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c74264a6-eb65-4232-9444-a503723c6fdf\":{\"label\":\"rule.mitre.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Security Events","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d70ade40-d606-45b2-97e2-3f0e7612df49:panel_d70ade40-d606-45b2-97e2-3f0e7612df49","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"c90b5ced-c476-4336-8248-5f5eee09b7d3:indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:4cd727d8-200d-4869-b702-ff540bd3ff56","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:1b7728c2-28d0-40f9-81ed-74e77231242c","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:933a08d4-fd4c-4829-938c-df17bc87af15","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e:indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e35f33d0-784d-471a-842e-576523d0ca80:indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"ee6f5f4c-2a18-4733-a593-23c1f2a24376:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTUsMV0="} +{"attributes":{"allowHidden":false,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-states-vulnerabilities-wazuh-manager","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"vulnerability.detected_at","title":"wazuh-states-vulnerabilities-wazuh-manager"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:40:39.596Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:40:39.596Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE1NzIsMV0="} +{"attributes":{"controlGroupInput":{"chainingSystem":"HIERARCHICAL","controlStyle":"oneLine","ignoreParentSettingsJSON":"{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}","panelsJSON":"{\"ae4a6e83-4b41-41a1-ba66-baac4a181116\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ae4a6e83-4b41-41a1-ba66-baac4a181116\",\"fieldName\":\"agent.name\",\"title\":\"Host Name Filter\",\"grow\":true,\"width\":\"medium\",\"searchTechnique\":\"prefix\",\"selectedOptions\":[],\"exclude\":false,\"enhancements\":{}}}}","showApplySelections":false},"description":"Tracks wazuh's vulnerability related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":32,\"i\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},\"panelIndex\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":11,\"h\":5,\"i\":\"9931cceb-51f1-4e47-bd26-491e7a624592\"},\"panelIndex\":\"9931cceb-51f1-4e47-bd26-491e7a624592\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\"}],\"state\":{\"visualization\":{\"layerId\":\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\",\"layerType\":\"data\",\"metricAccessor\":\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\":{\"columns\":{\"fe99fb3f-debd-4796-9a1a-6277cae75abb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Critical Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":18,\"y\":0,\"w\":10,\"h\":5,\"i\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\"},\"panelIndex\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15\"}],\"state\":{\"visualization\":{\"layerId\":\"fd6049b6-e52c-449e-9775-ded5ac1eac15\",\"layerType\":\"data\",\"metricAccessor\":\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fd6049b6-e52c-449e-9775-ded5ac1eac15\":{\"columns\":{\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity: \\\"High\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"High Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":10,\"h\":5,\"i\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\"},\"panelIndex\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641\"}],\"state\":{\"visualization\":{\"layerId\":\"a8774fa0-5ae6-4746-94bd-cd21a0210641\",\"layerType\":\"data\",\"metricAccessor\":\"2a7bcb09-d553-456e-8af2-8194dff05293\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8774fa0-5ae6-4746-94bd-cd21a0210641\":{\"columns\":{\"2a7bcb09-d553-456e-8af2-8194dff05293\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Medium\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"2a7bcb09-d553-456e-8af2-8194dff05293\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Medium Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":38,\"y\":0,\"w\":10,\"h\":5,\"i\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\"},\"panelIndex\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3\"}],\"state\":{\"visualization\":{\"layerId\":\"a397e361-0b6a-4d18-b957-2afce890f6c3\",\"accessor\":\"33a61fcd-b356-40c3-9f38-ec1b6a607081\",\"layerType\":\"data\",\"colorMode\":\"None\",\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a397e361-0b6a-4d18-b957-2afce890f6c3\":{\"columns\":{\"33a61fcd-b356-40c3-9f38-ec1b6a607081\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Low\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"33a61fcd-b356-40c3-9f38-ec1b6a607081\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Low Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":5,\"w\":18,\"h\":14,\"i\":\"8fe06d85-091b-47aa-a809-aae9150a3314\"},\"panelIndex\":\"8fe06d85-091b-47aa-a809-aae9150a3314\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"CURVE_MONOTONE_X\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"47832b00-8a1a-4d99-8631-89379474c236\",\"accessors\":[\"32448531-8094-4131-89c9-38ed77a620ec\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"32448531-8094-4131-89c9-38ed77a620ec\",\"axisMode\":\"auto\"}],\"xAccessor\":\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"splitAccessor\":\"1cc61481-30d8-4719-b629-47daf49c7250\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"47832b00-8a1a-4d99-8631-89379474c236\":{\"columns\":{\"32448531-8094-4131-89c9-38ed77a620ec\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"00593c9d-f971-478e-98a6-78c781a6ae6d\":{\"label\":\"vulnerability.detected_at\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"vulnerability.detected_at\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1cc61481-30d8-4719-b629-47daf49c7250\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"32448531-8094-4131-89c9-38ed77a620ec\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"High\",\"Critical\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"1cc61481-30d8-4719-b629-47daf49c7250\",\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"32448531-8094-4131-89c9-38ed77a620ec\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert severity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":5,\"w\":23,\"h\":14,\"i\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\"},\"panelIndex\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsHeatmap\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\"}],\"state\":{\"visualization\":{\"shape\":\"heatmap\",\"layerId\":\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\",\"layerType\":\"data\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"type\":\"heatmap_legend\"},\"gridConfig\":{\"type\":\"heatmap_grid\",\"isCellLabelVisible\":false,\"isYAxisLabelVisible\":true,\"isXAxisLabelVisible\":true,\"isYAxisTitleVisible\":false,\"isXAxisTitleVisible\":true,\"yTitle\":\"\"},\"valueAccessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\",\"xAccessor\":\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"palette\":{\"type\":\"palette\",\"name\":\"positive\",\"params\":{\"name\":\"positive\",\"continuity\":\"above\",\"reverse\":false,\"stops\":[{\"color\":\"#d6e9e4\",\"stop\":0},{\"color\":\"#aed3ca\",\"stop\":20},{\"color\":\"#85bdb1\",\"stop\":40},{\"color\":\"#5aa898\",\"stop\":60},{\"color\":\"#209280\",\"stop\":80}],\"rangeMin\":0,\"rangeMax\":null},\"accessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"yAccessor\":\"fc5af013-78e6-40e3-8e64-8015aa4f721e\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\":{\"columns\":{\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":false},\"e8d69708-c954-444b-a94f-9eb1befd3197\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"fc5af013-78e6-40e3-8e64-8015aa4f721e\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\"],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"fc5af013-78e6-40e3-8e64-8015aa4f721e\",\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Vulnerabilities heat map\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":19,\"w\":41,\"h\":13,\"i\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\"},\"panelIndex\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"oneClickFilter\":true,\"width\":128.25},{\"isTransposed\":false,\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\",\"hidden\":true},{\"columnId\":\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"isTransposed\":false,\"isMetric\":false,\"width\":350},{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"7dcaf287-0461-4459-8009-4d870050dac4\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"e8f9533e-b4ee-4db5-a484-329645593766\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d94ddf3d-d285-450e-aba4-46057df55fb7\",\"layerType\":\"data\",\"paging\":{\"enabled\":true,\"size\":20},\"sorting\":{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"direction\":\"asc\"}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d94ddf3d-d285-450e-aba4-46057df55fb7\":{\"columns\":{\"542028d8-117e-4ee0-ba25-3ff4475940aa\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"f790607c-81f9-4567-82c3-feb4dc9126fe\":{\"label\":\"Vulnerability Severity Score\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"vulnerability.score.base\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"},\"customLabel\":true},\"4d9643e1-3799-4319-82a1-352650000378\":{\"label\":\"Vulnerability Severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"7dcaf287-0461-4459-8009-4d870050dac4\":{\"label\":\"Package Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"e8f9533e-b4ee-4db5-a484-329645593766\":{\"label\":\"Package Version\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.version\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"4d9643e1-3799-4319-82a1-352650000378\",\"7dcaf287-0461-4459-8009-4d870050dac4\",\"e8f9533e-b4ee-4db5-a484-329645593766\",\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Events\"}]","timeRestore":false,"title":"Wazuh Vulnerabilities","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"272fa8b1-b058-4d9b-945f-4369d2f8eb8c:panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c","type":"links"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"9931cceb-51f1-4e47-bd26-491e7a624592:indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"a0b05cdd-c4b5-46b0-af2e-32253bd965e6:indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"b22f2aba-370b-40f2-8f30-c7175fd21d84:indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"dad9436c-6a56-47cc-a52a-065c86d64c7f:indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"8fe06d85-091b-47aa-a809-aae9150a3314:indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"680cfedf-a868-4de2-8173-897f4df7f6d7:indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"5a8626af-2bc4-4317-ad7f-20622c16db0a:indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"controlGroup_ae4a6e83-4b41-41a1-ba66-baac4a181116:optionsListDataView","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T22:11:33.226Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2NjMsMV0="} +{"attributes":{"description":"Quick Display dashboard to view security event related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":27,\"i\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\"},\"panelIndex\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d08ddf45-10a2-4438-87c9-2162bea57d73\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":12,\"i\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\"},\"panelIndex\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"primaryGroups\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\"],\"metrics\":[\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"numberDisplay\":\"hidden\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.7,\"legendSize\":\"large\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\":{\"columns\":{\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"filter\":{\"query\":\"\",\"language\":\"kuery\"}},\"ccea2153-9f5c-4f65-9346-1feceb3783eb\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\",\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert groups\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":12,\"i\":\"115417e6-11a1-4a55-8055-220b69dad98e\"},\"panelIndex\":\"115417e6-11a1-4a55-8055-220b69dad98e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":false,\"position\":\"right\",\"showSingleSeries\":false},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"accessors\":[\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"splitAccessor\":\"a195fccb-9268-453a-b824-54f1e3f72d12\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"54e72470-df75-47d1-a7a6-3d2f807a39d1\":{\"columns\":{\"a195fccb-9268-453a-b824-54f1e3f72d12\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"audit\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"a195fccb-9268-453a-b824-54f1e3f72d12\",\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"sampling\":1,\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":12,\"w\":41,\"h\":15,\"i\":\"edc2487b-0a85-4975-b841-457471ee5cd0\"},\"panelIndex\":\"edc2487b-0a85-4975-b841-457471ee5cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\"},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\":{\"label\":\"rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":true},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Incident Response","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d08ddf45-10a2-4438-87c9-2162bea57d73:panel_d08ddf45-10a2-4438-87c9-2162bea57d73","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"caf3fb07-a3b0-4f51-b000-926f4b26ee4f:indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"115417e6-11a1-4a55-8055-220b69dad98e:indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"edc2487b-0a85-4975-b841-457471ee5cd0:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTksMV0="} +{"attributes":{"description":"","layout":"vertical","links":[{"destinationRefName":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","id":"88df0698-f98d-410a-a44f-6c02b8c0bc16","label":"Wazuh Security Events","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":0,"type":"dashboardLink"},{"destinationRefName":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","id":"08f3674d-8a6c-477b-8eca-b274f271bf65","label":"Wazuh Vulnerabilities ","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":1,"type":"dashboardLink"},{"destinationRefName":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","id":"9df28651-90ee-42ff-b3a9-5d30443b781f","label":"Wazuh Malware Detection","order":2,"type":"dashboardLink"},{"destinationRefName":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","id":"ea41555a-331c-4ec6-92b7-29e1ceeafc11","label":"Wazuh Incident Response","order":3,"type":"dashboardLink"}],"title":"Wazuh Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","managed":false,"references":[{"id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","name":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","type":"dashboard"},{"id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","name":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","type":"dashboard"},{"id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","name":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","type":"dashboard"},{"id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","name":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTgsMV0="} +{"attributes":{"description":"This tracks Wazuh's malware related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":35,\"i\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},\"panelIndex\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":17,\"h\":14,\"i\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\"},\"panelIndex\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"LINEAR\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"accessors\":[\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"yConfig\":[{\"forAccessor\":\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\",\"color\":\"#40d4e0\"}]}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\":{\"columns\":{\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Emotet malware activity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":0,\"w\":23,\"h\":14,\"i\":\"cc5ad74e-c871-4ac3-9487-328adc286921\"},\"panelIndex\":\"cc5ad74e-c871-4ac3-9487-328adc286921\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"accessors\":[\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"splitAccessor\":\"52edc505-8c8a-4965-a3f3-46ca861738af\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5ccb00b3-1675-4c9f-a542-927c5930e66e\":{\"columns\":{\"52edc505-8c8a-4965-a3f3-46ca861738af\":{\"label\":\"Top 5 values of data.title\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.title\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]}},\"b662da8a-50ee-4dae-a2bb-25861753d95c\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"f001735e-ca2b-455d-a50a-b7f44b005f0b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"52edc505-8c8a-4965-a3f3-46ca861738af\",\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Rootkits activity over