diff --git a/README.md b/README.md index 71c5e69..f73b4cd 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,7 @@ The following steps were taken to set up sof-elk from the sof-elk config repo * Copied `sof-elk/conffiles` to `sof-elk/conffiles` * Copied `sof-elk/grok-patterns` to `sof-elk/grok-patterns` * Copied `sof-elk/supporting-scripts` to `sof-elk/supporting-scrips` +* Copied `sof-elk/dashboards` to `sof-elk/dashboards` * Copied `lsplugins` from `sof-elk/supporting-scripts/ls_plugin_update.sh` to the plugin install command in the docker-compose.yaml for logstash * Added `logspout.conf` to `sof-elk/conffiles` for logspout * Changed all `sof-elk/conffiles/*output*` to contain this output line (for correct elasticsearch host) diff --git a/docker-compose.yaml b/docker-compose.yaml index 2be0da9..5eb3ac4 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -34,6 +34,15 @@ services: # - "traefik.enable=true" # - "traefik.port=9000" + # Startup to run scripts needed to set up sof-elk + starter: + image: vertoforce/sof-elk-starter + build: startup + volumes: + - ./sof-elk:/sof-elk + networks: + - master + # ELK elasticsearch: image: library/elasticsearch:6.5.0 diff --git a/sof-elk/dashboards/6d272a20-7319-11e8-9f32-cf7527ac183d.json b/sof-elk/dashboards/6d272a20-7319-11e8-9f32-cf7527ac183d.json new file mode 100644 index 0000000..743aef6 --- /dev/null +++ b/sof-elk/dashboards/6d272a20-7319-11e8-9f32-cf7527ac183d.json @@ -0,0 +1,209 @@ +{ + "version": "6.5.3", + "objects": [ + { + "id": "bdecdc70-731e-11e8-9f32-cf7527ac183d", + "type": "visualization", + "attributes": { + "title": "SOF-ELK® VM Intro", + "visState": "{\"title\":\"SOF-ELK® VM Intro\",\"type\":\"markdown\",\"params\":{\"fontSize\":11,\"openLinksInNewTab\":false,\"markdown\":\"## Welcome to the SOF-ELK® (Security Operations and Forensics Elasticsearch/Logstash/Kibana) distribution\\n\\nThis VMware image was created with a fully functional ELK configuration. The VM will ingest various log formats, and includes several dashboards to present the data in useful formats. While this version of the VM was created specifically for the SANS DFIR FOR572 class, it is maintained as community resource.\\n\\nSee the blocks at the bottom of this page to learn more about which types of data the VM is preconfigured to ingest and how to feed it.\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + } + }, + { + "id": "f8529370-3023-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "Syslog Count", + "visState": "{\"title\":\"Syslog Count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":36}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Syslog Records\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}" + } + } + }, + { + "id": "fc97bf70-2f2c-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "HTTPD Log Count", + "visState": "{\"title\":\"HTTPD Log Count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":36}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"HTTPD Records\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "b9aee980-746f-11e8-b583-8357aefbc6ed", + "type": "visualization", + "attributes": { + "title": "NetFlow Count", + "visState": "{\"title\":\"NetFlow Count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":36}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"NetFlow Records\"}}]}", + "uiStateJSON": "{}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"netflow\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "2ddd09e0-7470-11e8-b583-8357aefbc6ed", + "type": "visualization", + "attributes": { + "title": "Syslog Collected", + "visState": "{\"title\":\"Syslog Collected\",\"type\":\"table\",\"params\":{\"perPage\":7,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"path\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":7,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"logstash\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "820f2570-7470-11e8-b583-8357aefbc6ed", + "type": "visualization", + "attributes": { + "title": "HTTPD Logs Collected", + "visState": "{\"title\":\"HTTPD Logs Collected\",\"type\":\"table\",\"params\":{\"perPage\":7,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"path\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":7,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"httpdlog\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "28d920a0-7489-11e8-b583-8357aefbc6ed", + "type": "visualization", + "attributes": { + "title": "NetFlow Collected", + "visState": "{\"title\":\"NetFlow Collected\",\"type\":\"table\",\"params\":{\"perPage\":7,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Source\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"path\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":7,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Records\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"netflow\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "ea84ac10-7510-11e8-b583-8357aefbc6ed", + "type": "visualization", + "attributes": { + "title": "Syslog Intro", + "visState": "{\"title\":\"Syslog Intro\",\"type\":\"markdown\",\"params\":{\"fontSize\":10,\"openLinksInNewTab\":false,\"markdown\":\"Use the [Syslog Dashboard](#/dashboard/ac6e6490-3021-11e8-9faf-f77fbc81a50d) to explore this data\\n\\nSyslog data is loaded via the following methods:\\n* Files in the `/logstash/syslog/` directory.\\n * NOTE: Create e.g. `/logstash/syslog/2015/` for files that should be loaded as if they are from the year 2015.\\n* Network syslog messages sent to UDP or TCP port 5514\\n * NOTE: Open the firewall ports using the `fw_modify.sh` script. For example:\\n * `fw_modify.sh -a open -p 5514 -r udp`\\n * `fw_modify.sh -a open -p 5514 -r tcp`\\n * [filebeat](https://www.elastic.co/products/beats/filebeat) messages sent to TCP 5044\\n * NOTE: Open the firewall ports using the `fw_modify.sh` script. For example:\\n * `fw_modify.sh -a open -p 5044 -r tcp`\\n * Network RELP messages sent to TCP 5516\\n * NOTE: Open firewall ports using the `fw_modify.sh` script. For example:\\n * `fw_modify.sh -a open -p 5516 -r tcp`\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + } + }, + { + "id": "36c823e0-7511-11e8-b583-8357aefbc6ed", + "type": "visualization", + "attributes": { + "title": "NetFlow Intro", + "visState": "{\"title\":\"NetFlow Intro\",\"type\":\"markdown\",\"params\":{\"fontSize\":10,\"openLinksInNewTab\":false,\"markdown\":\"Use the [NetFlow Dashboard](#/dashboard/99d1b510-72b3-11e8-9159-894bd7d62352) to explore this data\\n\\nNetFlow data is loaded via the following methods:\\n* Files in the `/logstash/nfarch/` directory.