time\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":14,\"w\":40,\"h\":21,\"i\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\"},\"panelIndex\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\"},{\"isTransposed\":false,\"columnId\":\"1169cee0-a32f-48d2-8e12-2919736d710a\"},{\"isTransposed\":false,\"columnId\":\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"125edb0b-de81-41b8-9612-1d87188e2b12\"},{\"isTransposed\":false,\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\",\"hidden\":true},{\"columnId\":\"694278f2-f767-4450-90f5-4a95905e989f\",\"isTransposed\":false},{\"columnId\":\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"isTransposed\":false}],\"layerId\":\"777017d9-58d0-4f3f-8461-64af784d41a4\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"777017d9-58d0-4f3f-8461-64af784d41a4\":{\"columns\":{\"56e30fec-0d21-4af5-9751-7630c08713e8\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\":{\"label\":\"rule.mitre.technique\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.technique\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1169cee0-a32f-48d2-8e12-2919736d710a\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"23107287-fb86-49ea-bdea-79d55b5e7ea4\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"125edb0b-de81-41b8-9612-1d87188e2b12\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a1caa30b-78e1-493d-bb05-f29242d47609\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"694278f2-f767-4450-90f5-4a95905e989f\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1073b1b6-aa33-4e11-841b-0b6459a56603\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"694278f2-f767-4450-90f5-4a95905e989f\",\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\",\"1169cee0-a32f-48d2-8e12-2919736d710a\",\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"125edb0b-de81-41b8-9612-1d87188e2b12\",\"a1caa30b-78e1-493d-bb05-f29242d47609\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Malware Detection","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"3aa1520f-1ba9-4584-8f33-a2d86e020bc3:panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"847a1b06-c15d-41a2-9a08-73b056e959fb:indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"cc5ad74e-c871-4ac3-9487-328adc286921:indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e3873842-502a-4ba4-a3ab-d5bcdc9d908c:indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTcsMV0="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":8,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/wazuh/wazuh_security_events.dumped.ndjson b/dashboards/wazuh/wazuh_security_events.dumped.ndjson new file mode 100644 index 00000000..67ba8a4f --- /dev/null +++ b/dashboards/wazuh/wazuh_security_events.dumped.ndjson @@ -0,0 +1,9 @@ +{"attributes":{"allowHidden":false,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-states-vulnerabilities-wazuh-manager","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"vulnerability.detected_at","title":"wazuh-states-vulnerabilities-wazuh-manager"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:40:39.596Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:40:39.596Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE1NzIsMV0="} +{"attributes":{"color":"#3f38b0","description":"","name":"wazuh"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzUxLDFd"} +{"attributes":{"controlGroupInput":{"chainingSystem":"HIERARCHICAL","controlStyle":"oneLine","ignoreParentSettingsJSON":"{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}","panelsJSON":"{\"ae4a6e83-4b41-41a1-ba66-baac4a181116\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ae4a6e83-4b41-41a1-ba66-baac4a181116\",\"fieldName\":\"agent.name\",\"title\":\"Host Name Filter\",\"grow\":true,\"width\":\"medium\",\"searchTechnique\":\"prefix\",\"selectedOptions\":[],\"exclude\":false,\"enhancements\":{}}}}","showApplySelections":false},"description":"Tracks wazuh's vulnerability related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":32,\"i\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},\"panelIndex\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":11,\"h\":5,\"i\":\"9931cceb-51f1-4e47-bd26-491e7a624592\"},\"panelIndex\":\"9931cceb-51f1-4e47-bd26-491e7a624592\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\"}],\"state\":{\"visualization\":{\"layerId\":\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\",\"layerType\":\"data\",\"metricAccessor\":\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\":{\"columns\":{\"fe99fb3f-debd-4796-9a1a-6277cae75abb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Critical Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":18,\"y\":0,\"w\":10,\"h\":5,\"i\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\"},\"panelIndex\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15\"}],\"state\":{\"visualization\":{\"layerId\":\"fd6049b6-e52c-449e-9775-ded5ac1eac15\",\"layerType\":\"data\",\"metricAccessor\":\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fd6049b6-e52c-449e-9775-ded5ac1eac15\":{\"columns\":{\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity: \\\"High\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"High Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":10,\"h\":5,\"i\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\"},\"panelIndex\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641\"}],\"state\":{\"visualization\":{\"layerId\":\"a8774fa0-5ae6-4746-94bd-cd21a0210641\",\"layerType\":\"data\",\"metricAccessor\":\"2a7bcb09-d553-456e-8af2-8194dff05293\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8774fa0-5ae6-4746-94bd-cd21a0210641\":{\"columns\":{\"2a7bcb09-d553-456e-8af2-8194dff05293\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Medium\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"2a7bcb09-d553-456e-8af2-8194dff05293\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Medium Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":38,\"y\":0,\"w\":10,\"h\":5,\"i\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\"},\"panelIndex\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3\"}],\"state\":{\"visualization\":{\"layerId\":\"a397e361-0b6a-4d18-b957-2afce890f6c3\",\"accessor\":\"33a61fcd-b356-40c3-9f38-ec1b6a607081\",\"layerType\":\"data\",\"colorMode\":\"None\",\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a397e361-0b6a-4d18-b957-2afce890f6c3\":{\"columns\":{\"33a61fcd-b356-40c3-9f38-ec1b6a607081\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Low\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"33a61fcd-b356-40c3-9f38-ec1b6a607081\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Low Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":5,\"w\":18,\"h\":14,\"i\":\"8fe06d85-091b-47aa-a809-aae9150a3314\"},\"panelIndex\":\"8fe06d85-091b-47aa-a809-aae9150a3314\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"CURVE_MONOTONE_X\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"47832b00-8a1a-4d99-8631-89379474c236\",\"accessors\":[\"32448531-8094-4131-89c9-38ed77a620ec\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"32448531-8094-4131-89c9-38ed77a620ec\",\"axisMode\":\"auto\"}],\"xAccessor\":\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"splitAccessor\":\"1cc61481-30d8-4719-b629-47daf49c7250\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"47832b00-8a1a-4d99-8631-89379474c236\":{\"columns\":{\"32448531-8094-4131-89c9-38ed77a620ec\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"00593c9d-f971-478e-98a6-78c781a6ae6d\":{\"label\":\"vulnerability.detected_at\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"vulnerability.detected_at\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1cc61481-30d8-4719-b629-47daf49c7250\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"32448531-8094-4131-89c9-38ed77a620ec\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"High\",\"Critical\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"1cc61481-30d8-4719-b629-47daf49c7250\",\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"32448531-8094-4131-89c9-38ed77a620ec\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert severity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":5,\"w\":23,\"h\":14,\"i\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\"},\"panelIndex\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsHeatmap\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\"}],\"state\":{\"visualization\":{\"shape\":\"heatmap\",\"layerId\":\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\",\"layerType\":\"data\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"type\":\"heatmap_legend\"},\"gridConfig\":{\"type\":\"heatmap_grid\",\"isCellLabelVisible\":false,\"isYAxisLabelVisible\":true,\"isXAxisLabelVisible\":true,\"isYAxisTitleVisible\":false,\"isXAxisTitleVisible\":true,\"yTitle\":\"\"},\"valueAccessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\",\"xAccessor\":\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"palette\":{\"type\":\"palette\",\"name\":\"positive\",\"params\":{\"name\":\"positive\",\"continuity\":\"above\",\"reverse\":false,\"stops\":[{\"color\":\"#d6e9e4\",\"stop\":0},{\"color\":\"#aed3ca\",\"stop\":20},{\"color\":\"#85bdb1\",\"stop\":40},{\"color\":\"#5aa898\",\"stop\":60},{\"color\":\"#209280\",\"stop\":80}],\"rangeMin\":0,\"rangeMax\":null},\"accessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"yAccessor\":\"fc5af013-78e6-40e3-8e64-8015aa4f721e\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\":{\"columns\":{\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":false},\"e8d69708-c954-444b-a94f-9eb1befd3197\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"fc5af013-78e6-40e3-8e64-8015aa4f721e\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\"],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"fc5af013-78e6-40e3-8e64-8015aa4f721e\",\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Vulnerabilities heat map\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":19,\"w\":41,\"h\":13,\"i\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\"},\"panelIndex\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"oneClickFilter\":true,\"width\":128.25},{\"isTransposed\":false,\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\",\"hidden\":true},{\"columnId\":\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"isTransposed\":false,\"isMetric\":false,\"width\":350},{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"7dcaf287-0461-4459-8009-4d870050dac4\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"e8f9533e-b4ee-4db5-a484-329645593766\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d94ddf3d-d285-450e-aba4-46057df55fb7\",\"layerType\":\"data\",\"paging\":{\"enabled\":true,\"size\":20},\"sorting\":{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"direction\":\"asc\"}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d94ddf3d-d285-450e-aba4-46057df55fb7\":{\"columns\":{\"542028d8-117e-4ee0-ba25-3ff4475940aa\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"f790607c-81f9-4567-82c3-feb4dc9126fe\":{\"label\":\"Vulnerability Severity Score\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"vulnerability.score.base\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"},\"customLabel\":true},\"4d9643e1-3799-4319-82a1-352650000378\":{\"label\":\"Vulnerability Severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"7dcaf287-0461-4459-8009-4d870050dac4\":{\"label\":\"Package Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"e8f9533e-b4ee-4db5-a484-329645593766\":{\"label\":\"Package Version\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.version\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"4d9643e1-3799-4319-82a1-352650000378\",\"7dcaf287-0461-4459-8009-4d870050dac4\",\"e8f9533e-b4ee-4db5-a484-329645593766\",\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Events\"}]","timeRestore":false,"title":"Wazuh Vulnerabilities","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"272fa8b1-b058-4d9b-945f-4369d2f8eb8c:panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c","type":"links"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"9931cceb-51f1-4e47-bd26-491e7a624592:indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"a0b05cdd-c4b5-46b0-af2e-32253bd965e6:indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"b22f2aba-370b-40f2-8f30-c7175fd21d84:indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"dad9436c-6a56-47cc-a52a-065c86d64c7f:indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"8fe06d85-091b-47aa-a809-aae9150a3314:indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"680cfedf-a868-4de2-8173-897f4df7f6d7:indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"5a8626af-2bc4-4317-ad7f-20622c16db0a:indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"controlGroup_ae4a6e83-4b41-41a1-ba66-baac4a181116:optionsListDataView","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T22:11:33.226Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2NjMsMV0="} +{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-alerts-4.x-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"timestamp","title":"wazuh-alerts-4.x-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTQsMV0="} +{"attributes":{"description":"This tracks Wazuh's malware related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":35,\"i\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},\"panelIndex\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":17,\"h\":14,\"i\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\"},\"panelIndex\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"LINEAR\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"accessors\":[\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"yConfig\":[{\"forAccessor\":\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\",\"color\":\"#40d4e0\"}]}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\":{\"columns\":{\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Emotet malware activity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":0,\"w\":23,\"h\":14,\"i\":\"cc5ad74e-c871-4ac3-9487-328adc286921\"},\"panelIndex\":\"cc5ad74e-c871-4ac3-9487-328adc286921\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"accessors\":[\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"splitAccessor\":\"52edc505-8c8a-4965-a3f3-46ca861738af\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5ccb00b3-1675-4c9f-a542-927c5930e66e\":{\"columns\":{\"52edc505-8c8a-4965-a3f3-46ca861738af\":{\"label\":\"Top 5 values of data.title\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.title\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]}},\"b662da8a-50ee-4dae-a2bb-25861753d95c\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"f001735e-ca2b-455d-a50a-b7f44b005f0b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"52edc505-8c8a-4965-a3f3-46ca861738af\",\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Rootkits activity over time\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":14,\"w\":40,\"h\":21,\"i\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\"},\"panelIndex\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\"},{\"isTransposed\":false,\"columnId\":\"1169cee0-a32f-48d2-8e12-2919736d710a\"},{\"isTransposed\":false,\"columnId\":\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"125edb0b-de81-41b8-9612-1d87188e2b12\"},{\"isTransposed\":false,\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\",\"hidden\":true},{\"columnId\":\"694278f2-f767-4450-90f5-4a95905e989f\",\"isTransposed\":false},{\"columnId\":\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"isTransposed\":false}],\"layerId\":\"777017d9-58d0-4f3f-8461-64af784d41a4\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"777017d9-58d0-4f3f-8461-64af784d41a4\":{\"columns\":{\"56e30fec-0d21-4af5-9751-7630c08713e8\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\":{\"label\":\"rule.mitre.technique\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.technique\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1169cee0-a32f-48d2-8e12-2919736d710a\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"23107287-fb86-49ea-bdea-79d55b5e7ea4\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"125edb0b-de81-41b8-9612-1d87188e2b12\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a1caa30b-78e1-493d-bb05-f29242d47609\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"694278f2-f767-4450-90f5-4a95905e989f\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1073b1b6-aa33-4e11-841b-0b6459a56603\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"694278f2-f767-4450-90f5-4a95905e989f\",\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\",\"1169cee0-a32f-48d2-8e12-2919736d710a\",\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"125edb0b-de81-41b8-9612-1d87188e2b12\",\"a1caa30b-78e1-493d-bb05-f29242d47609\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Malware Detection","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"3aa1520f-1ba9-4584-8f33-a2d86e020bc3:panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"847a1b06-c15d-41a2-9a08-73b056e959fb:indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"cc5ad74e-c871-4ac3-9487-328adc286921:indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e3873842-502a-4ba4-a3ab-d5bcdc9d908c:indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTcsMV0="} +{"attributes":{"description":"Quick Display dashboard to view security event related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":27,\"i\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\"},\"panelIndex\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d08ddf45-10a2-4438-87c9-2162bea57d73\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":12,\"i\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\"},\"panelIndex\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"primaryGroups\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\"],\"metrics\":[\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"numberDisplay\":\"hidden\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.7,\"legendSize\":\"large\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\":{\"columns\":{\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"filter\":{\"query\":\"\",\"language\":\"kuery\"}},\"ccea2153-9f5c-4f65-9346-1feceb3783eb\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\",\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert groups\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":12,\"i\":\"115417e6-11a1-4a55-8055-220b69dad98e\"},\"panelIndex\":\"115417e6-11a1-4a55-8055-220b69dad98e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":false,\"position\":\"right\",\"showSingleSeries\":false},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"accessors\":[\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"splitAccessor\":\"a195fccb-9268-453a-b824-54f1e3f72d12\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"54e72470-df75-47d1-a7a6-3d2f807a39d1\":{\"columns\":{\"a195fccb-9268-453a-b824-54f1e3f72d12\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"audit\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"a195fccb-9268-453a-b824-54f1e3f72d12\",\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"sampling\":1,\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":12,\"w\":41,\"h\":15,\"i\":\"edc2487b-0a85-4975-b841-457471ee5cd0\"},\"panelIndex\":\"edc2487b-0a85-4975-b841-457471ee5cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\"},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\":{\"label\":\"rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":true},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Incident Response","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d08ddf45-10a2-4438-87c9-2162bea57d73:panel_d08ddf45-10a2-4438-87c9-2162bea57d73","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"caf3fb07-a3b0-4f51-b000-926f4b26ee4f:indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"115417e6-11a1-4a55-8055-220b69dad98e:indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"edc2487b-0a85-4975-b841-457471ee5cd0:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTksMV0="} +{"attributes":{"description":"","layout":"vertical","links":[{"destinationRefName":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","id":"88df0698-f98d-410a-a44f-6c02b8c0bc16","label":"Wazuh Security Events","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":0,"type":"dashboardLink"},{"destinationRefName":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","id":"08f3674d-8a6c-477b-8eca-b274f271bf65","label":"Wazuh Vulnerabilities ","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":1,"type":"dashboardLink"},{"destinationRefName":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","id":"9df28651-90ee-42ff-b3a9-5d30443b781f","label":"Wazuh Malware Detection","order":2,"type":"dashboardLink"},{"destinationRefName":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","id":"ea41555a-331c-4ec6-92b7-29e1ceeafc11","label":"Wazuh Incident Response","order":3,"type":"dashboardLink"}],"title":"Wazuh Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","managed":false,"references":[{"id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","name":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","type":"dashboard"},{"id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","name":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","type":"dashboard"},{"id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","name":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","type":"dashboard"},{"id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","name":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTgsMV0="} +{"attributes":{"description":"Displays and categorizes Wazuh security related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":34,\"i\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\"},\"panelIndex\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d70ade40-d606-45b2-97e2-3f0e7612df49\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":5,\"i\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\"},\"panelIndex\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"accessor\":\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1E75B6\",\"stop\":300}],\"colorStops\":[{\"color\":\"#1E75B6\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\":{\"columns\":{\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\":{\"label\":\"Total\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":8,\"h\":5,\"i\":\"dc864252-a518-4187-80ca-b581ad14f1cb\"},\"panelIndex\":\"dc864252-a518-4187-80ca-b581ad14f1cb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"accessor\":\"65d5d9ac-208b-4393-b498-12f4351445bd\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#e57488\",\"stop\":8}],\"colorStops\":[{\"color\":\"#e57488\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"alias\":\"rule.level >= 12\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"range\\\":{\\\"rule.level\\\":{\\\"gte\\\":\\\"12\\\"}}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"range\":{\"rule.level\":{\"gte\":\"12\"}}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\":{\"columns\":{\"65d5d9ac-208b-4393-b498-12f4351445bd\":{\"label\":\"Level 12 or above alerts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.level >= 12\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"65d5d9ac-208b-4393-b498-12f4351445bd\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":8,\"h\":5,\"i\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\"},\"panelIndex\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"28318134-b7bd-4faa-b21e-b0a6665b526f\",\"accessor\":\"e1a6a50b-cffe-4c92-b756-bad658aee97d\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#d4458d\",\"stop\":4}],\"colorStops\":[{\"color\":\"#d4458d\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"alias\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"rule.groups\\\":\\\"authentication_failed\\\"}}],\\\"minimum_should_match\\\":1}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"win_authentication_failed\\\",\\\"lenient\\\":true}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"authentication_failures\\\",\\\"lenient\\\":true}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"term\":{\"rule.groups\":\"authentication_failed\"}}],\"minimum_should_match\":1}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"win_authentication_failed\",\"lenient\":true}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"authentication_failures\",\"lenient\":true}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"28318134-b7bd-4faa-b21e-b0a6665b526f\":{\"columns\":{\"e1a6a50b-cffe-4c92-b756-bad658aee97d\":{\"label\":\"Athentication failure\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"e1a6a50b-cffe-4c92-b756-bad658aee97d\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":0,\"w\":8,\"h\":5,\"i\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\"},\"panelIndex\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"accessor\":\"ea00d671-3e3a-434a-8813-1dfa3a023112\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1a938a\",\"stop\":2}],\"colorStops\":[{\"color\":\"#1a938a\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"exists\",\"key\":\"rule.groups\",\"value\":\"exists\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"rule.groups\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67c3da39-aad2-4ff4-812f-15cf135b2d12\":{\"columns\":{\"ea00d671-3e3a-434a-8813-1dfa3a023112\":{\"label\":\"Authentication success\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups: \\\"authentication_success\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ea00d671-3e3a-434a-8813-1dfa3a023112\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":5,\"w\":24,\"h\":14,\"i\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\"},\"panelIndex\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"accessors\":[\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"splitAccessor\":\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"xAccessor\":\"c5296771-93c8-48cb-bf57-cad19d8c829e\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"e8600050-5477-49a7-a28e-ce9a47ded5f5\":{\"columns\":{\"8d76d731-1e09-4706-b3d9-48108dd7dd32\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"c5296771-93c8-48cb-bf57-cad19d8c829e\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":false,\"dropPartials\":false}},\"3f2d0dea-171c-41ed-9452-29106c10a968\":{\"label\":\"Top 5 values of agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"c5296771-93c8-48cb-bf57-cad19d8c829e\",\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alerts evolution - Top 5 agents\"},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":5,\"w\":16,\"h\":14,\"i\":\"e35f33d0-784d-471a-842e-576523d0ca80\"},\"panelIndex\":\"e35f33d0-784d-471a-842e-576523d0ca80\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Top Mitre\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"pie\",\"layers\":[{\"layerId\":\"d2ef6c07-620f-431e-85f2-77175187e0fe\",\"primaryGroups\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\"],\"metrics\":[\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.3,\"legendSize\":\"xlarge\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d2ef6c07-620f-431e-85f2-77175187e0fe\":{\"columns\":{\"a676e778-cad9-431e-b520-3e87b3a0afb2\":{\"label\":\"Top 5 values of rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\",\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Top Mitre ATT&K tactics\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":19,\"w\":40,\"h\":15,\"i\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\"},\"panelIndex\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"isTransposed\":false,\"columnId\":\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\"},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"columnId\":\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"isTransposed\":false,\"oneClickFilter\":true}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c74264a6-eb65-4232-9444-a503723c6fdf\":{\"label\":\"rule.mitre.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Security Events","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d70ade40-d606-45b2-97e2-3f0e7612df49:panel_d70ade40-d606-45b2-97e2-3f0e7612df49","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"c90b5ced-c476-4336-8248-5f5eee09b7d3:indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:4cd727d8-200d-4869-b702-ff540bd3ff56","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:1b7728c2-28d0-40f9-81ed-74e77231242c","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:933a08d4-fd4c-4829-938c-df17bc87af15","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e:indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e35f33d0-784d-471a-842e-576523d0ca80:indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"ee6f5f4c-2a18-4733-a593-23c1f2a24376:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTUsMV0="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":8,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/wazuh/wazuh_vulnerabilities.dumped.ndjson b/dashboards/wazuh/wazuh_vulnerabilities.dumped.ndjson new file mode 100644 index 00000000..048e9b9b --- /dev/null +++ b/dashboards/wazuh/wazuh_vulnerabilities.dumped.ndjson @@ -0,0 +1,9 @@ +{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-alerts-4.x-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"timestamp","title":"wazuh-alerts-4.x-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTQsMV0="} +{"attributes":{"color":"#3f38b0","description":"","name":"wazuh"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","managed":false,"references":[],"type":"tag","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzUxLDFd"} +{"attributes":{"description":"Displays and categorizes Wazuh security related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":34,\"i\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\"},\"panelIndex\":\"d70ade40-d606-45b2-97e2-3f0e7612df49\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d70ade40-d606-45b2-97e2-3f0e7612df49\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":5,\"i\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\"},\"panelIndex\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"accessor\":\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1E75B6\",\"stop\":300}],\"colorStops\":[{\"color\":\"#1E75B6\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\":{\"columns\":{\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\":{\"label\":\"Total\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":8,\"h\":5,\"i\":\"dc864252-a518-4187-80ca-b581ad14f1cb\"},\"panelIndex\":\"dc864252-a518-4187-80ca-b581ad14f1cb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"accessor\":\"65d5d9ac-208b-4393-b498-12f4351445bd\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#e57488\",\"stop\":8}],\"colorStops\":[{\"color\":\"#e57488\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"alias\":\"rule.level >= 12\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"range\\\":{\\\"rule.level\\\":{\\\"gte\\\":\\\"12\\\"}}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"range\":{\"rule.level\":{\"gte\":\"12\"}}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\":{\"columns\":{\"65d5d9ac-208b-4393-b498-12f4351445bd\":{\"label\":\"Level 12 or above alerts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.level >= 12\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"65d5d9ac-208b-4393-b498-12f4351445bd\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":8,\"h\":5,\"i\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\"},\"panelIndex\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"28318134-b7bd-4faa-b21e-b0a6665b526f\",\"accessor\":\"e1a6a50b-cffe-4c92-b756-bad658aee97d\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#d4458d\",\"stop\":4}],\"colorStops\":[{\"color\":\"#d4458d\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"alias\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"rule.groups\\\":\\\"authentication_failed\\\"}}],\\\"minimum_should_match\\\":1}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"win_authentication_failed\\\",\\\"lenient\\\":true}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"authentication_failures\\\",\\\"lenient\\\":true}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"term\":{\"rule.groups\":\"authentication_failed\"}}],\"minimum_should_match\":1}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"win_authentication_failed\",\"lenient\":true}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"authentication_failures\",\"lenient\":true}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"28318134-b7bd-4faa-b21e-b0a6665b526f\":{\"columns\":{\"e1a6a50b-cffe-4c92-b756-bad658aee97d\":{\"label\":\"Athentication failure\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"e1a6a50b-cffe-4c92-b756-bad658aee97d\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":0,\"w\":8,\"h\":5,\"i\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\"},\"panelIndex\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"accessor\":\"ea00d671-3e3a-434a-8813-1dfa3a023112\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1a938a\",\"stop\":2}],\"colorStops\":[{\"color\":\"#1a938a\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"exists\",\"key\":\"rule.groups\",\"value\":\"exists\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"rule.groups\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67c3da39-aad2-4ff4-812f-15cf135b2d12\":{\"columns\":{\"ea00d671-3e3a-434a-8813-1dfa3a023112\":{\"label\":\"Authentication success\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups: \\\"authentication_success\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ea00d671-3e3a-434a-8813-1dfa3a023112\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":5,\"w\":24,\"h\":14,\"i\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\"},\"panelIndex\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"accessors\":[\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"splitAccessor\":\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"xAccessor\":\"c5296771-93c8-48cb-bf57-cad19d8c829e\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"e8600050-5477-49a7-a28e-ce9a47ded5f5\":{\"columns\":{\"8d76d731-1e09-4706-b3d9-48108dd7dd32\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"c5296771-93c8-48cb-bf57-cad19d8c829e\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":false,\"dropPartials\":false}},\"3f2d0dea-171c-41ed-9452-29106c10a968\":{\"label\":\"Top 5 values of agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"c5296771-93c8-48cb-bf57-cad19d8c829e\",\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alerts evolution - Top 5 agents\"},{\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":5,\"w\":16,\"h\":14,\"i\":\"e35f33d0-784d-471a-842e-576523d0ca80\"},\"panelIndex\":\"e35f33d0-784d-471a-842e-576523d0ca80\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Top Mitre\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"pie\",\"layers\":[{\"layerId\":\"d2ef6c07-620f-431e-85f2-77175187e0fe\",\"primaryGroups\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\"],\"metrics\":[\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.3,\"legendSize\":\"xlarge\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d2ef6c07-620f-431e-85f2-77175187e0fe\":{\"columns\":{\"a676e778-cad9-431e-b520-3e87b3a0afb2\":{\"label\":\"Top 5 values of rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\",\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Top Mitre ATT&K tactics\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":19,\"w\":40,\"h\":15,\"i\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\"},\"panelIndex\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"isTransposed\":false,\"columnId\":\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\"},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"columnId\":\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"isTransposed\":false,\"oneClickFilter\":true}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c74264a6-eb65-4232-9444-a503723c6fdf\":{\"label\":\"rule.mitre.