\\n * NOTE: Files must be in CSV format, created with the supplied `nfdump2sof-elk.sh` script: `nfdump2sof-elk.sh [-e ] -r `\\n* NetFlow v5 network messages sent to UDP port 9995\\n * NOTE: Open the firewall ports using the `fw_modify.sh` script. For example:\\n * `fw_modify.sh -a open -p 9995 -r udp`\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + } + }, + { + "id": "57704730-7511-11e8-b583-8357aefbc6ed", + "type": "visualization", + "attributes": { + "title": "HTTPD Log Intro", + "visState": "{\"title\":\"HTTPD Log Intro\",\"type\":\"markdown\",\"params\":{\"fontSize\":10,\"openLinksInNewTab\":false,\"markdown\":\"Use the [HTTPD Log Dashboard](#/dashboard/ba531340-2f17-11e8-9faf-f77fbc81a50d) to explore this data\\n\\nHTTPD log data is loaded via the following methods:\\n* Files in the `/logstash/httpd/` directory\\n * NOTE: Logs in the Common, Combined, and Combined + VHost formats are currently supported\\n* Network syslog messages sent to UDP or TCP port 5515\\n * NOTE: Open the firewall ports using the `fw_modify.sh` script. For example:\\n * `fw_modify.sh -a open -p 5515 -r udp`\\n * `fw_modify.sh -a open -p 5515 -r tcp`\\n* Network RELP messages sent to TCP 5517\\n * NOTE: Open firewall ports using the `fw_modify.sh` script. For example:\\n * `fw_modify.sh -a open -p 5517 -r tcp`\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + } + }, + { + "id": "98309f20-8873-11e8-b4c2-17db52b8990d", + "type": "visualization", + "attributes": { + "title": "SOF-ELK®", + "visState": "{\"title\":\"SOF-ELK®\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"openLinksInNewTab\":false,\"markdown\":\"![SOF-ELK Logo](/plugins/kibana/assets/sof-elk.svg)\"},\"aggs\":[]}", + "uiStateJSON": "{}", + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } + } + }, + { + "id": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "type": "search", + "attributes": { + "title": "Syslog Discovery", + "description": "", + "hits": 0, + "columns": [ + "syslog_hostname", + "syslog_program", + "message" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"index\": \"logstash\",\n \"highlightAll\": true,\n \"version\": true,\n \"query\": {\n \"query\": \"\",\n \"language\": \"lucene\"\n },\n \"filter\": []\n}" + } + } + }, + { + "id": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "type": "search", + "attributes": { + "title": "HTTPD Discovery", + "description": "", + "hits": 0, + "columns": [ + "source_ip", + "request_method", + "hostname", + "request", + "response_code" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"httpdlog\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}" + } + } + }, + { + "id": "6d272a20-7319-11e8-9f32-cf7527ac183d", + "type": "dashboard", + "attributes": { + "title": "SOF-ELK® VM Introduction Dashboard", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"1\",\"gridData\":{\"x\":21,\"y\":0,\"w\":27,\"h\":11,\"i\":\"1\"},\"embeddableConfig\":{},\"id\":\"bdecdc70-731e-11e8-9f32-cf7527ac183d\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"2\",\"gridData\":{\"x\":0,\"y\":11,\"w\":16,\"h\":6,\"i\":\"2\"},\"embeddableConfig\":{},\"id\":\"f8529370-3023-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"3\",\"gridData\":{\"x\":32,\"y\":11,\"w\":16,\"h\":6,\"i\":\"3\"},\"embeddableConfig\":{},\"id\":\"fc97bf70-2f2c-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"4\",\"gridData\":{\"x\":16,\"y\":11,\"w\":16,\"h\":6,\"i\":\"4\"},\"embeddableConfig\":{},\"id\":\"b9aee980-746f-11e8-b583-8357aefbc6ed\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":0,\"y\":17,\"w\":16,\"h\":14,\"i\":\"5\"},\"embeddableConfig\":{},\"id\":\"2ddd09e0-7470-11e8-b583-8357aefbc6ed\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"7\",\"gridData\":{\"x\":32,\"y\":17,\"w\":16,\"h\":14,\"i\":\"7\"},\"embeddableConfig\":{},\"id\":\"820f2570-7470-11e8-b583-8357aefbc6ed\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"8\",\"gridData\":{\"x\":16,\"y\":17,\"w\":16,\"h\":14,\"i\":\"8\"},\"embeddableConfig\":{},\"id\":\"28d920a0-7489-11e8-b583-8357aefbc6ed\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"9\",\"gridData\":{\"x\":0,\"y\":31,\"w\":16,\"h\":15,\"i\":\"9\"},\"embeddableConfig\":{},\"id\":\"ea84ac10-7510-11e8-b583-8357aefbc6ed\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"10\",\"gridData\":{\"x\":16,\"y\":31,\"w\":16,\"h\":15,\"i\":\"10\"},\"embeddableConfig\":{},\"id\":\"36c823e0-7511-11e8-b583-8357aefbc6ed\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"11\",\"gridData\":{\"x\":32,\"y\":31,\"w\":16,\"h\":15,\"i\":\"11\"},\"embeddableConfig\":{},\"id\":\"57704730-7511-11e8-b583-8357aefbc6ed\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"12\",\"gridData\":{\"x\":0,\"y\":0,\"w\":21,\"h\":11,\"i\":\"12\"},\"embeddableConfig\":{},\"id\":\"98309f20-8873-11e8-b4c2-17db52b8990d\",\"type\":\"visualization\",\"version\":\"6.3.2\"}]", + "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}" + } + } + } + ] +} diff --git a/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75.json b/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75.json new file mode 100644 index 0000000..2803ee6 --- /dev/null +++ b/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75.json @@ -0,0 +1,198 @@ +{ + "version": "6.5.3", + "objects": [ + { + "id": "ce5fcc50-72b2-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Bytes by Protocol", + "visState": "{\"title\":\"NetFlow Bytes by Protocol\",\"type\":\"area\",\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Bytes\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"normal\",\"data\":{\"label\":\"Bytes\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"aprotocol.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Protocol\"}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "2b79dfc0-72b3-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Flows by Protocol", + "visState": "{\"title\":\"NetFlow Flows by Protocol\",\"type\":\"area\",\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Flows\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"normal\",\"data\":{\"label\":\"Flows\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records_vis\",\"customLabel\":\"Flows\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"aprotocol.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Protocol\"}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "652b9e70-72b3-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Packets by Protocol", + "visState": "{\"title\":\"NetFlow Packets by Protocol\",\"type\":\"area\",\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Packets\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"normal\",\"data\":{\"label\":\"Packets\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets_vis\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"aprotocol.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Protocol\"}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "type": "search", + "attributes": { + "title": "NetFlow Discovery", + "description": "", + "hits": 0, + "columns": [ + "exporter", + "aprotocol", + "source_ip", + "source_port", + "destination_ip", + "destination_port", + "total_bytes", + "total_packets" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"netflow\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}" + } + } + }, + { + "id": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "type": "search", + "attributes": { + "title": "Syslog Discovery", + "description": "", + "hits": 0, + "columns": [ + "syslog_hostname", + "syslog_program", + "message" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"index\": \"logstash\",\n \"highlightAll\": true,\n \"version\": true,\n \"query\": {\n \"query\": \"\",\n \"language\": \"lucene\"\n },\n \"filter\": []\n}" + } + } + }, + { + "id": "a7b68c60-3022-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "Event Timeline by Severity", + "visState": "{\"title\":\"Event Timeline by Severity\",\"type\":\"line\",\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"severity:[0 TO 2]\"},\"label\":\"Emerg/Alert/Crit\"},{\"input\":{\"query\":\"severity:[3 TO 4]\"},\"label\":\"Error/Warning\"},{\"input\":{\"query\":\"severity:[5 TO 6]\"},\"label\":\"Notice/Info\"},{\"input\":{\"query\":\"severity:7\"},\"label\":\"Debug\"},{\"input\":{\"query\":\"NOT(severity:[0 TO 7])\"},\"label\":\"Unknown\"}]}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "68935a70-d2ae-11e8-b129-a1f6f7111a75", + "type": "visualization", + "attributes": { + "title": "Source Map", + "visState": "{\"title\":\"Source Map\",\"type\":\"tile_map\",\"params\":{\"colorSchema\":\"Yellow to Red\",\"mapType\":\"Shaded Circle Markers\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":1.5,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.4.1&license=6447d0c7-8b7a-4cf7-ad0a-b56fd9164ba2\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.4.1&license=6447d0c7-8b7a-4cf7-ad0a-b56fd9164ba2\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"source_geo.location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"mapZoom\":2,\"mapCenter\":[0,0],\"precision\":2}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + } + }, + { + "id": "0f503070-d32e-11e8-b129-a1f6f7111a75", + "type": "visualization", + "attributes": { + "title": "Login Results", + "visState": "{\"title\":\"Login Results\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"login_result.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Login Result\"}}]}", + "uiStateJSON": "{\"vis\":{\"colors\":{\"Failed\":\"#E24D42\",\"Accepted\":\"#7EB26D\"},\"legendOpen\":false}}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + } + } + }, + { + "id": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "type": "search", + "attributes": { + "title": "HTTPD Discovery", + "description": "", + "hits": 0, + "columns": [ + "source_ip", + "request_method", + "hostname", + "request", + "response_code" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"httpdlog\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}" + } + } + }, + { + "id": "netflow", + "type": "index-pattern", + "attributes": { + "timeFieldName": "@timestamp", + "title": "netflow-*" + } + }, + { + "id": "logstash", + "type": "index-pattern", + "attributes": { + "timeFieldName": "@timestamp", + "title": "logstash-*" + } + }, + { + "id": "httpdlog", + "type": "index-pattern", + "attributes": { + "timeFieldName": "@timestamp", + "title": "httpdlog-*" + } + }, + { + "id": "8e8ec8e0-d27c-11e8-b129-a1f6f7111a75", + "type": "dashboard", + "attributes": { + "title": "Login Activity Dashboard", + "hits": 0, + "description": "", + "panelsJSON": "[{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":0,\"w\":16,\"h\":11,\"i\":\"1\"},\"id\":\"ce5fcc50-72b2-11e8-9159-894bd7d62352\",\"panelIndex\":\"1\",\"type\":\"visualization\",\"version\":\"6.4.1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":16,\"y\":0,\"w\":16,\"h\":11,\"i\":\"2\"},\"id\":\"2b79dfc0-72b3-11e8-9159-894bd7d62352\",\"panelIndex\":\"2\",\"type\":\"visualization\",\"version\":\"6.4.1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":32,\"y\":0,\"w\":16,\"h\":11,\"i\":\"3\"},\"id\":\"652b9e70-72b3-11e8-9159-894bd7d62352\",\"panelIndex\":\"3\",\"type\":\"visualization\",\"version\":\"6.4.1\"},{\"embeddableConfig\":{\"sort\":[\"@timestamp\",\"desc\"]},\"gridData\":{\"x\":0,\"y\":24,\"w\":48,\"h\":11,\"i\":\"4\"},\"id\":\"fa3332b0-72b0-11e8-9159-894bd7d62352\",\"panelIndex\":\"4\",\"type\":\"search\",\"version\":\"6.4.1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":35,\"w\":48,\"h\":11,\"i\":\"5\"},\"id\":\"e45686d0-3021-11e8-9faf-f77fbc81a50d\",\"panelIndex\":\"5\",\"type\":\"search\",\"version\":\"6.4.1\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":11,\"w\":16,\"h\":13,\"i\":\"6\"},\"id\":\"a7b68c60-3022-11e8-9faf-f77fbc81a50d\",\"panelIndex\":\"6\",\"type\":\"visualization\",\"version\":\"6.4.1\"},{\"embeddableConfig\":{\"mapCenter\":[36.59788913307022,21.796875000000004],\"mapZoom\":1},\"gridData\":{\"x\":26,\"y\":11,\"w\":22,\"h\":13,\"i\":\"7\"},\"id\":\"68935a70-d2ae-11e8-b129-a1f6f7111a75\",\"panelIndex\":\"7\",\"type\":\"visualization\",\"version\":\"6.4.1\"},{\"gridData\":{\"x\":16,\"y\":11,\"w\":10,\"h\":13,\"i\":\"8\"},\"version\":\"6.4.1\",\"panelIndex\":\"8\",\"type\":\"visualization\",\"id\":\"0f503070-d32e-11e8-b129-a1f6f7111a75\",\"embeddableConfig\":{}},{\"gridData\":{\"x\":0,\"y\":46,\"w\":48,\"h\":10,\"i\":\"9\"},\"version\":\"6.4.1\",\"panelIndex\":\"9\",\"type\":\"search\",\"id\":\"9744c560-2f17-11e8-9faf-f77fbc81a50d\",\"embeddableConfig\":{}}]", + "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":\"SSH Records (TCP/22, sshd)\",\"disabled\":true,\"index\":\"netflow\",\"key\":\"query\",\"negate\":false,\"type\":\"custom\",\"value\":\"{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"ports\\\":\\\"22\\\"}},{\\\"term\\\":{\\\"syslog_program\\\":\\\"sshd\\\"}}]}}\"},\"query\":{\"bool\":{\"should\":[{\"term\":{\"ports\":\"22\"}},{\"term\":{\"syslog_program\":\"sshd\"}}]}}},{\"query\":{\"bool\":{\"should\":[{\"term\":{\"ports\":\"80\"}},{\"term\":{\"ports\":\"443\"}},{\"term\":{\"syslog_program\":\"httpd\"}}]}},\"meta\":{\"index\":\"netflow\",\"disabled\":true,\"alias\":\"HTTP Records (TCP/80,443, httpd)\",\"type\":\"custom\",\"key\":\"query\",\"value\":\"{\\\"bool\\\":{\\\"should\\\":[{\\\"term\\\":{\\\"ports\\\":\\\"80\\\"}},{\\\"term\\\":{\\\"ports\\\":\\\"443\\\"}},{\\\"term\\\":{\\\"syslog_program\\\":\\\"httpd\\\"}}]}}\",\"negate\":false},\"$state\":{\"store\":\"appState\"}}]}" + } + } + } + ] +} diff --git a/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75_fieldFormatMap.txt b/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75_fieldFormatMap.txt new file mode 100644 index 0000000..c33b12c --- /dev/null +++ b/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75_fieldFormatMap.txt @@ -0,0 +1,156 @@ +{ + "in_bytes_vis": { + "id": "bytes", + "params": { + "pattern": "0,0.[0]b" + } + }, + "flow_records_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "in_packets_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "@timestamp": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "source_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "destination_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "out_bytes_vis": { + "id": "bytes", + "params": { + "pattern": "0,0.[0]b" + } + }, + "out_packets_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "missed_bytes_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "total_packets_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "total_bytes_vis": { + "id": "bytes", + "params": { + "pattern": "0,0.