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Security Events","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d70ade40-d606-45b2-97e2-3f0e7612df49:panel_d70ade40-d606-45b2-97e2-3f0e7612df49","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"c90b5ced-c476-4336-8248-5f5eee09b7d3:indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:4cd727d8-200d-4869-b702-ff540bd3ff56","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:1b7728c2-28d0-40f9-81ed-74e77231242c","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:933a08d4-fd4c-4829-938c-df17bc87af15","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e:indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e35f33d0-784d-471a-842e-576523d0ca80:indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"ee6f5f4c-2a18-4733-a593-23c1f2a24376:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTUsMV0="} +{"attributes":{"description":"This tracks Wazuh's malware related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":35,\"i\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},\"panelIndex\":\"3aa1520f-1ba9-4584-8f33-a2d86e020bc3\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":17,\"h\":14,\"i\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\"},\"panelIndex\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"LINEAR\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"accessors\":[\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"yConfig\":[{\"forAccessor\":\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\",\"color\":\"#40d4e0\"}]}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\":{\"columns\":{\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Emotet malware activity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":0,\"w\":23,\"h\":14,\"i\":\"cc5ad74e-c871-4ac3-9487-328adc286921\"},\"panelIndex\":\"cc5ad74e-c871-4ac3-9487-328adc286921\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"accessors\":[\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"splitAccessor\":\"52edc505-8c8a-4965-a3f3-46ca861738af\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5ccb00b3-1675-4c9f-a542-927c5930e66e\":{\"columns\":{\"52edc505-8c8a-4965-a3f3-46ca861738af\":{\"label\":\"Top 5 values of data.title\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.title\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]}},\"b662da8a-50ee-4dae-a2bb-25861753d95c\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"f001735e-ca2b-455d-a50a-b7f44b005f0b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"52edc505-8c8a-4965-a3f3-46ca861738af\",\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Rootkits activity over time\"},{\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":14,\"w\":40,\"h\":21,\"i\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\"},\"panelIndex\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\"},{\"isTransposed\":false,\"columnId\":\"1169cee0-a32f-48d2-8e12-2919736d710a\"},{\"isTransposed\":false,\"columnId\":\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"125edb0b-de81-41b8-9612-1d87188e2b12\"},{\"isTransposed\":false,\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\",\"hidden\":true},{\"columnId\":\"694278f2-f767-4450-90f5-4a95905e989f\",\"isTransposed\":false},{\"columnId\":\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"isTransposed\":false}],\"layerId\":\"777017d9-58d0-4f3f-8461-64af784d41a4\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"777017d9-58d0-4f3f-8461-64af784d41a4\":{\"columns\":{\"56e30fec-0d21-4af5-9751-7630c08713e8\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\":{\"label\":\"rule.mitre.technique\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.technique\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1169cee0-a32f-48d2-8e12-2919736d710a\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"23107287-fb86-49ea-bdea-79d55b5e7ea4\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"125edb0b-de81-41b8-9612-1d87188e2b12\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a1caa30b-78e1-493d-bb05-f29242d47609\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"694278f2-f767-4450-90f5-4a95905e989f\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1073b1b6-aa33-4e11-841b-0b6459a56603\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"694278f2-f767-4450-90f5-4a95905e989f\",\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\",\"1169cee0-a32f-48d2-8e12-2919736d710a\",\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"125edb0b-de81-41b8-9612-1d87188e2b12\",\"a1caa30b-78e1-493d-bb05-f29242d47609\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Malware Detection","version":1},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"3aa1520f-1ba9-4584-8f33-a2d86e020bc3:panel_3aa1520f-1ba9-4584-8f33-a2d86e020bc3","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"847a1b06-c15d-41a2-9a08-73b056e959fb:indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"cc5ad74e-c871-4ac3-9487-328adc286921:indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e3873842-502a-4ba4-a3ab-d5bcdc9d908c:indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTcsMV0="} +{"attributes":{"description":"Quick Display dashboard to view security event related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":27,\"i\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\"},\"panelIndex\":\"d08ddf45-10a2-4438-87c9-2162bea57d73\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_d08ddf45-10a2-4438-87c9-2162bea57d73\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":15,\"h\":12,\"i\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\"},\"panelIndex\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"primaryGroups\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\"],\"metrics\":[\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"numberDisplay\":\"hidden\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.7,\"legendSize\":\"large\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\":{\"columns\":{\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"filter\":{\"query\":\"\",\"language\":\"kuery\"}},\"ccea2153-9f5c-4f65-9346-1feceb3783eb\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\",\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert groups\"},{\"type\":\"lens\",\"gridData\":{\"x\":22,\"y\":0,\"w\":26,\"h\":12,\"i\":\"115417e6-11a1-4a55-8055-220b69dad98e\"},\"panelIndex\":\"115417e6-11a1-4a55-8055-220b69dad98e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":false,\"position\":\"right\",\"showSingleSeries\":false},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"accessors\":[\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"splitAccessor\":\"a195fccb-9268-453a-b824-54f1e3f72d12\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"54e72470-df75-47d1-a7a6-3d2f807a39d1\":{\"columns\":{\"a195fccb-9268-453a-b824-54f1e3f72d12\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"audit\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"a195fccb-9268-453a-b824-54f1e3f72d12\",\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"sampling\":1,\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":12,\"w\":41,\"h\":15,\"i\":\"edc2487b-0a85-4975-b841-457471ee5cd0\"},\"panelIndex\":\"edc2487b-0a85-4975-b841-457471ee5cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\"},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\":{\"label\":\"rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":true},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"Wazuh Incident Response","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"d08ddf45-10a2-4438-87c9-2162bea57d73:panel_d08ddf45-10a2-4438-87c9-2162bea57d73","type":"links"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"caf3fb07-a3b0-4f51-b000-926f4b26ee4f:indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"115417e6-11a1-4a55-8055-220b69dad98e:indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"edc2487b-0a85-4975-b841-457471ee5cd0:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTksMV0="} +{"attributes":{"description":"","layout":"vertical","links":[{"destinationRefName":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","id":"88df0698-f98d-410a-a44f-6c02b8c0bc16","label":"Wazuh Security Events","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":0,"type":"dashboardLink"},{"destinationRefName":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","id":"08f3674d-8a6c-477b-8eca-b274f271bf65","label":"Wazuh Vulnerabilities ","options":{"openInNewTab":false,"useCurrentDateRange":true,"useCurrentFilters":true},"order":1,"type":"dashboardLink"},{"destinationRefName":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","id":"9df28651-90ee-42ff-b3a9-5d30443b781f","label":"Wazuh Malware Detection","order":2,"type":"dashboardLink"},{"destinationRefName":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","id":"ea41555a-331c-4ec6-92b7-29e1ceeafc11","label":"Wazuh Incident Response","order":3,"type":"dashboardLink"}],"title":"Wazuh Dashboards:"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","managed":false,"references":[{"id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","name":"link_88df0698-f98d-410a-a44f-6c02b8c0bc16_dashboard","type":"dashboard"},{"id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","name":"link_08f3674d-8a6c-477b-8eca-b274f271bf65_dashboard","type":"dashboard"},{"id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","name":"link_9df28651-90ee-42ff-b3a9-5d30443b781f_dashboard","type":"dashboard"},{"id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","name":"link_ea41555a-331c-4ec6-92b7-29e1ceeafc11_dashboard","type":"dashboard"}],"type":"links","updated_at":"2024-11-04T20:04:10.632Z","version":"WzE1NTgsMV0="} +{"attributes":{"allowHidden":false,"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-states-vulnerabilities-wazuh-manager","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"vulnerability.detected_at","title":"wazuh-states-vulnerabilities-wazuh-manager"},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:40:39.596Z","created_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2024-11-04T20:40:39.596Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE1NzIsMV0="} +{"attributes":{"controlGroupInput":{"chainingSystem":"HIERARCHICAL","controlStyle":"oneLine","ignoreParentSettingsJSON":"{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}","panelsJSON":"{\"ae4a6e83-4b41-41a1-ba66-baac4a181116\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ae4a6e83-4b41-41a1-ba66-baac4a181116\",\"fieldName\":\"agent.name\",\"title\":\"Host Name Filter\",\"grow\":true,\"width\":\"medium\",\"searchTechnique\":\"prefix\",\"selectedOptions\":[],\"exclude\":false,\"enhancements\":{}}}}","showApplySelections":false},"description":"Tracks wazuh's vulnerability related alerts","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"type\":\"links\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":32,\"i\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},\"panelIndex\":\"272fa8b1-b058-4d9b-945f-4369d2f8eb8c\",\"embeddableConfig\":{\"disabledActions\":[\"OPEN_FLYOUT_ADD_DRILLDOWN\"],\"enhancements\":{}},\"panelRefName\":\"panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":11,\"h\":5,\"i\":\"9931cceb-51f1-4e47-bd26-491e7a624592\"},\"panelIndex\":\"9931cceb-51f1-4e47-bd26-491e7a624592\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\"}],\"state\":{\"visualization\":{\"layerId\":\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\",\"layerType\":\"data\",\"metricAccessor\":\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\":{\"columns\":{\"fe99fb3f-debd-4796-9a1a-6277cae75abb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":false,\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"fe99fb3f-debd-4796-9a1a-6277cae75abb\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Critical Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":18,\"y\":0,\"w\":10,\"h\":5,\"i\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\"},\"panelIndex\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15\"}],\"state\":{\"visualization\":{\"layerId\":\"fd6049b6-e52c-449e-9775-ded5ac1eac15\",\"layerType\":\"data\",\"metricAccessor\":\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fd6049b6-e52c-449e-9775-ded5ac1eac15\":{\"columns\":{\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity: \\\"High\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"7610d222-5513-44d3-b3e2-9bb0d2a29c00\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"High Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":28,\"y\":0,\"w\":10,\"h\":5,\"i\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\"},\"panelIndex\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641\"}],\"state\":{\"visualization\":{\"layerId\":\"a8774fa0-5ae6-4746-94bd-cd21a0210641\",\"layerType\":\"data\",\"metricAccessor\":\"2a7bcb09-d553-456e-8af2-8194dff05293\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8774fa0-5ae6-4746-94bd-cd21a0210641\":{\"columns\":{\"2a7bcb09-d553-456e-8af2-8194dff05293\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Medium\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"2a7bcb09-d553-456e-8af2-8194dff05293\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Medium Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":38,\"y\":0,\"w\":10,\"h\":5,\"i\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\"},\"panelIndex\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3\"}],\"state\":{\"visualization\":{\"layerId\":\"a397e361-0b6a-4d18-b957-2afce890f6c3\",\"accessor\":\"33a61fcd-b356-40c3-9f38-ec1b6a607081\",\"layerType\":\"data\",\"colorMode\":\"None\",\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a397e361-0b6a-4d18-b957-2afce890f6c3\":{\"columns\":{\"33a61fcd-b356-40c3-9f38-ec1b6a607081\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"vulnerability.severity\",\"filter\":{\"query\":\"vulnerability.severity : \\\"Low\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"33a61fcd-b356-40c3-9f38-ec1b6a607081\"],\"incompleteColumns\":{},\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}},\"title\":\"Low Vulnerabilities\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":5,\"w\":18,\"h\":14,\"i\":\"8fe06d85-091b-47aa-a809-aae9150a3314\"},\"panelIndex\":\"8fe06d85-091b-47aa-a809-aae9150a3314\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"CURVE_MONOTONE_X\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"47832b00-8a1a-4d99-8631-89379474c236\",\"accessors\":[\"32448531-8094-4131-89c9-38ed77a620ec\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"32448531-8094-4131-89c9-38ed77a620ec\",\"axisMode\":\"auto\"}],\"xAccessor\":\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"splitAccessor\":\"1cc61481-30d8-4719-b629-47daf49c7250\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"47832b00-8a1a-4d99-8631-89379474c236\":{\"columns\":{\"32448531-8094-4131-89c9-38ed77a620ec\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"00593c9d-f971-478e-98a6-78c781a6ae6d\":{\"label\":\"vulnerability.detected_at\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"vulnerability.detected_at\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1cc61481-30d8-4719-b629-47daf49c7250\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"32448531-8094-4131-89c9-38ed77a620ec\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"High\",\"Critical\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"1cc61481-30d8-4719-b629-47daf49c7250\",\"00593c9d-f971-478e-98a6-78c781a6ae6d\",\"32448531-8094-4131-89c9-38ed77a620ec\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert severity\"},{\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":5,\"w\":23,\"h\":14,\"i\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\"},\"panelIndex\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsHeatmap\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\"}],\"state\":{\"visualization\":{\"shape\":\"heatmap\",\"layerId\":\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\",\"layerType\":\"data\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"type\":\"heatmap_legend\"},\"gridConfig\":{\"type\":\"heatmap_grid\",\"isCellLabelVisible\":false,\"isYAxisLabelVisible\":true,\"isXAxisLabelVisible\":true,\"isYAxisTitleVisible\":false,\"isXAxisTitleVisible\":true,\"yTitle\":\"\"},\"valueAccessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\",\"xAccessor\":\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"palette\":{\"type\":\"palette\",\"name\":\"positive\",\"params\":{\"name\":\"positive\",\"continuity\":\"above\",\"reverse\":false,\"stops\":[{\"color\":\"#d6e9e4\",\"stop\":0},{\"color\":\"#aed3ca\",\"stop\":20},{\"color\":\"#85bdb1\",\"stop\":40},{\"color\":\"#5aa898\",\"stop\":60},{\"color\":\"#209280\",\"stop\":80}],\"rangeMin\":0,\"rangeMax\":null},\"accessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"yAccessor\":\"fc5af013-78e6-40e3-8e64-8015aa4f721e\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\":{\"columns\":{\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":false},\"e8d69708-c954-444b-a94f-9eb1befd3197\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"fc5af013-78e6-40e3-8e64-8015aa4f721e\":{\"label\":\"Top 5 values of vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\"],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"fc5af013-78e6-40e3-8e64-8015aa4f721e\",\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Vulnerabilities heat map\"},{\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":19,\"w\":41,\"h\":13,\"i\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\"},\"panelIndex\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\",\"name\":\"indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"oneClickFilter\":true,\"width\":128.25},{\"isTransposed\":false,\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\",\"hidden\":true},{\"columnId\":\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"isTransposed\":false,\"isMetric\":false,\"width\":350},{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"7dcaf287-0461-4459-8009-4d870050dac4\",\"isTransposed\":false,\"isMetric\":false},{\"columnId\":\"e8f9533e-b4ee-4db5-a484-329645593766\",\"isTransposed\":false,\"isMetric\":false}],\"layerId\":\"d94ddf3d-d285-450e-aba4-46057df55fb7\",\"layerType\":\"data\",\"paging\":{\"enabled\":true,\"size\":20},\"sorting\":{\"columnId\":\"4d9643e1-3799-4319-82a1-352650000378\",\"direction\":\"asc\"}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d94ddf3d-d285-450e-aba4-46057df55fb7\":{\"columns\":{\"542028d8-117e-4ee0-ba25-3ff4475940aa\":{\"label\":\"Host Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"f790607c-81f9-4567-82c3-feb4dc9126fe\":{\"label\":\"Vulnerability Severity Score\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"vulnerability.score.base\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"},\"customLabel\":true},\"4d9643e1-3799-4319-82a1-352650000378\":{\"label\":\"Vulnerability Severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[\"Critical\",\"High\",\"Medium\",\"Low\",0],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"7dcaf287-0461-4459-8009-4d870050dac4\":{\"label\":\"Package