[0]b" + } + }, + "total_bytes": { + "id": "number" + }, + "total_packets": { + "id": "number" + }, + "first_switched": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "last_switched": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "ports": { + "id": "number", + "params": { + "pattern": "00" + } + } +} +{ + "destination_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "source_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "ports": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "@timestamp": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "source_geo.asnstr": { + "id": "string", + "params": { + "transform": "false" + } + } +} +{ + "source_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "destination_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "ports": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "@timestamp": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "source_geo.asnstr": { + "id": "string", + "params": { + "transform": "false" + } + } +} diff --git a/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75_fields.txt b/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75_fields.txt new file mode 100644 index 0000000..c7749c2 --- /dev/null +++ b/sof-elk/dashboards/8e8ec8e0-d27c-11e8-b129-a1f6f7111a75_fields.txt @@ -0,0 +1,328 @@ +{"name":"@timestamp","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"@version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"_id","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_index","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_source","type":"_source","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"agent","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agent.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.build","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.build.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.device","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.device.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.major","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.major.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.minor","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.minor.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os_major","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os_major.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os_minor","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os_minor.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.patch","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.patch.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_ip_v6","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_ip_v6.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"aprotocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"aprotocol.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"auth_reason","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"auth_reason.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.version.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"cachehits","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"cachehits.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"cookie","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"cookie.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"count","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_as","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.area_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asn.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asnstr","type":"string","count":0,"scripted":true,"script":"if ( !doc.containsKey('destination_geo.asn') || !doc.containsKey('destination_geo.as_org.keyword') ) { return 'ASN: Not Available' } else { return 'ASN' + doc['destination_geo.asn'].value + ': ' + doc['destination_geo.as_org.keyword'].value }","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"destination_geo.asnstr.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.number","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"destination_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_mac","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_mac.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_mask","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dhcp_hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_hwaddr","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dhcp_hwaddr.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_messagetype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dhcp_messagetype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dns_query","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dns_query.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dns_rectype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dns_rectype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"engine_id","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"engine_type","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"eth_type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"eth_type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_category","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_category.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_criticality","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_id","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_logsource","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_logsource.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_logtype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_logtype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_sidtype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_sidtype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_source","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_source.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"exporter","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"facility","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"fields","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"first_switched","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"flow_records","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"flow_records_vis","type":"number","count":0,"scripted":true,"script":"return doc['flow_records'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"host","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"host.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"host.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"host.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"http_tags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"http_tags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"httpversion","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ident","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"in_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"in_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['in_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"in_packets","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"in_packets_vis","type":"number","count":0,"scripted":true,"script":"return doc['in_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"info_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"info_phrase","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"info_phrase.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"input.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"input.type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"input_interface","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"input_interface.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"input_snmp","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ips","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"key_id","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"label","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"label.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"last_switched","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"login_method","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"login_method.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"login_result","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"login_result.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"logsource","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"logsource.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"message","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"message.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"missed_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"missed_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['missed_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"next_hop_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"offset","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"original_message","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"out_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"out_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"out_packets","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"out_packets_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"output_interface","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"output_interface.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"output_snmp","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_destusername","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_destusername.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_event","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_event.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_module","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_module.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_service","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_service.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_sessiontype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_sessiontype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_sourceuid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_sourceuid.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"password","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"path","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ports","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"prospector.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"protocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"protocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"protocol.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"proxied","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"proxied.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"proxy_cachestatus","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"proxy_hierarchystatus","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"query","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"query.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"query_string","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"query_string.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"querytype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"querytype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"rawrequest","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"rawrequest.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"received_at","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"referrer","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"referrer.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"relay_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"relay_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"relay_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"request","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"request.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"request_method","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"request_method.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"request_url","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"request_url.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"response_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"response_filename","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"response_filename.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_fuid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_mimetype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"response_mimetype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_phrase","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"response_phrase.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_sub","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"response_time","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"rrclass","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"rrclass.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"severity","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"snare_counter","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_as","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_filename","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_filename.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_fuid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asnstr","type":"string","count":0,"scripted":true,"script":"if ( !doc.containsKey('source_geo.asn') || !doc.containsKey('source_geo.as_org.keyword') ) { return 'ASN: Not Available' } else { return 'ASN' + doc['source_geo.asn'].value + ': ' + doc['source_geo.as_org.keyword'].value }","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_geo.asnstr.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_kex_methods","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_kex_methods.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_mac","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_mac.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_mask","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_mimetype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_mimetype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_tos","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssh_disconnect_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssh_disconnect_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssh_disconnect_statement","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssh_disconnect_statement.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssh_protocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssh_protocol.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssl_cipher","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssl_cipher.