Name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.name\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"e8f9533e-b4ee-4db5-a484-329645593766\":{\"label\":\"Package Version\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"package.version\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"f790607c-81f9-4567-82c3-feb4dc9126fe\",\"4d9643e1-3799-4319-82a1-352650000378\",\"7dcaf287-0461-4459-8009-4d870050dac4\",\"e8f9533e-b4ee-4db5-a484-329645593766\",\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"],\"incompleteColumns\":{},\"sampling\":1,\"indexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"}},\"currentIndexPatternId\":\"d4523cf5-4b96-4cf8-a704-5845f6e365b9\"},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Events\"}]","timeRestore":false,"title":"Wazuh Vulnerabilities","version":2},"coreMigrationVersion":"8.8.0","created_at":"2024-11-04T20:04:10.632Z","id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","managed":false,"references":[{"id":"2f63ce7b-3d65-47b2-ad89-4983c656e3f7","name":"272fa8b1-b058-4d9b-945f-4369d2f8eb8c:panel_272fa8b1-b058-4d9b-945f-4369d2f8eb8c","type":"links"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"9931cceb-51f1-4e47-bd26-491e7a624592:indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"a0b05cdd-c4b5-46b0-af2e-32253bd965e6:indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"b22f2aba-370b-40f2-8f30-c7175fd21d84:indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"dad9436c-6a56-47cc-a52a-065c86d64c7f:indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"8fe06d85-091b-47aa-a809-aae9150a3314:indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"680cfedf-a868-4de2-8173-897f4df7f6d7:indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"5a8626af-2bc4-4317-ad7f-20622c16db0a:indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7","type":"index-pattern"},{"id":"d4523cf5-4b96-4cf8-a704-5845f6e365b9","name":"controlGroup_ae4a6e83-4b41-41a1-ba66-baac4a181116:optionsListDataView","type":"index-pattern"},{"id":"1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","name":"tag-ref-1ccbc8a5-e4dd-4bd8-8381-7759ece579cb","type":"tag"}],"type":"dashboard","typeMigrationVersion":"10.2.0","updated_at":"2024-11-04T22:11:33.226Z","updated_by":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","version":"WzE2NjMsMV0="} +{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":8,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/dashboards/wazuh/wz-es-4.x-8.x-dashboards.ndjson b/dashboards/wazuh/wz-es-4.x-8.x-dashboards.ndjson deleted file mode 100644 index a02f7704..00000000 --- a/dashboards/wazuh/wz-es-4.x-8.x-dashboards.ndjson +++ /dev/null @@ -1,9 +0,0 @@ -{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"wazuh-alerts-4.x-*","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"timestamp","title":"wazuh-alerts-4.x-*","typeMeta":"{}"},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T17:17:45.191Z","id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","migrationVersion":{"index-pattern":"8.0.0"},"references":[],"type":"index-pattern","updated_at":"2023-04-24T17:17:45.191Z","version":"WzI1MSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":7,\"y\":0,\"w\":8,\"h\":5,\"i\":\"9931cceb-51f1-4e47-bd26-491e7a624592\"},\"panelIndex\":\"9931cceb-51f1-4e47-bd26-491e7a624592\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"b9624937-542e-4ac9-9f09-ae532ade3311\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\",\"accessor\":\"df19010a-26e5-446d-9d74-56fe2495e38b\",\"layerType\":\"data\",\"textAlign\":\"center\",\"size\":\"xxl\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#db5871\",\"stop\":2}],\"colorStops\":[{\"color\":\"#db5871\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"b9624937-542e-4ac9-9f09-ae532ade3311\",\"type\":\"exists\",\"key\":\"data.vulnerability.severity\",\"value\":\"exists\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"data.vulnerability.severity\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"1dc5f9b1-9f0c-458b-98e6-e92708af5b9d\":{\"columns\":{\"df19010a-26e5-446d-9d74-56fe2495e38b\":{\"label\":\"Critical Severity Alerts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"data.vulnerability.severity\",\"isBucketed\":false,\"filter\":{\"query\":\"data.vulnerability.severity : \\\"Critical\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"df19010a-26e5-446d-9d74-56fe2495e38b\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":15,\"y\":0,\"w\":8,\"h\":5,\"i\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\"},\"panelIndex\":\"a0b05cdd-c4b5-46b0-af2e-32253bd965e6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"fd6049b6-e52c-449e-9775-ded5ac1eac15\",\"accessor\":\"2ce8bbeb-74d7-4e28-b616-6edd33c1f981\",\"layerType\":\"data\",\"textAlign\":\"center\",\"size\":\"xxl\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#0c5da3\",\"stop\":2}],\"colorStops\":[{\"color\":\"#0c5da3\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"fd6049b6-e52c-449e-9775-ded5ac1eac15\":{\"columns\":{\"2ce8bbeb-74d7-4e28-b616-6edd33c1f981\":{\"label\":\"Hight Severity Alerts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"data.vulnerability.severity\",\"isBucketed\":false,\"filter\":{\"query\":\"data.vulnerability.severity : \\\"High\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"2ce8bbeb-74d7-4e28-b616-6edd33c1f981\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":23,\"y\":0,\"w\":9,\"h\":5,\"i\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\"},\"panelIndex\":\"b22f2aba-370b-40f2-8f30-c7175fd21d84\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"a8774fa0-5ae6-4746-94bd-cd21a0210641\",\"accessor\":\"b7764bb5-540b-4183-a8c5-e9e856e48949\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#007d73\",\"stop\":2}],\"colorStops\":[{\"color\":\"#007d73\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a8774fa0-5ae6-4746-94bd-cd21a0210641\":{\"columns\":{\"b7764bb5-540b-4183-a8c5-e9e856e48949\":{\"label\":\"Medium Severity Alerts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"data.vulnerability.severity\",\"isBucketed\":false,\"filter\":{\"query\":\"data.vulnerability.severity : \\\"Medium\\\" \",\"language\":\"kuery\"},\"reducedTimeRange\":\"\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"b7764bb5-540b-4183-a8c5-e9e856e48949\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":0,\"w\":9,\"h\":5,\"i\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\"},\"panelIndex\":\"dad9436c-6a56-47cc-a52a-065c86d64c7f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"a532bc3a-2caf-4353-9a37-17d4fb373b0d\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"a397e361-0b6a-4d18-b957-2afce890f6c3\",\"accessor\":\"c0f27509-4ce0-4eca-94c5-e1eddfc176e9\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#222222\",\"stop\":2}],\"colorStops\":[{\"color\":\"#222222\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"a532bc3a-2caf-4353-9a37-17d4fb373b0d\",\"alias\":\"data.vulnerability.severity : \\\"Low\\\" \",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"data.vulnerability.severity\\\":\\\"Low\\\"}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"term\":{\"data.vulnerability.severity\":\"Low\"}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a397e361-0b6a-4d18-b957-2afce890f6c3\":{\"columns\":{\"c0f27509-4ce0-4eca-94c5-e1eddfc176e9\":{\"label\":\"Low Severity Alerts\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"data.vulnerability.severity\",\"isBucketed\":false,\"filter\":{\"query\":\"data.vulnerability.severity : \\\"Low\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"c0f27509-4ce0-4eca-94c5-e1eddfc176e9\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":5,\"w\":25,\"h\":14,\"i\":\"8fe06d85-091b-47aa-a809-aae9150a3314\"},\"panelIndex\":\"8fe06d85-091b-47aa-a809-aae9150a3314\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"CURVE_MONOTONE_X\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"47832b00-8a1a-4d99-8631-89379474c236\",\"accessors\":[\"32448531-8094-4131-89c9-38ed77a620ec\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"yConfig\":[{\"forAccessor\":\"32448531-8094-4131-89c9-38ed77a620ec\",\"axisMode\":\"auto\"}],\"xAccessor\":\"f20c7be6-a511-4b95-be88-6de506dbf1d8\",\"splitAccessor\":\"526e79e6-d985-4fc0-b5f3-ec87f5d24b83\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"47832b00-8a1a-4d99-8631-89379474c236\":{\"columns\":{\"526e79e6-d985-4fc0-b5f3-ec87f5d24b83\":{\"label\":\"Top 5 values of data.vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"32448531-8094-4131-89c9-38ed77a620ec\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f20c7be6-a511-4b95-be88-6de506dbf1d8\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"3h\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"32448531-8094-4131-89c9-38ed77a620ec\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"526e79e6-d985-4fc0-b5f3-ec87f5d24b83\",\"f20c7be6-a511-4b95-be88-6de506dbf1d8\",\"32448531-8094-4131-89c9-38ed77a620ec\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert severity\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":25,\"y\":5,\"w\":23,\"h\":14,\"i\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\"},\"panelIndex\":\"680cfedf-a868-4de2-8173-897f4df7f6d7\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsHeatmap\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"heatmap\",\"layerId\":\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\",\"layerType\":\"data\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"type\":\"heatmap_legend\"},\"gridConfig\":{\"type\":\"heatmap_grid\",\"isCellLabelVisible\":false,\"isYAxisLabelVisible\":true,\"isXAxisLabelVisible\":true,\"isYAxisTitleVisible\":false,\"isXAxisTitleVisible\":true,\"yTitle\":\"\"},\"valueAccessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\",\"yAccessor\":\"6fcc771b-b4e8-4684-80da-49b7b897dc24\",\"xAccessor\":\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"palette\":{\"type\":\"palette\",\"name\":\"positive\",\"params\":{\"name\":\"positive\",\"continuity\":\"above\",\"reverse\":false,\"stops\":[{\"color\":\"#d6e9e4\",\"stop\":0},{\"color\":\"#aed3ca\",\"stop\":20},{\"color\":\"#85bdb1\",\"stop\":40},{\"color\":\"#5aa898\",\"stop\":60},{\"color\":\"#209280\",\"stop\":80}],\"rangeMin\":0,\"rangeMax\":null},\"accessor\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a\":{\"columns\":{\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":false},\"6fcc771b-b4e8-4684-80da-49b7b897dc24\":{\"label\":\"Top 3 values of data.vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.vulnerability.severity\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":false},\"e8d69708-c954-444b-a94f-9eb1befd3197\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"6fcc771b-b4e8-4684-80da-49b7b897dc24\",\"e8d69708-c954-444b-a94f-9eb1befd3197\",\"4e7e0e20-a869-417a-b9ba-fac0c17e10ed\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Vulnerabilities heat map\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":19,\"w\":48,\"h\":14,\"i\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\"},\"panelIndex\":\"5a8626af-2bc4-4317-ad7f-20622c16db0a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"e26de584-b46b-474e-bcd4-11bd37ff8e2e\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"1007fe8b-8a98-4b60-b8ef-93cd49227cd4\"},{\"isTransposed\":false,\"columnId\":\"ec84289b-cb43-4fae-9b94-7b17b696e4e0\"},{\"isTransposed\":false,\"columnId\":\"89ac7aeb-dfe3-449c-a109-6686a3610a4b\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\",\"hidden\":true},{\"columnId\":\"4732efcd-d7cd-4a02-8b03-c498b3bb637c\",\"isTransposed\":false},{\"columnId\":\"056be5db-ea40-4979-9985-8f0c73a8dcef\",\"isTransposed\":false}],\"layerId\":\"d94ddf3d-d285-450e-aba4-46057df55fb7\",\"layerType\":\"data\",\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d94ddf3d-d285-450e-aba4-46057df55fb7\":{\"columns\":{\"542028d8-117e-4ee0-ba25-3ff4475940aa\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"e26de584-b46b-474e-bcd4-11bd37ff8e2e\":{\"label\":\"data.vulnerability.cve\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.vulnerability.cve\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1007fe8b-8a98-4b60-b8ef-93cd49227cd4\":{\"label\":\"data.vulnerability.package.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.vulnerability.package.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"ec84289b-cb43-4fae-9b94-7b17b696e4e0\":{\"label\":\"data.vulnerability.severity\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.vulnerability.package.version\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"89ac7aeb-dfe3-449c-a109-6686a3610a4b\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"4732efcd-d7cd-4a02-8b03-c498b3bb637c\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"056be5db-ea40-4979-9985-8f0c73a8dcef\":{\"label\":\"data.vulnerability.package.version\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.vulnerability.package.version\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"4732efcd-d7cd-4a02-8b03-c498b3bb637c\",\"542028d8-117e-4ee0-ba25-3ff4475940aa\",\"e26de584-b46b-474e-bcd4-11bd37ff8e2e\",\"1007fe8b-8a98-4b60-b8ef-93cd49227cd4\",\"056be5db-ea40-4979-9985-8f0c73a8dcef\",\"ec84289b-cb43-4fae-9b94-7b17b696e4e0\",\"89ac7aeb-dfe3-449c-a109-6686a3610a4b\",\"5a0e5d4b-1345-4f59-ba8b-662451bf949b\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Events\"}]","timeRestore":false,"title":"wazuh-vulnerabilities-v1.0","version":1},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T18:37:41.475Z","id":"1e68dc60-e2b5-11ed-9db8-9f0e23f622c3","migrationVersion":{"dashboard":"8.6.0"},"references":[{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"9931cceb-51f1-4e47-bd26-491e7a624592:indexpattern-datasource-layer-1dc5f9b1-9f0c-458b-98e6-e92708af5b9d","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"9931cceb-51f1-4e47-bd26-491e7a624592:b9624937-542e-4ac9-9f09-ae532ade3311","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"a0b05cdd-c4b5-46b0-af2e-32253bd965e6:indexpattern-datasource-layer-fd6049b6-e52c-449e-9775-ded5ac1eac15","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"b22f2aba-370b-40f2-8f30-c7175fd21d84:indexpattern-datasource-layer-a8774fa0-5ae6-4746-94bd-cd21a0210641","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dad9436c-6a56-47cc-a52a-065c86d64c7f:indexpattern-datasource-layer-a397e361-0b6a-4d18-b957-2afce890f6c3","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dad9436c-6a56-47cc-a52a-065c86d64c7f:a532bc3a-2caf-4353-9a37-17d4fb373b0d","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"8fe06d85-091b-47aa-a809-aae9150a3314:indexpattern-datasource-layer-47832b00-8a1a-4d99-8631-89379474c236","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"680cfedf-a868-4de2-8173-897f4df7f6d7:indexpattern-datasource-layer-6f9a4ce5-1395-4bc6-9dd6-0a8c130e9d8a","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"5a8626af-2bc4-4317-ad7f-20622c16db0a:indexpattern-datasource-layer-d94ddf3d-d285-450e-aba4-46057df55fb7","type":"index-pattern"}],"type":"dashboard","updated_at":"2023-04-24T18:37:41.475Z","version":"WzQ3OSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":5,\"i\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\"},\"panelIndex\":\"c90b5ced-c476-4336-8248-5f5eee09b7d3\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\",\"accessor\":\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1E75B6\",\"stop\":300}],\"colorStops\":[{\"color\":\"#1E75B6\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f7d51ed1-e2c7-4eff-a2f0-426523a27b79\":{\"columns\":{\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\":{\"label\":\"Total\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"bba216ab-0609-4fc7-9f00-3f95df7bd9e5\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":16,\"y\":0,\"w\":8,\"h\":5,\"i\":\"dc864252-a518-4187-80ca-b581ad14f1cb\"},\"panelIndex\":\"dc864252-a518-4187-80ca-b581ad14f1cb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\",\"accessor\":\"65d5d9ac-208b-4393-b498-12f4351445bd\",\"layerType\":\"data\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#e57488\",\"stop\":8}],\"colorStops\":[{\"color\":\"#e57488\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"textAlign\":\"center\",\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"4cd727d8-200d-4869-b702-ff540bd3ff56\",\"alias\":\"rule.level >= 12\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"range\\\":{\\\"rule.level\\\":{\\\"gte\\\":\\\"12\\\"}}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"range\":{\"rule.level\":{\"gte\":\"12\"}}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"a63a4df1-6335-4d1e-a8fb-44d550e0513b\":{\"columns\":{\"65d5d9ac-208b-4393-b498-12f4351445bd\":{\"label\":\"Level 12 or above alerts\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.level >= 12\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"65d5d9ac-208b-4393-b498-12f4351445bd\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":8,\"h\":5,\"i\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\"},\"panelIndex\":\"4bab10c4-2a6d-4f8f-8094-323581c98950\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"28318134-b7bd-4faa-b21e-b0a6665b526f\",\"accessor\":\"e1a6a50b-cffe-4c92-b756-bad658aee97d\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#d4458d\",\"stop\":4}],\"colorStops\":[{\"color\":\"#d4458d\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"1b7728c2-28d0-40f9-81ed-74e77231242c\",\"alias\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"must\\\":[],\\\"filter\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"rule.groups\\\":\\\"authentication_failed\\\"}}],\\\"minimum_should_match\\\":1}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"win_authentication_failed\\\",\\\"lenient\\\":true}},{\\\"multi_match\\\":{\\\"type\\\":\\\"phrase\\\",\\\"query\\\":\\\"authentication_failures\\\",\\\"lenient\\\":true}}],\\\"minimum_should_match\\\":1}}],\\\"should\\\":[],\\\"must_not\\\":[]}}\",\"disabled\":false,\"negate\":false},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"term\":{\"rule.groups\":\"authentication_failed\"}}],\"minimum_should_match\":1}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"win_authentication_failed\",\"lenient\":true}},{\"multi_match\":{\"type\":\"phrase\",\"query\":\"authentication_failures\",\"lenient\":true}}],\"minimum_should_match\":1}}],\"should\":[],\"must_not\":[]}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"28318134-b7bd-4faa-b21e-b0a6665b526f\":{\"columns\":{\"e1a6a50b-cffe-4c92-b756-bad658aee97d\":{\"label\":\"Athentication