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"syslog_hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_pid","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_program","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"syslog_program.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_timestamp","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"tags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"tags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"tcp_aflags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"tcp_aflags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"total_bytes","type":"number","count":0,"scripted":true,"script":"return doc['out_bytes'].value + doc['in_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"total_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_bytes'].value + doc['in_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"total_packets","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value + doc['in_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"total_packets_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value + doc['in_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"trans_depth","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ttl","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"uid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"uptime","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"uptime.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"user","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"user.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"user_validity","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"user_validity.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"username","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"username.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"version","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} diff --git a/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352.json b/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352.json new file mode 100644 index 0000000..3a4f0c0 --- /dev/null +++ b/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352.json @@ -0,0 +1,236 @@ +{ + "version": "6.5.3", + "objects": [ + { + "id": "ce5fcc50-72b2-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Bytes by Protocol", + "visState": "{\"title\":\"NetFlow Bytes by Protocol\",\"type\":\"area\",\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Bytes\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"normal\",\"data\":{\"label\":\"Bytes\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"aprotocol.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Protocol\"}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "2b79dfc0-72b3-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Flows by Protocol", + "visState": "{\"title\":\"NetFlow Flows by Protocol\",\"type\":\"area\",\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Flows\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"normal\",\"data\":{\"label\":\"Flows\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records_vis\",\"customLabel\":\"Flows\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"aprotocol.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Protocol\"}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "652b9e70-72b3-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Packets by Protocol", + "visState": "{\"title\":\"NetFlow Packets by Protocol\",\"type\":\"area\",\"params\":{\"type\":\"area\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Packets\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"area\",\"mode\":\"normal\",\"data\":{\"label\":\"Packets\",\"id\":\"1\"},\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets_vis\",\"customLabel\":\"Packets\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"aprotocol.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Protocol\"}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "e94c3c00-72b3-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Statistics Summary", + "visState": "{\"title\":\"NetFlow Statistics Summary\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":40}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records_vis\",\"customLabel\":\"Flows\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets_vis\",\"customLabel\":\"Packets\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "9fda3e40-72b4-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Traffic Source", + "visState": "{\"title\":\"NetFlow Traffic Source\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":1.3,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.3.0&license=6447d0c7-8b7a-4cf7-ad0a-b56fd9164ba2\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.3.0&license=6447d0c7-8b7a-4cf7-ad0a-b56fd9164ba2\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"source_geo.location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "e6d33040-72b4-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Volume by Source Port", + "visState": "{\"title\":\"NetFlow Volume by Source Port\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"source_port\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "5a51a520-72b4-11e8-9159-894bd7d62352", + "type": "visualization", + "attributes": { + "title": "NetFlow Statistics by Destination IP", + "visState": "{\"title\":\"NetFlow Statistics by Destination IP\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Volume\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets\",\"customLabel\":\"Packets\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records\",\"customLabel\":\"Flows\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"destination_ip\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination IP\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "40667a60-7317-11e8-9f32-cf7527ac183d", + "type": "visualization", + "attributes": { + "title": "NetFlow Traffic Destination", + "visState": "{\"title\":\"NetFlow Traffic Destination\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Heatmap\",\"isDesaturated\":true,\"addTooltip\":true,\"heatClusterSize\":1.3,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[0,0],\"wms\":{\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"baseLayersAreLoaded\":{},\"tmsLayers\":[{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.3.0&license=6447d0c7-8b7a-4cf7-ad0a-b56fd9164ba2\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}],\"selectedTmsLayer\":{\"id\":\"road_map\",\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.3.0&license=6447d0c7-8b7a-4cf7-ad0a-b56fd9164ba2\",\"minZoom\":0,\"maxZoom\":18,\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"subdomains\":[]}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"destination_geo.location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "524b2aa0-7317-11e8-9f32-cf7527ac183d", + "type": "visualization", + "attributes": { + "title": "NetFlow Volume by Destination Port", + "visState": "{\"title\":\"NetFlow Volume by Destination Port\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Bytes\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"destination_port\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination Port\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "2f25d250-7317-11e8-9f32-cf7527ac183d", + "type": "visualization", + "attributes": { + "title": "NetFlow Statistics by Source IP", + "visState": "{\"title\":\"NetFlow Statistics by Source IP\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Volume\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets\",\"customLabel\":\"Packets\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records\",\"customLabel\":\"Flows\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"source_ip\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source IP\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "1a339e80-7318-11e8-9f32-cf7527ac183d", + "type": "visualization", + "attributes": { + "title": "NetFlow Statistics by Exporter", + "visState": "{\"title\":\"NetFlow Statistics by Exporter\",\"type\":\"table\",\"params\":{\"perPage\":7,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Volume\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets\",\"customLabel\":\"Packets\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records\",\"customLabel\":\"Flows\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"exporter\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":7,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Exporter\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "57a87fb0-7318-11e8-9f32-cf7527ac183d", + "type": "visualization", + "attributes": { + "title": "NetFlow Statistics by Source AS", + "visState": "{\"title\":\"NetFlow Statistics by Source AS\",\"type\":\"table\",\"params\":{\"perPage\":7,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Volume\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets\",\"customLabel\":\"Packets\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records\",\"customLabel\":\"Flows\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"source_geo.asnstr\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":7,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source AS\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "689e8a30-7318-11e8-9f32-cf7527ac183d", + "type": "visualization", + "attributes": { + "title": "NetFlow Statistics by Destination AS", + "visState": "{\"title\":\"NetFlow Statistics by Destination AS\",\"type\":\"table\",\"params\":{\"perPage\":7,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_bytes_vis\",\"customLabel\":\"Volume\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"total_packets\",\"customLabel\":\"Packets\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"sum\",\"schema\":\"metric\",\"params\":{\"field\":\"flow_records\",\"customLabel\":\"Flows\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"destination_geo.asnstr\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":7,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination AS\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "savedSearchId": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "fa3332b0-72b0-11e8-9159-894bd7d62352", + "type": "search", + "attributes": { + "title": "NetFlow Discovery", + "description": "", + "hits": 0, + "columns": [ + "exporter", + "aprotocol", + "source_ip", + "source_port", + "destination_ip", + "destination_port", + "total_bytes", + "total_packets" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"netflow\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}" + } + } + }, + { + "id": "netflow", + "type": "index-pattern", + "attributes": { + "timeFieldName": "@timestamp", + "title": "netflow-*" + } + }, + { + "id": "99d1b510-72b3-11e8-9159-894bd7d62352", + "type": "dashboard", + "attributes": { + "title": "NetFlow Dashboard", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"1\",\"gridData\":{\"x\":0,\"y\":0,\"w\":14,\"h\":14,\"i\":\"1\"},\"embeddableConfig\":{},\"id\":\"ce5fcc50-72b2-11e8-9159-894bd7d62352\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"2\",\"gridData\":{\"x\":14,\"y\":0,\"w\":17,\"h\":14,\"i\":\"2\"},\"embeddableConfig\":{},\"id\":\"2b79dfc0-72b3-11e8-9159-894bd7d62352\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"3\",\"gridData\":{\"x\":31,\"y\":0,\"w\":17,\"h\":14,\"i\":\"3\"},\"embeddableConfig\":{},\"id\":\"652b9e70-72b3-11e8-9159-894bd7d62352\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":0,\"y\":14,\"w\":48,\"h\":7,\"i\":\"5\"},\"embeddableConfig\":{},\"id\":\"e94c3c00-72b3-11e8-9159-894bd7d62352\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"7\",\"gridData\":{\"x\":14,\"y\":21,\"w\":19,\"h\":18,\"i\":\"7\"},\"embeddableConfig\":{\"mapCenter\":[41.50857729743935,66.09375000000001],\"mapZoom\":1},\"id\":\"9fda3e40-72b4-11e8-9159-894bd7d62352\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"8\",\"gridData\":{\"x\":33,\"y\":21,\"w\":15,\"h\":18,\"i\":\"8\"},\"embeddableConfig\":{},\"id\":\"e6d33040-72b4-11e8-9159-894bd7d62352\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"9\",\"gridData\":{\"x\":0,\"y\":39,\"w\":14,\"h\":18,\"i\":\"9\"},\"embeddableConfig\":{},\"id\":\"5a51a520-72b4-11e8-9159-894bd7d62352\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"10\",\"gridData\":{\"x\":14,\"y\":39,\"w\":19,\"h\":18,\"i\":\"10\"},\"embeddableConfig\":{\"mapCenter\":[14.944784875088372,-42.5390625],\"mapZoom\":2},\"id\":\"40667a60-7317-11e8-9f32-cf7527ac183d\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"11\",\"gridData\":{\"x\":33,\"y\":39,\"w\":15,\"h\":18,\"i\":\"11\"},\"embeddableConfig\":{},\"id\":\"524b2aa0-7317-11e8-9f32-cf7527ac183d\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"12\",\"gridData\":{\"x\":0,\"y\":21,\"w\":14,\"h\":18,\"i\":\"12\"},\"embeddableConfig\":{},\"id\":\"2f25d250-7317-11e8-9f32-cf7527ac183d\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"panelIndex\":\"13\",\"gridData\":{\"x\":0,\"y\":57,\"w\":10,\"h\":15,\"i\":\"13\"},\"version\":\"6.3.0\",\"type\":\"visualization\",\"id\":\"1a339e80-7318-11e8-9f32-cf7527ac183d\",\"embeddableConfig\":{}},{\"panelIndex\":\"14\",\"gridData\":{\"x\":10,\"y\":57,\"w\":19,\"h\":15,\"i\":\"14\"},\"version\":\"6.3.0\",\"type\":\"visualization\",\"id\":\"57a87fb0-7318-11e8-9f32-cf7527ac183d\",\"embeddableConfig\":{}},{\"panelIndex\":\"15\",\"gridData\":{\"x\":29,\"y\":57,\"w\":19,\"h\":15,\"i\":\"15\"},\"version\":\"6.3.0\",\"type\":\"visualization\",\"id\":\"689e8a30-7318-11e8-9f32-cf7527ac183d\",\"embeddableConfig\":{}},{\"panelIndex\":\"16\",\"gridData\":{\"x\":0,\"y\":72,\"w\":48,\"h\":53,\"i\":\"16\"},\"version\":\"6.3.0\",\"type\":\"search\",\"id\":\"fa3332b0-72b0-11e8-9159-894bd7d62352\",\"embeddableConfig\":{}}]", + "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}" + } + } + } + ] +} diff --git a/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352_fieldFormatMap.txt b/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352_fieldFormatMap.txt new file mode 100644 index 0000000..a148edf --- /dev/null +++ b/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352_fieldFormatMap.txt @@ -0,0 +1,104 @@ +{ + "in_bytes_vis": { + "id": "bytes", + "params": { + "pattern": "0,0.[0]b" + } + }, + "flow_records_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "in_packets_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "@timestamp": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "source_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "destination_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "out_bytes_vis": { + "id": "bytes", + "params": { + "pattern": "0,0.