failure\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups : \\\"authentication_failed\\\" or \\\"win_authentication_failed\\\" or \\\"authentication_failures\\\"\",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"e1a6a50b-cffe-4c92-b756-bad658aee97d\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":0,\"w\":8,\"h\":5,\"i\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\"},\"panelIndex\":\"3cc5e7d4-2f44-438e-8529-6dfae4e29b16\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsLegacyMetric\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"type\":\"index-pattern\"},{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"67c3da39-aad2-4ff4-812f-15cf135b2d12\",\"accessor\":\"ea00d671-3e3a-434a-8813-1dfa3a023112\",\"layerType\":\"data\",\"textAlign\":\"center\",\"colorMode\":\"Labels\",\"palette\":{\"name\":\"custom\",\"type\":\"palette\",\"params\":{\"steps\":3,\"name\":\"custom\",\"reverse\":false,\"rangeType\":\"number\",\"rangeMin\":null,\"rangeMax\":null,\"progression\":\"fixed\",\"stops\":[{\"color\":\"#1a938a\",\"stop\":2}],\"colorStops\":[{\"color\":\"#1a938a\",\"stop\":null}],\"continuity\":\"all\",\"maxSteps\":5}},\"size\":\"xxl\"},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"933a08d4-fd4c-4829-938c-df17bc87af15\",\"type\":\"exists\",\"key\":\"rule.groups\",\"value\":\"exists\",\"disabled\":false,\"negate\":false,\"alias\":null},\"query\":{\"exists\":{\"field\":\"rule.groups\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"67c3da39-aad2-4ff4-812f-15cf135b2d12\":{\"columns\":{\"ea00d671-3e3a-434a-8813-1dfa3a023112\":{\"label\":\"Authentication success\",\"dataType\":\"number\",\"operationType\":\"unique_count\",\"scale\":\"ratio\",\"sourceField\":\"rule.groups\",\"isBucketed\":false,\"filter\":{\"query\":\"rule.groups: \\\"authentication_success\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"ea00d671-3e3a-434a-8813-1dfa3a023112\"],\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":5,\"w\":32,\"h\":14,\"i\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\"},\"panelIndex\":\"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"e8600050-5477-49a7-a28e-ce9a47ded5f5\",\"accessors\":[\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"splitAccessor\":\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"xAccessor\":\"c5296771-93c8-48cb-bf57-cad19d8c829e\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"e8600050-5477-49a7-a28e-ce9a47ded5f5\":{\"columns\":{\"8d76d731-1e09-4706-b3d9-48108dd7dd32\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"c5296771-93c8-48cb-bf57-cad19d8c829e\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":false,\"dropPartials\":false}},\"3f2d0dea-171c-41ed-9452-29106c10a968\":{\"label\":\"Top 5 values of agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"3f2d0dea-171c-41ed-9452-29106c10a968\",\"c5296771-93c8-48cb-bf57-cad19d8c829e\",\"8d76d731-1e09-4706-b3d9-48108dd7dd32\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alerts evolution - Top 5 agents\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":32,\"y\":5,\"w\":16,\"h\":14,\"i\":\"e35f33d0-784d-471a-842e-576523d0ca80\"},\"panelIndex\":\"e35f33d0-784d-471a-842e-576523d0ca80\",\"embeddableConfig\":{\"attributes\":{\"title\":\"Top Mitre\",\"description\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"pie\",\"layers\":[{\"layerId\":\"d2ef6c07-620f-431e-85f2-77175187e0fe\",\"primaryGroups\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\"],\"metrics\":[\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.3,\"legendSize\":\"xlarge\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"d2ef6c07-620f-431e-85f2-77175187e0fe\":{\"columns\":{\"a676e778-cad9-431e-b520-3e87b3a0afb2\":{\"label\":\"Top 5 values of rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"a676e778-cad9-431e-b520-3e87b3a0afb2\",\"c2640e02-f544-4f25-a0a4-aaec8e9e2f47\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Top Mitre ATT&K tactics\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":19,\"w\":48,\"h\":15,\"i\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\"},\"panelIndex\":\"ee6f5f4c-2a18-4733-a593-23c1f2a24376\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"isTransposed\":false,\"columnId\":\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\"},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"columnId\":\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"isTransposed\":false,\"oneClickFilter\":true}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"c74264a6-eb65-4232-9444-a503723c6fdf\":{\"label\":\"rule.mitre.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"c74264a6-eb65-4232-9444-a503723c6fdf\",\"5333b889-bfc5-4e1a-a4e3-54828d1dd91b\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"wazuh-security-events-v1.0","version":1},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T18:37:25.862Z","id":"1002c610-a23f-11ed-9c45-1d7f2cbf4bd8","migrationVersion":{"dashboard":"8.6.0"},"references":[{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"c90b5ced-c476-4336-8248-5f5eee09b7d3:indexpattern-datasource-layer-f7d51ed1-e2c7-4eff-a2f0-426523a27b79","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:indexpattern-datasource-layer-a63a4df1-6335-4d1e-a8fb-44d550e0513b","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"dc864252-a518-4187-80ca-b581ad14f1cb:4cd727d8-200d-4869-b702-ff540bd3ff56","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:indexpattern-datasource-layer-28318134-b7bd-4faa-b21e-b0a6665b526f","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"4bab10c4-2a6d-4f8f-8094-323581c98950:1b7728c2-28d0-40f9-81ed-74e77231242c","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:indexpattern-datasource-layer-67c3da39-aad2-4ff4-812f-15cf135b2d12","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"3cc5e7d4-2f44-438e-8529-6dfae4e29b16:933a08d4-fd4c-4829-938c-df17bc87af15","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"fc1f8b94-2637-4f4d-a998-f6a59c6b9e7e:indexpattern-datasource-layer-e8600050-5477-49a7-a28e-ce9a47ded5f5","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e35f33d0-784d-471a-842e-576523d0ca80:indexpattern-datasource-layer-d2ef6c07-620f-431e-85f2-77175187e0fe","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"ee6f5f4c-2a18-4733-a593-23c1f2a24376:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"}],"type":"dashboard","updated_at":"2023-04-24T18:37:25.862Z","version":"WzQ3MiwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.6.2\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":29,\"h\":15,\"i\":\"976e6302-500a-427c-bd29-75cee9034fe6\"},\"panelIndex\":\"976e6302-500a-427c-bd29-75cee9034fe6\",\"embeddableConfig\":{\"savedVis\":{\"id\":\"\",\"title\":\"PCI DSS requirements\",\"description\":\"\",\"type\":\"line\",\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false,\"valueAxis\":\"\"},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{},\"style\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":true,\"truncate\":100},\"title\":{\"text\":\"\"},\"style\":{}}],\"seriesParams\":[{\"show\":true,\"type\":\"line\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"lineWidth\":0,\"showCircles\":true,\"circlesRadius\":10,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"detailedTooltip\":true,\"palette\":{\"type\":\"palette\",\"name\":\"default\"},\"addLegend\":true,\"legendPosition\":\"right\",\"fittingFunction\":\"linear\",\"times\":[],\"addTimeMarker\":false,\"truncateLegend\":true,\"maxLegendLines\":1,\"radiusRatio\":9,\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"labels\":{}},\"uiState\":{},\"data\":{\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{\"emptyAsNull\":false},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"params\":{\"field\":\"timestamp\",\"timeRange\":{\"from\":\"now-10w\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"extendToTimeRange\":false,\"scaleMetricValues\":false,\"interval\":\"auto\",\"used_interval\":\"1d\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}},\"schema\":\"segment\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"rule.pci_dss\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"includeIsRegex\":true,\"excludeIsRegex\":true},\"schema\":\"group\"}],\"searchSource\":{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}}},\"enhancements\":{}}},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":29,\"y\":0,\"w\":19,\"h\":15,\"i\":\"d299d776-0b4f-4955-b7d6-5717119dba59\"},\"panelIndex\":\"d299d776-0b4f-4955-b7d6-5717119dba59\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-c85ec231-a4fc-495d-b8d6-1aad7dc1e489\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"c85ec231-a4fc-495d-b8d6-1aad7dc1e489\",\"accessors\":[\"0ca7b7c5-03fd-401d-bd44-201d8ca00b25\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"e17436ee-06c3-4b4e-acda-f8d379648407\",\"splitAccessor\":\"852bf376-24f0-4b54-8568-0964c3289eb4\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c85ec231-a4fc-495d-b8d6-1aad7dc1e489\":{\"columns\":{\"e17436ee-06c3-4b4e-acda-f8d379648407\":{\"label\":\"Requirements\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.pci_dss\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0ca7b7c5-03fd-401d-bd44-201d8ca00b25\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"0ca7b7c5-03fd-401d-bd44-201d8ca00b25\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"852bf376-24f0-4b54-8568-0964c3289eb4\":{\"label\":\"Top 5 values of agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0ca7b7c5-03fd-401d-bd44-201d8ca00b25\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"e17436ee-06c3-4b4e-acda-f8d379648407\",\"852bf376-24f0-4b54-8568-0964c3289eb4\",\"0ca7b7c5-03fd-401d-bd44-201d8ca00b25\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Requirements by agent\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":15,\"w\":48,\"h\":17,\"i\":\"f3674cc2-b4c6-44e1-baa9-6dcb9b932a01\"},\"panelIndex\":\"f3674cc2-b4c6-44e1-baa9-6dcb9b932a01\",\"embeddableConfig\":{\"attributes\":{\"title\":\"PCI DSS\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-951964d6-a0d3-4593-911f-b598f1bdd7a6\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"layerId\":\"951964d6-a0d3-4593-911f-b598f1bdd7a6\",\"layerType\":\"data\",\"columns\":[{\"isTransposed\":false,\"columnId\":\"27ae8c68-e64e-4824-9422-df1611b74c58\"},{\"isTransposed\":false,\"columnId\":\"30508bd4-917e-4614-9922-c445af8e8a8f\"},{\"isTransposed\":false,\"columnId\":\"7044d45a-dce5-4fbe-8af4-64a9b1e14840\"},{\"isTransposed\":false,\"columnId\":\"49885e99-2da3-4165-9b20-9d78ccaca4bd\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"df70835d-3cfb-4ead-a942-d60c00330c30\"},{\"columnId\":\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\",\"isTransposed\":false,\"hidden\":true},{\"columnId\":\"f96a237b-410c-475c-863e-60acde29fc71\",\"isTransposed\":false,\"oneClickFilter\":true}],\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"951964d6-a0d3-4593-911f-b598f1bdd7a6\":{\"columns\":{\"27ae8c68-e64e-4824-9422-df1611b74c58\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"30508bd4-917e-4614-9922-c445af8e8a8f\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"7044d45a-dce5-4fbe-8af4-64a9b1e14840\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"49885e99-2da3-4165-9b20-9d78ccaca4bd\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"df70835d-3cfb-4ead-a942-d60c00330c30\":{\"label\":\"rule.pci_dss\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.pci_dss\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"f96a237b-410c-475c-863e-60acde29fc71\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"7044d45a-dce5-4fbe-8af4-64a9b1e14840\",\"49885e99-2da3-4165-9b20-9d78ccaca4bd\",\"df70835d-3cfb-4ead-a942-d60c00330c30\",\"27ae8c68-e64e-4824-9422-df1611b74c58\",\"30508bd4-917e-4614-9922-c445af8e8a8f\",\"f96a237b-410c-475c-863e-60acde29fc71\",\"f7cf15d8-617e-4a52-bdc2-6b94a9c722ad\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Recent events\"}]","timeRestore":false,"title":"wazuh-pci-dss-v1.0","version":1},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T18:37:10.201Z","id":"ad09bc40-a634-11ed-8b0e-91d62e747cc9","migrationVersion":{"dashboard":"8.6.0"},"references":[{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"976e6302-500a-427c-bd29-75cee9034fe6:kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"d299d776-0b4f-4955-b7d6-5717119dba59:indexpattern-datasource-layer-c85ec231-a4fc-495d-b8d6-1aad7dc1e489","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"f3674cc2-b4c6-44e1-baa9-6dcb9b932a01:indexpattern-datasource-layer-951964d6-a0d3-4593-911f-b598f1bdd7a6","type":"index-pattern"}],"type":"dashboard","updated_at":"2023-04-24T18:37:10.201Z","version":"WzQ2NSwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":0,\"w\":18,\"h\":13,\"i\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\"},\"panelIndex\":\"847a1b06-c15d-41a2-9a08-73b056e959fb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"LINEAR\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\",\"accessors\":[\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"yConfig\":[{\"forAccessor\":\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\",\"color\":\"#40d4e0\"}]}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"0c3e7889-e551-4507-bb13-1a4ff7d96f96\":{\"columns\":{\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"f4e6f4ad-fca2-4012-9dc4-a34df1d4a5ec\",\"9b7ab5ea-5a4d-4fc1-a493-861ed613bfdb\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Emotet malware activity\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":18,\"y\":0,\"w\":30,\"h\":13,\"i\":\"cc5ad74e-c871-4ac3-9487-328adc286921\"},\"panelIndex\":\"cc5ad74e-c871-4ac3-9487-328adc286921\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"line\",\"layers\":[{\"layerId\":\"5ccb00b3-1675-4c9f-a542-927c5930e66e\",\"accessors\":[\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"position\":\"top\",\"seriesType\":\"line\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"splitAccessor\":\"52edc505-8c8a-4965-a3f3-46ca861738af\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"5ccb00b3-1675-4c9f-a542-927c5930e66e\":{\"columns\":{\"52edc505-8c8a-4965-a3f3-46ca861738af\":{\"label\":\"Top 5 values of data.title\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.title\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]}},\"b662da8a-50ee-4dae-a2bb-25861753d95c\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"f001735e-ca2b-455d-a50a-b7f44b005f0b\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"52edc505-8c8a-4965-a3f3-46ca861738af\",\"b662da8a-50ee-4dae-a2bb-25861753d95c\",\"f001735e-ca2b-455d-a50a-b7f44b005f0b\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Rootkits activity over time\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":13,\"w\":48,\"h\":21,\"i\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\"},\"panelIndex\":\"e3873842-502a-4ba4-a3ab-d5bcdc9d908c\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\"},{\"isTransposed\":false,\"columnId\":\"1169cee0-a32f-48d2-8e12-2919736d710a\"},{\"isTransposed\":false,\"columnId\":\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"125edb0b-de81-41b8-9612-1d87188e2b12\"},{\"isTransposed\":false,\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\",\"hidden\":true},{\"columnId\":\"694278f2-f767-4450-90f5-4a95905e989f\",\"isTransposed\":false},{\"columnId\":\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"isTransposed\":false}],\"layerId\":\"777017d9-58d0-4f3f-8461-64af784d41a4\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"777017d9-58d0-4f3f-8461-64af784d41a4\":{\"columns\":{\"56e30fec-0d21-4af5-9751-7630c08713e8\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\":{\"label\":\"rule.mitre.technique\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.technique\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1169cee0-a32f-48d2-8e12-2919736d710a\":{\"label\":\"rule.mitre.tactic\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.mitre.tactic\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"23107287-fb86-49ea-bdea-79d55b5e7ea4\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"125edb0b-de81-41b8-9612-1d87188e2b12\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a1caa30b-78e1-493d-bb05-f29242d47609\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"rootcheck\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"694278f2-f767-4450-90f5-4a95905e989f\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"1073b1b6-aa33-4e11-841b-0b6459a56603\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"a1caa30b-78e1-493d-bb05-f29242d47609\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"694278f2-f767-4450-90f5-4a95905e989f\",\"56e30fec-0d21-4af5-9751-7630c08713e8\",\"94ca03f4-c063-4be7-b4c1-007c8a6d271a\",\"1169cee0-a32f-48d2-8e12-2919736d710a\",\"1073b1b6-aa33-4e11-841b-0b6459a56603\",\"23107287-fb86-49ea-bdea-79d55b5e7ea4\",\"125edb0b-de81-41b8-9612-1d87188e2b12\",\"a1caa30b-78e1-493d-bb05-f29242d47609\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{}},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"wazuh-malware-detection-v1.0","version":1},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T18:36:31.797Z","id":"f9bb41b0-a3cf-11ed-9187-5147a2b9eedf","migrationVersion":{"dashboard":"8.6.0"},"references":[{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"847a1b06-c15d-41a2-9a08-73b056e959fb:indexpattern-datasource-layer-0c3e7889-e551-4507-bb13-1a4ff7d96f96","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"cc5ad74e-c871-4ac3-9487-328adc286921:indexpattern-datasource-layer-5ccb00b3-1675-4c9f-a542-927c5930e66e","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"e3873842-502a-4ba4-a3ab-d5bcdc9d908c:indexpattern-datasource-layer-777017d9-58d0-4f3f-8461-64af784d41a4","type":"index-pattern"}],"type":"dashboard","updated_at":"2023-04-24T18:36:31.797Z","version":"WzQwNywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":0,\"w\":15,\"h\":13,\"i\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\"},\"panelIndex\":\"caf3fb07-a3b0-4f51-b000-926f4b26ee4f\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\",\"primaryGroups\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\"],\"metrics\":[\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"numberDisplay\":\"hidden\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.7,\"legendSize\":\"large\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d\":{\"columns\":{\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"filter\":{\"query\":\"\",\"language\":\"kuery\"}},\"ccea2153-9f5c-4f65-9346-1feceb3783eb\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"ccea2153-9f5c-4f65-9346-1feceb3783eb\",\"06ae1d26-0a3a-4f59-b5bd-8cb93b640f86\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Alert groups\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":15,\"y\":0,\"w\":33,\"h\":13,\"i\":\"115417e6-11a1-4a55-8055-220b69dad98e\"},\"panelIndex\":\"115417e6-11a1-4a55-8055-220b69dad98e\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":false,\"position\":\"right\",\"showSingleSeries\":false},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"54e72470-df75-47d1-a7a6-3d2f807a39d1\",\"accessors\":[\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"splitAccessor\":\"a195fccb-9268-453a-b824-54f1e3f72d12\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"54e72470-df75-47d1-a7a6-3d2f807a39d1\":{\"columns\":{\"a195fccb-9268-453a-b824-54f1e3f72d12\":{\"label\":\"Top 5 values of rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"audit\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"a195fccb-9268-453a-b824-54f1e3f72d12\",\"f518cf1a-0d1d-44c7-97a0-12c5cd840e14\",\"db53a2e0-d936-4f7c-86bb-fc4e20810e64\"],\"sampling\":1,\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":13,\"w\":48,\"h\":13,\"i\":\"edc2487b-0a85-4975-b841-457471ee5cd0\"},\"panelIndex\":\"edc2487b-0a85-4975-b841-457471ee5cd0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\"},{\"columnId\":\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"isTransposed\":false},{\"isTransposed\":false,\"columnId\":\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"884cc56d-feb1-40dd-89a9-e006ec72dd85\"},{\"columnId\":\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"isTransposed\":false,\"oneClickFilter\":false},{\"isTransposed\":false,\"columnId\":\"b3369c71-8edb-4569-89df-883f23ea2785\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\",\"hidden\":true,\"colorMode\":\"none\"}],\"layerId\":\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f001be29-b6cc-4c99-8aae-5941a7f9a8ee\":{\"columns\":{\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\":{\"label\":\"rule.groups\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.groups\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"72a21fae-312d-4cbb-8a94-fa24d4b29933\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"884cc56d-feb1-40dd-89a9-e006ec72dd85\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"6bb85b4f-0834-416d-8ade-49d83caac7ee\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"b3369c71-8edb-4569-89df-883f23ea2785\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"233f059c-ccd6-4a64-a6be-4961a3c4d500\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"4a2c3535-ba05-42d2-8dbb-5218d3309ea6\",\"72a21fae-312d-4cbb-8a94-fa24d4b29933\",\"5f8c9137-f9b6-4074-ba6c-9fa777b6afdf\",\"884cc56d-feb1-40dd-89a9-e006ec72dd85\",\"6bb85b4f-0834-416d-8ade-49d83caac7ee\",\"b3369c71-8edb-4569-89df-883f23ea2785\",\"233f059c-ccd6-4a64-a6be-4961a3c4d500\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":true},\"title\":\"Security alerts\"}]","timeRestore":false,"title":"wazuh-incident-response-v1.0","version":1},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T18:36:14.435Z","id":"e30257a0-a641-11ed-8b0e-91d62e747cc9","migrationVersion":{"dashboard":"8.6.0"},"references":[{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"caf3fb07-a3b0-4f51-b000-926f4b26ee4f:indexpattern-datasource-layer-3ef3cbb5-abf3-4697-9e38-f4cf60bcdd5d","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"115417e6-11a1-4a55-8055-220b69dad98e:indexpattern-datasource-layer-54e72470-df75-47d1-a7a6-3d2f807a39d1","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"edc2487b-0a85-4975-b841-457471ee5cd0:indexpattern-datasource-layer-f001be29-b6cc-4c99-8aae-5941a7f9a8ee","type":"index-pattern"}],"type":"dashboard","updated_at":"2023-04-24T18:36:14.435Z","version":"WzQwMCwxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":0,\"w\":14,\"h\":12,\"i\":\"9c90478b-ef8d-4f0a-89ea-7cac2fb2b631\"},\"panelIndex\":\"9c90478b-ef8d-4f0a-89ea-7cac2fb2b631\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-b9d91550-4d81-4724-926b-368cbac70c5c\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"b9d91550-4d81-4724-926b-368cbac70c5c\",\"primaryGroups\":[\"393155df-15ed-400b-bef4-be554873a6c6\"],\"metrics\":[\"bc0afca3-aed2-4b22-970c-c91ac3e2bc02\"],\"numberDisplay\":\"percent\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.7}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"b9d91550-4d81-4724-926b-368cbac70c5c\":{\"columns\":{\"393155df-15ed-400b-bef4-be554873a6c6\":{\"label\":\"Top 5 values of data.docker.Action\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.docker.Action\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"bc0afca3-aed2-4b22-970c-c91ac3e2bc02\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}},\"bc0afca3-aed2-4b22-970c-c91ac3e2bc02\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"393155df-15ed-400b-bef4-be554873a6c6\",\"bc0afca3-aed2-4b22-970c-c91ac3e2bc02\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Top 5 events\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":14,\"y\":0,\"w\":34,\"h\":12,\"i\":\"ec92f542-1336-4a92-90e6-548fa7a78db6\"},\"panelIndex\":\"ec92f542-1336-4a92-90e6-548fa7a78db6\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-45315f08-c693-4bdc-aa72-8546f280b2b2\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"45315f08-c693-4bdc-aa72-8546f280b2b2\",\"accessors\":[\"69651d63-8697-41d8-b639-5d77e806c90a\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"93ae869a-82d8-4825-9391-568728d510a7\",\"splitAccessor\":\"588460de-4d21-471e-922f-0b59d3ec977f\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"45315f08-c693-4bdc-aa72-8546f280b2b2\":{\"columns\":{\"93ae869a-82d8-4825-9391-568728d510a7\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"69651d63-8697-41d8-b639-5d77e806c90a\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true},\"customLabel\":true},\"588460de-4d21-471e-922f-0b59d3ec977f\":{\"label\":\"Top 3 values of data.docker.Type\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.docker.Type\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"69651d63-8697-41d8-b639-5d77e806c90a\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false}}},\"columnOrder\":[\"588460de-4d21-471e-922f-0b59d3ec977f\",\"93ae869a-82d8-4825-9391-568728d510a7\",\"69651d63-8697-41d8-b639-5d77e806c90a\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events by source over time\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":12,\"w\":48,\"h\":37,\"i\":\"cac9a63e-4892-4879-bd94-210fd3b5b3d0\"},\"panelIndex\":\"cac9a63e-4892-4879-bd94-210fd3b5b3d0\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-c51272e9-4ceb-4095-a2a2-7d27d957fc4e\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"columnId\":\"1cedf71d-5da2-423a-8108-0d28190dc1f2\",\"isTransposed\":false},{\"columnId\":\"09e332ce-350b-499a-8df5-9b15ed375c20\",\"isTransposed\":false,\"oneClickFilter\":true},{\"columnId\":\"e323b79e-be8f-458d-80b9-100d79e6fc3c\",\"isTransposed\":false,\"hidden\":true},{\"columnId\":\"655b8229-82ac-4302-a97c-a5b1778f22f9\",\"isTransposed\":false},{\"columnId\":\"c47bc042-54fd-4134-9cec-05f36c5c95e0\",\"isTransposed\":false},{\"columnId\":\"1bef96c9-5098-47db-9d76-2eba9c1cfd33\",\"isTransposed\":false},{\"columnId\":\"a61f2679-de38-4a5d-b105-dab5d341a400\",\"isTransposed\":false},{\"columnId\":\"f7109d3b-68d4-418c-b4c4-fe451858d375\",\"isTransposed\":false},{\"columnId\":\"28c7593f-f805-4cbd-afed-94dfdbde7d29\",\"isTransposed\":false,\"oneClickFilter\":true}],\"layerId\":\"c51272e9-4ceb-4095-a2a2-7d27d957fc4e\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c51272e9-4ceb-4095-a2a2-7d27d957fc4e\":{\"columns\":{\"1cedf71d-5da2-423a-8108-0d28190dc1f2\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"09e332ce-350b-499a-8df5-9b15ed375c20\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"e323b79e-be8f-458d-80b9-100d79e6fc3c\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"e323b79e-be8f-458d-80b9-100d79e6fc3c\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"655b8229-82ac-4302-a97c-a5b1778f22f9\":{\"label\":\"data.docker.Type\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.docker.Type\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"e323b79e-be8f-458d-80b9-100d79e6fc3c\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"c47bc042-54fd-4134-9cec-05f36c5c95e0\":{\"label\":\"data.docker.Action\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.docker.Action\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"e323b79e-be8f-458d-80b9-100d79e6fc3c\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]},\"customLabel\":true},\"1bef96c9-5098-47db-9d76-2eba9c1cfd33\":{\"label\":\"data.docker.Actor.ID\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.docker.Actor.ID\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"e323b79e-be8f-458d-80b9-100d79e6fc3c\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"a61f2679-de38-4a5d-b105-dab5d341a400\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"e323b79e-be8f-458d-80b9-100d79e6fc3c\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"f7109d3b-68d4-418c-b4c4-fe451858d375\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"28c7593f-f805-4cbd-afed-94dfdbde7d29\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"e323b79e-be8f-458d-80b9-100d79e6fc3c\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"1cedf71d-5da2-423a-8108-0d28190dc1f2\",\"09e332ce-350b-499a-8df5-9b15ed375c20\",\"655b8229-82ac-4302-a97c-a5b1778f22f9\",\"1bef96c9-5098-47db-9d76-2eba9c1cfd33\",\"c47bc042-54fd-4134-9cec-05f36c5c95e0\",\"a61f2679-de38-4a5d-b105-dab5d341a400\",\"f7109d3b-68d4-418c-b4c4-fe451858d375\",\"28c7593f-f805-4cbd-afed-94dfdbde7d29\",\"e323b79e-be8f-458d-80b9-100d79e6fc3c\"],\"sampling\":1,\"incompleteColumns\":{}}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events\"}]","timeRestore":false,"title":"wazuh-docker-listener-v1.0","version":1},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T18:35:50.548Z","id":"8359c240-a7cf-11ed-8b0e-91d62e747cc9","migrationVersion":{"dashboard":"8.6.0"},"references":[{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"9c90478b-ef8d-4f0a-89ea-7cac2fb2b631:indexpattern-datasource-layer-b9d91550-4d81-4724-926b-368cbac70c5c","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"ec92f542-1336-4a92-90e6-548fa7a78db6:indexpattern-datasource-layer-45315f08-c693-4bdc-aa72-8546f280b2b2","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"cac9a63e-4892-4879-bd94-210fd3b5b3d0:indexpattern-datasource-layer-c51272e9-4ceb-4095-a2a2-7d27d957fc4e","type":"index-pattern"}],"type":"dashboard","updated_at":"2023-04-24T18:35:50.548Z","version":"WzM5MywxXQ=="} -{"attributes":{"description":"","kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncCursor\":true,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":0,\"w\":31,\"h\":15,\"i\":\"5177564c-7c79-4412-9c03-99dca92b90d5\"},\"panelIndex\":\"5177564c-7c79-4412-9c03-99dca92b90d5\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-bca83102-e00c-4277-b280-a91ef087536e\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"legend\":{\"isVisible\":true,\"position\":\"left\"},\"valueLabels\":\"hide\",\"fittingFunction\":\"None\",\"curveType\":\"CURVE_MONOTONE_X\",\"fillOpacity\":1,\"axisTitlesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"tickLabelsVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"labelsOrientation\":{\"x\":0,\"yLeft\":0,\"yRight\":0},\"gridlinesVisibilitySettings\":{\"x\":true,\"yLeft\":true,\"yRight\":true},\"preferredSeriesType\":\"area_stacked\",\"layers\":[{\"layerId\":\"bca83102-e00c-4277-b280-a91ef087536e\",\"accessors\":[\"80ac5cd7-4cfb-4c07-ad75-3cedb6212f18\"],\"position\":\"top\",\"seriesType\":\"area_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"4d2f8c1f-5ce3-449b-b0d7-f1d1989ba49e\",\"splitAccessor\":\"0e534aac-0aaf-4458-8d88-e2575fb2ebb9\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"bca83102-e00c-4277-b280-a91ef087536e\":{\"columns\":{\"0e534aac-0aaf-4458-8d88-e2575fb2ebb9\":{\"label\":\"Top 3 values of data.aws.source\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.aws.source\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"80ac5cd7-4cfb-4c07-ad75-3cedb6212f18\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]}},\"4d2f8c1f-5ce3-449b-b0d7-f1d1989ba49e\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"80ac5cd7-4cfb-4c07-ad75-3cedb6212f18\":{\"label\":\"Count\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"filter\":{\"query\":\"rule.groups : \\\"amazon\\\" \",\"language\":\"kuery\"},\"params\":{\"emptyAsNull\":true},\"customLabel\":true}},\"columnOrder\":[\"0e534aac-0aaf-4458-8d88-e2575fb2ebb9\",\"4d2f8c1f-5ce3-449b-b0d7-f1d1989ba49e\",\"80ac5cd7-4cfb-4c07-ad75-3cedb6212f18\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events by source over time\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":31,\"y\":0,\"w\":17,\"h\":15,\"i\":\"692e518d-0688-414b-92e8-6b2bf1b960dd\"},\"panelIndex\":\"692e518d-0688-414b-92e8-6b2bf1b960dd\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsPie\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-ecb05aff-bc9d-4ba1-b817-bf4016e0c5ef\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"shape\":\"donut\",\"layers\":[{\"layerId\":\"ecb05aff-bc9d-4ba1-b817-bf4016e0c5ef\",\"primaryGroups\":[\"e81edf81-ce10-496b-8ca9-eb38d5ff2ccb\"],\"metrics\":[\"4a2c1031-e343-427d-b141-b47ccc7a570a\"],\"numberDisplay\":\"hidden\",\"categoryDisplay\":\"hide\",\"legendDisplay\":\"show\",\"nestedLegend\":false,\"layerType\":\"data\",\"emptySizeRatio\":0.7}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"ecb05aff-bc9d-4ba1-b817-bf4016e0c5ef\":{\"columns\":{\"e81edf81-ce10-496b-8ca9-eb38d5ff2ccb\":{\"label\":\"Top 5 values of data.aws.source\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.aws.source\",\"isBucketed\":true,\"params\":{\"size\":5,\"orderBy\":{\"type\":\"column\",\"columnId\":\"4a2c1031-e343-427d-b141-b47ccc7a570a\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false,\"secondaryFields\":[]}},\"4a2c1031-e343-427d-b141-b47ccc7a570a\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"e81edf81-ce10-496b-8ca9-eb38d5ff2ccb\",\"4a2c1031-e343-427d-b141-b47ccc7a570a\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Sources\"},{\"version\":\"8.6.2\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":15,\"w\":48,\"h\":15,\"i\":\"25e0d536-4163-46e6-abd5-5cd45cd9f30a\"},\"panelIndex\":\"25e0d536-4163-46e6-abd5-5cd45cd9f30a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"e\",\"description\":\"\",\"visualizationType\":\"lnsDatatable\",\"type\":\"lens\",\"references\":[{\"id\":\"f410770f-a2da-47db-8a47-20b2ddbdcf5e\",\"name\":\"indexpattern-datasource-layer-c23cdcb3-1e5c-46f0-9ef2-827d9b867cb2\",\"type\":\"index-pattern\"}],\"state\":{\"visualization\":{\"columns\":[{\"isTransposed\":false,\"columnId\":\"8882fc10-f772-4a02-af1f-049b59a04dfd\",\"oneClickFilter\":true},{\"isTransposed\":false,\"columnId\":\"1835ff08-affb-403c-991e-8e642c7a5456\"},{\"isTransposed\":false,\"columnId\":\"6dce6ade-b342-4645-9ff2-228f319d69f7\"},{\"isTransposed\":false,\"columnId\":\"f8266242-342d-4046-8bb5-90efe4839a60\",\"hidden\":true},{\"columnId\":\"06b78908-beb7-4a01-a9b0-b7f9775318d9\",\"isTransposed\":false},{\"columnId\":\"ea992e31-8ea1-4548-8182-da51c911cf21\",\"isTransposed\":false},{\"columnId\":\"a8c6efd9-93b3-4636-96ea-43b359962134\",\"isTransposed\":false,\"oneClickFilter\":true}],\"layerId\":\"c23cdcb3-1e5c-46f0-9ef2-827d9b867cb2\",\"layerType\":\"data\",\"headerRowHeight\":\"custom\",\"headerRowHeightLines\":2,\"rowHeight\":\"custom\",\"rowHeightLines\":2,\"paging\":{\"size\":10,\"enabled\":true}},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"c23cdcb3-1e5c-46f0-9ef2-827d9b867cb2\":{\"columns\":{\"8882fc10-f772-4a02-af1f-049b59a04dfd\":{\"label\":\"agent.name\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"agent.name\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f8266242-342d-4046-8bb5-90efe4839a60\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"1835ff08-affb-403c-991e-8e642c7a5456\":{\"label\":\"data.aws.source\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"data.aws.source\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f8266242-342d-4046-8bb5-90efe4839a60\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"6dce6ade-b342-4645-9ff2-228f319d69f7\":{\"label\":\"timestamp\",\"dataType\":\"date\",\"operationType\":\"date_histogram\",\"sourceField\":\"timestamp\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"interval\":\"auto\",\"includeEmptyRows\":true,\"dropPartials\":false}},\"f8266242-342d-4046-8bb5-90efe4839a60\":{\"label\":\"Count of records\",\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"06b78908-beb7-4a01-a9b0-b7f9775318d9\":{\"label\":\"rule.description\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.description\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f8266242-342d-4046-8bb5-90efe4839a60\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true},\"ea992e31-8ea1-4548-8182-da51c911cf21\":{\"label\":\"rule.level\",\"dataType\":\"number\",\"operationType\":\"range\",\"sourceField\":\"rule.level\",\"isBucketed\":true,\"scale\":\"interval\",\"params\":{\"includeEmptyRows\":true,\"type\":\"histogram\",\"ranges\":[{\"from\":0,\"to\":1000,\"label\":\"\"}],\"maxBars\":\"auto\"}},\"a8c6efd9-93b3-4636-96ea-43b359962134\":{\"label\":\"rule.id\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"rule.id\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"f8266242-342d-4046-8bb5-90efe4839a60\"},\"orderDirection\":\"desc\",\"otherBucket\":false,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"include\":[],\"exclude\":[],\"includeIsRegex\":false,\"excludeIsRegex\":false},\"customLabel\":true}},\"columnOrder\":[\"6dce6ade-b342-4645-9ff2-228f319d69f7\",\"8882fc10-f772-4a02-af1f-049b59a04dfd\",\"1835ff08-affb-403c-991e-8e642c7a5456\",\"06b78908-beb7-4a01-a9b0-b7f9775318d9\",\"ea992e31-8ea1-4548-8182-da51c911cf21\",\"a8c6efd9-93b3-4636-96ea-43b359962134\",\"f8266242-342d-4046-8bb5-90efe4839a60\"],\"incompleteColumns\":{},\"sampling\":1}}},\"textBased\":{\"layers\":{}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{},\"hidePanelTitles\":false},\"title\":\"Events\"}]","timeRestore":false,"title":"wazuh-amazon-aws-v1.0","version":1},"coreMigrationVersion":"8.6.2","created_at":"2023-04-24T18:35:30.916Z","id":"ff5626e0-a63f-11ed-8b0e-91d62e747cc9","migrationVersion":{"dashboard":"8.6.0"},"references":[{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"5177564c-7c79-4412-9c03-99dca92b90d5:indexpattern-datasource-layer-bca83102-e00c-4277-b280-a91ef087536e","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"692e518d-0688-414b-92e8-6b2bf1b960dd:indexpattern-datasource-layer-ecb05aff-bc9d-4ba1-b817-bf4016e0c5ef","type":"index-pattern"},{"id":"f410770f-a2da-47db-8a47-20b2ddbdcf5e","name":"25e0d536-4163-46e6-abd5-5cd45cd9f30a:indexpattern-datasource-layer-c23cdcb3-1e5c-46f0-9ef2-827d9b867cb2","type":"index-pattern"}],"type":"dashboard","updated_at":"2023-04-24T18:35:30.916Z","version":"WzM1OCwxXQ=="} -{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":8,"missingRefCount":0,"missingReferences":[]} \ No newline at end of file diff --git a/docs/markdown/agents/wazuh-agent-mangement.md b/docs/markdown/agents/wazuh-agent-mangement.md index bc912324..0be65f18 100644 --- a/docs/markdown/agents/wazuh-agent-mangement.md +++ b/docs/markdown/agents/wazuh-agent-mangement.md @@ -26,7 +26,7 @@ Output should look similar to this: "error": 0, "data": [ { - "WAZUH_VERSION": "v4.7.5" + "WAZUH_VERSION": "v4.9.1" }, { "WAZUH_REVISION": "40720" @@ -37,7 +37,7 @@ Output should look similar to this: ] } ``` -drop the v, and use `4.7.5` +drop the v, and use `4.9.1` ## Steps to Enroll a Wazuh Agent (***Windows***) @@ -50,10 +50,10 @@ drop the v, and use `4.7.5` - You can also use the below powershell command: ```powershell # Replace the values with the values you have above -# where {WAZUH_AGENT_VERSION}=4.7.5 +# where {WAZUH_AGENT_VERSION}=4.9.1 # where {WAZUH_MANAGER_IP}=10.1.0.5 -Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.7.5-1.msi -OutFile wazuh-agent-4.7.5-1.msi;` -Start-Process msiexec.exe -ArgumentList '/i wazuh-agent-4.7.5-1.msi /q WAZUH_MANAGER="10.1.0.5"' -Wait -NoNewWindow` +Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.1-1.msi -OutFile wazuh-agent-4.9.1-1.msi;` +Start-Process msiexec.exe -ArgumentList '/i wazuh-agent-4.9.1-1.msi /q WAZUH_MANAGER="10.1.0.5"' -Wait -NoNewWindow ``` 2. **Install the Wazuh Agent** diff --git a/quadlet/lme-elastalert.container b/quadlet/lme-elastalert.container index 98309f7f..1bedcb1f 100644 --- a/quadlet/lme-elastalert.container +++ b/quadlet/lme-elastalert.container @@ -24,6 +24,7 @@ Network=lme PodmanArgs=--network-alias lme-elastalert2 Volume=lme_elastalert2_logs:/opt/elastalert/logs Volume=/opt/lme/config/elastalert2/rules:/opt/elastalert/rules:ro +Volume=/opt/lme/config/elastalert2/misc:/opt/elastalert/misc:ro Volume=/opt/lme/config/elastalert2/config.yaml:/opt/elastalert/config.yaml:ro Volume=lme_certs:/etc/wazuh-manager/certs:ro Volume=/etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro diff --git a/quadlet/lme-fleet-server.container b/quadlet/lme-fleet-server.container index 320dc012..f2a16fb0 100644 --- a/quadlet/lme-fleet-server.container +++ b/quadlet/lme-fleet-server.container @@ -7,6 +7,7 @@ PartOf=lme.service [Service] Restart=always +TimeoutStartSec=5400 #30 minutes, helps ensure does not fail due to health check Environment=ANSIBLE_VAULT_PASSWORD_FILE=/etc/lme/pass.sh [Install] @@ -25,4 +26,6 @@ PublishPort=8220:8220 Volume=lme_certs:/certs:ro Volume=lme_fleet_data:/usr/share/elastic-agent UserNS=auto:uidmapping=0:171632:3048,gidmapping=0:171632:3048 -#TODO: add a healthcheck +#TODO: fix this, need to check if its ready before polling API +#HealthCmd=CMD-SHELL curl -s --cacert /certs/ca/ca.crt https://localhost:8220/api/status | grep '"status":"HEALTHY"' +#Notify=healthy diff --git a/quadlet/lme-kibana.container b/quadlet/lme-kibana.container index fe0e9c7b..a51cd176 100644 --- a/quadlet/lme-kibana.container +++ b/quadlet/lme-kibana.container @@ -10,7 +10,7 @@ WantedBy=default.target lme.service [Service] Restart=always -TimeoutStartSec=900 #5 minutes, kibana can be slow +TimeoutStartSec=5400 #30 minutes, helps ensure does not fail due to health check Environment=ANSIBLE_VAULT_PASSWORD_FILE=/etc/lme/pass.sh [Container] diff --git a/quadlet/lme-wazuh-manager.container b/quadlet/lme-wazuh-manager.container index 22671290..09110dd6 100644 --- a/quadlet/lme-wazuh-manager.container +++ b/quadlet/lme-wazuh-manager.container @@ -9,6 +9,7 @@ PartOf=lme.service Restart=always LimitNOFILE=655360 Environment=ANSIBLE_VAULT_PASSWORD_FILE=/etc/lme/pass.sh +TimeoutStartSec=5400 #30 minutes, helps ensure does not fail due to health check [Install] WantedBy=default.target lme.service diff --git a/scripts/check_fleet_api.sh b/scripts/check_fleet_api.sh index 80b41ed0..3fa52374 100755 --- a/scripts/check_fleet_api.sh +++ b/scripts/check_fleet_api.sh @@ -13,7 +13,7 @@ get_script_path() { SCRIPT_DIR="$(get_script_path)" HEADERS=( - -H "kbn-version: 8.12.2" + -H "kbn-version: 8.15.3" -H "kbn-xsrf: kibana" -H 'Content-Type: application/json' ) diff --git a/scripts/set-fleet.sh b/scripts/set-fleet.sh index d8be9438..9211eeaf 100755 --- a/scripts/set-fleet.sh +++ b/scripts/set-fleet.sh @@ -13,7 +13,7 @@ get_script_path() { SCRIPT_DIR="$(get_script_path)" HEADERS=( - -H "kbn-version: 8.12.2" + -H "kbn-version: 8.15.3" -H "kbn-xsrf: kibana" -H 'Content-Type: application/json' ) @@ -21,7 +21,7 @@ HEADERS=( # Function to check if Fleet API is ready check_fleet_ready() { local response - response=$(curl -k -s --user "elastic:${elastic}" \ + response=$(curl -kL -s --user "elastic:${elastic}" \ "${HEADERS[@]}" \ "${LOCAL_KBN_URL}/api/fleet/settings") @@ -51,17 +51,17 @@ wait_for_fleet() { set_fleet_values() { fingerprint=$(/nix/var/nix/profiles/default/bin/podman exec -w /usr/share/elasticsearch/config/certs/ca lme-elasticsearch cat ca.crt | openssl x509 -nout -fingerprint -sha256 | cut -d "=" -f 2| tr -d : | head -n1) - fleet_api_response=$(printf '{"fleet_server_hosts": ["%s"]}' "https://${IPVAR}:${FLEET_PORT}" | curl -k -v --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/settings" -d @-) + fleet_api_response=$(printf '{"fleet_server_hosts": ["%s"]}' "https://${IPVAR}:${FLEET_PORT}" | curl -kL -v --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/settings" -d @-) echo "Fleet API Response:" echo "$fleet_api_response" - printf '{"hosts": ["%s"]}' "https://${IPVAR}:9200" | curl -k --silent --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/outputs/fleet-default-output" -d @- | jq - printf '{"ca_trusted_fingerprint": "%s"}' "${fingerprint}" | curl -k --silent --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/outputs/fleet-default-output" -d @- | jq - printf '{"config_yaml": "%s"}' "ssl.verification_mode: certificate" | curl -k --silent --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/outputs/fleet-default-output" -d @- | jq + printf '{"hosts": ["%s"]}' "https://${IPVAR}:9200" | curl -kL --silent --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/outputs/fleet-default-output" -d @- | jq + printf '{"ca_trusted_fingerprint": "%s"}' "${fingerprint}" | curl -kL --silent --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/outputs/fleet-default-output" -d @- | jq + printf '{"config_yaml": "%s"}' "ssl.verification_mode: certificate" | curl -kL --silent --user "elastic:${elastic}" -XPUT "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/outputs/fleet-default-output" -d @- | jq policy_id=$(printf '{"name": "%s", "description": "%s", "namespace": "%s", "monitoring_enabled": ["logs","metrics"], "inactivity_timeout": 1209600}' "Endpoint Policy" "" "default" | curl -k --silent --user "elastic:${elastic}" -XPOST "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/agent_policies?sys_monitoring=true" -d @- | jq -r '.item.id') echo "Policy ID: ${policy_id}" - pkg_version=$(curl -k --user "elastic:${elastic}" -XGET "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/epm/packages/endpoint" -d : | jq -r '.item.version') + pkg_version=$(curl -kL --user "elastic:${elastic}" -XGET "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/epm/packages/endpoint" -d : | jq -r '.item.version') printf "{\"name\": \"%s\", \"description\": \"%s\", \"namespace\": \"%s\", \"policy_id\": \"%s\", \"enabled\": %s, \"inputs\": [{\"enabled\": true, \"streams\": [], \"type\": \"ENDPOINT_INTEGRATION_CONFIG\", \"config\": {\"_config\": {\"value\": {\"type\": \"endpoint\", \"endpointConfig\": {\"preset\": \"EDRComplete\"}}}}}], \"package\": {\"name\": \"endpoint\", \"title\": \"Elastic Defend\", \"version\": \"${pkg_version}\"}}" "Elastic Defend" "" "default" "${policy_id}" "true" | curl -k --silent --user "elastic:${elastic}" -XPOST "${HEADERS[@]}" "${LOCAL_KBN_URL}/api/fleet/package_policies" -d @- | jq } diff --git a/scripts/upgrade/import_1x.sh b/scripts/upgrade/import_1x.sh index f64ce44a..9aa9835e 100755 --- a/scripts/upgrade/import_1x.sh +++ b/scripts/upgrade/import_1x.sh @@ -30,7 +30,7 @@ set_credentials_from_file() { check_es_connection() { local response local http_code - response=$(curl -s -k -u "${ES_USER}:${ES_PASS}" -w "\n%{http_code}" "${ES_PROTOCOL}://${ES_HOST}:${ES_PORT}") + response=$(curl -s -kL -u "${ES_USER}:${ES_PASS}" -w "\n%{http_code}" "${ES_PROTOCOL}://${ES_HOST}:${ES_PORT}") http_code=$(echo "$response" | tail -n1) body=$(echo "$response" | sed '$d') @@ -58,7 +58,7 @@ increase_field_limit() { local new_limit="$2" echo "Increasing field limit for index ${index_name} to ${new_limit}..." - curl -X PUT -k -H 'Content-Type: application/json' \ + curl -X PUT -kL -H 'Content-Type: application/json' \ -u "${ES_USER}:${ES_PASS}" \ "${ES_PROTOCOL}://${ES_HOST}:${ES_PORT}/${index_name}/_settings" \ -d "{\"index.mapping.total_fields.limit\": ${new_limit}}" @@ -74,7 +74,7 @@ import_data_and_mappings() { # Create the index with increased field limit echo "Creating index ${import_index} with increased field limit..." - curl -X PUT -k -H 'Content-Type: application/json' \ + curl -X PUT -kL -H 'Content-Type: application/json' \ -u "${ES_USER}:${ES_PASS}" \ "${ES_PROTOCOL}://${ES_HOST}:${ES_PORT}/${import_index}" \ -d "{\"settings\": {\"index.mapping.total_fields.limit\": ${field_limit}}}" diff --git a/scripts/upgrade/import_dashboards.sh b/scripts/upgrade/import_dashboards.sh index 4e319e0a..73fa9d23 100755 --- a/scripts/upgrade/import_dashboards.sh +++ b/scripts/upgrade/import_dashboards.sh @@ -114,7 +114,7 @@ echo "Found ${#DASHBOARDS[@]} dashboard files." # Upload dashboards for db in "${DASHBOARDS[@]}"; do echo "Uploading ${db##*/} dashboard" - curl -X POST -k --user "${USER}:${PASSWORD}" -H 'kbn-xsrf: true' --form file="@${db}" "https://127.0.0.1/api/saved_objects/_import?overwrite=true" + curl -X POST -kL --user "${USER}:${PASSWORD}" -H 'kbn-xsrf: true' --form file="@${db}" "https://127.0.0.1/api/saved_objects/_import?overwrite=true" echo done diff --git a/testing/configure/linux_test_install.sh b/testing/configure/linux_test_install.sh index 3dda731d..25e2f99d 100755 --- a/testing/configure/linux_test_install.sh +++ b/testing/configure/linux_test_install.sh @@ -51,7 +51,7 @@ ELASTICSEARCH_HOST="localhost" ELASTICSEARCH_PORT="9200" # Get list of all indexes -indexes=$(curl -sk -u "elastic:$elastic" "https://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_cat/indices?v" | awk '{print $3}') +indexes=$(curl -skL -u "elastic:$elastic" "https://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/_cat/indices?v" | awk '{print $3}') # Check if winlogbeat index exists if echo "$indexes" | grep -q "winlogbeat"; then @@ -62,7 +62,7 @@ else fi # Check if we can query the winlogbeat index -response=$(curl -sk -u "elastic:$elastic" "https://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/winlogbeat-*/_search" -H "Content-Type: application/json" -d '{ +response=$(curl -skL -u "elastic:$elastic" "https://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}/winlogbeat-*/_search" -H "Content-Type: application/json" -d '{ "size": 1, "query": { "match_all": {} @@ -89,7 +89,7 @@ fi # echo $response -response=$(curl -sk -u "elastic:$elastic" "https://${ELASTICSEARCH_HOST}/api/kibana/management/saved_objects/_find?perPage=500&page=1&type=dashboard&sortField=updated_at&sortOrder=desc") +response=$(curl -skL -u "elastic:$elastic" "https://${ELASTICSEARCH_HOST}/api/kibana/management/saved_objects/_find?perPage=500&page=1&type=dashboard&sortField=updated_at&sortOrder=desc") #!/bin/bash diff --git a/testing/tests/api_tests/cluster/test_server.py b/testing/tests/api_tests/cluster/test_server.py index 42084c48..b513ee7f 100644 --- a/testing/tests/api_tests/cluster/test_server.py +++ b/testing/tests/api_tests/cluster/test_server.py @@ -46,11 +46,11 @@ def test_host_search(es_host, es_port, username, password): assert (data[rootKey]["total"]["value"] > 0) assert ".ds-metrics-system.cpu-default" in data[rootKey]["hits"][0]["_index"] assert (data[rootKey]["hits"][0]["_source"]["agent"]["name"] == "ubuntu-vm") - assert (data[rootKey]["hits"][0]["_source"]["agent"]["version"] == "8.12.2") + assert (data[rootKey]["hits"][0]["_source"]["agent"]["version"] == "8.15.3") assert (data[rootKey]["hits"][0]["_source"]["cloud"]["instance"]["name"] == "ubuntu") assert (data[rootKey]["hits"][0]["_source"]["data_stream"]["dataset"] == "system.cpu") assert (data[rootKey]["hits"][0]["_source"]["ecs"]["version"] == "8.0.0") - assert (data[rootKey]["hits"][0]["_source"]["elastic_agent"]["version"] == "8.12.2") + assert (data[rootKey]["hits"][0]["_source"]["elastic_agent"]["version"] == "8.15.3") assert (data[rootKey]["hits"][0]["_source"]["event"]["dataset"] == "system.cpu") assert (data[rootKey]["hits"][0]["_source"]["host"]["hostname"] == "ubuntu-vm") assert (data[rootKey]["hits"][0]["_source"]["metricset"]["name"] == "cpu") diff --git a/testing/tests/api_tests/linux_only/test_server.py b/testing/tests/api_tests/linux_only/test_server.py index a283d0ae..98eaf571 100644 --- a/testing/tests/api_tests/linux_only/test_server.py +++ b/testing/tests/api_tests/linux_only/test_server.py @@ -39,8 +39,8 @@ def test_elastic_root(es_host, es_port, username, password): body["cluster_name"] == "LME" ), f"Expected 'LME', got {body['cluster_name']}" assert ( - body["version"]["number"] == "8.12.2" - ), f"Expected '8.12.2', got {body['version']['number']}" + body["version"]["number"] == "8.15.3" + ), f"Expected '8.15.3', got {body['version']['number']}" assert ( body["version"]["build_flavor"] == "default" ), f"Expected 'default', got {body['version']['build_flavor']}" @@ -48,7 +48,7 @@ def test_elastic_root(es_host, es_port, username, password): body["version"]["build_type"] == "docker" ), f"Expected 'docker', got {body['version']['build_type']}" assert ( - body["version"]["lucene_version"] == "9.9.2" + body["version"]["lucene_version"] == "9.11.1" ), f"Expected '9.9.2', got {body['version']['lucene_version']}" assert ( body["version"]["minimum_wire_compatibility_version"] == "7.17.0" @@ -61,7 +61,7 @@ def test_elastic_root(es_host, es_port, username, password): schema = load_json_schema(f"{current_script_dir}/schemas/es_root.json") validate(instance=response.json(), schema=schema) - +@pytest.mark.skip(reason="These indices were changed in the new LME version") def test_elastic_indices(es_host, es_port, username, password): url = f"https://{es_host}:{es_port}/_cat/indices/" response = make_request(url, username, password) diff --git a/testing/v2/installers/install_v2/install.sh b/testing/v2/installers/install_v2/install.sh index 4a4a0742..4a5b5257 100755 --- a/testing/v2/installers/install_v2/install.sh +++ b/testing/v2/installers/install_v2/install.sh @@ -72,7 +72,7 @@ SUDO_EOF check_service() { local url=\$1 local auth=\$2 - curl -k -s -o /dev/null -w '%{http_code}' --insecure -u "\${auth}" "\${url}" | grep -q '200' + curl -kL -s -o /dev/null -w '%{http_code}' --insecure -u "\${auth}" "\${url}" | grep -q '200' } check_service "https://\${IPVAR}:9200" "elastic:\${elastic}" && \ check_service "\${LOCAL_KBN_URL}" "elastic:\${elastic}" diff --git a/testing/v2/installers/lib/check_agent_reporting.sh b/testing/v2/installers/lib/check_agent_reporting.sh index 369a3de2..6e206f1a 100755 --- a/testing/v2/installers/lib/check_agent_reporting.sh +++ b/testing/v2/installers/lib/check_agent_reporting.sh @@ -26,7 +26,7 @@ while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do fi # Run the curl command and capture the output - output=$(curl -k -s -X GET "https://localhost:9200/.ds-metrics-system.cpu-default-*/_search" \ + output=$(curl -kL -s -X GET "https://localhost:9200/.ds-metrics-system.cpu-default-*/_search" \ -H 'Content-Type: application/json' \ -H "kbn-xsrf: true" \ -u "elastic:$ES_PASSWORD" \ diff --git a/testing/v2/installers/lib/install_agent_linux.sh b/testing/v2/installers/lib/install_agent_linux.sh index 3a733d18..4825a2c5 100755 --- a/testing/v2/installers/lib/install_agent_linux.sh +++ b/testing/v2/installers/lib/install_agent_linux.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash # Default values -VERSION="8.12.2" +VERSION="8.15.3" ARCHITECTURE="linux-x86_64" IP="10.1.0.5" PORT="8220"