[0]b" + } + }, + "out_packets_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "missed_bytes_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "total_packets_vis": { + "id": "number", + "params": { + "pattern": "0,0.[0]a" + } + }, + "total_bytes_vis": { + "id": "bytes", + "params": { + "pattern": "0,0.[0]b" + } + }, + "total_bytes": { + "id": "number" + }, + "total_packets": { + "id": "number" + }, + "first_switched": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "last_switched": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "ports": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "destination_geo.asnstr": { + "id": "string", + "params": { + "transform": "false" + } + }, + "source_geo.asnstr": { + "id": "string", + "params": { + "transform": "false" + } + } +} diff --git a/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352_fields.txt b/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352_fields.txt new file mode 100644 index 0000000..864f1a3 --- /dev/null +++ b/sof-elk/dashboards/99d1b510-72b3-11e8-9159-894bd7d62352_fields.txt @@ -0,0 +1,121 @@ +{"name":"@timestamp","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"@version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"_id","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_index","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_source","type":"_source","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"aprotocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"aprotocol.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.version.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_as","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asnstr","type":"string","count":0,"scripted":true,"script":"if ( !doc.containsKey('destination_geo.asn') || !doc.containsKey('destination_geo.as_org.keyword') ) { return 'ASN: Not Available' } else { return 'ASN' + doc['destination_geo.asn'].value + ': ' + doc['destination_geo.as_org.keyword'].value }","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"destination_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_mask","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"engine_id","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"engine_type","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"exporter","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"first_switched","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"flow_records","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"flow_records_vis","type":"number","count":0,"scripted":true,"script":"return doc['flow_records'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"host.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"host.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"in_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"in_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['in_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"in_packets","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"in_packets_vis","type":"number","count":0,"scripted":true,"script":"return doc['in_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"input.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"input.type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"input_snmp","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ips","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"last_switched","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"missed_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"missed_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['missed_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"next_hop_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"offset","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"original_message","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"out_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"out_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"out_packets","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"out_packets_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"output_snmp","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"path","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ports","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"prospector.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"protocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"protocol.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_as","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asnstr","type":"string","count":0,"scripted":true,"script":"if ( !doc.containsKey('source_geo.asn') || !doc.containsKey('source_geo.as_org.keyword') ) { return 'ASN: Not Available' } else { return 'ASN' + doc['source_geo.asn'].value + ': ' + doc['source_geo.as_org.keyword'].value }","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_mask","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_tos","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"tags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"tags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"tcp_aflags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"tcp_aflags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"total_bytes","type":"number","count":0,"scripted":true,"script":"return doc['out_bytes'].value + doc['in_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"total_bytes_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_bytes'].value + doc['in_bytes'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"total_packets","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value + doc['in_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"total_packets_vis","type":"number","count":0,"scripted":true,"script":"return doc['out_packets'].value + doc['in_packets'].value","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"version","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} diff --git a/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d.json b/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d.json new file mode 100644 index 0000000..9f44588 --- /dev/null +++ b/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d.json @@ -0,0 +1,105 @@ +{ + "version": "6.5.3", + "objects": [ + { + "id": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "type": "search", + "attributes": { + "title": "Syslog Discovery", + "description": "", + "hits": 0, + "columns": [ + "syslog_hostname", + "syslog_program", + "message" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"index\": \"logstash\",\n \"highlightAll\": true,\n \"version\": true,\n \"query\": {\n \"query\": \"\",\n \"language\": \"lucene\"\n },\n \"filter\": []\n}" + } + } + }, + { + "id": "a7b68c60-3022-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "Event Timeline by Severity", + "visState": "{\"title\":\"Event Timeline by Severity\",\"type\":\"line\",\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"log\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"severity:[0 TO 2]\"},\"label\":\"Emerg/Alert/Crit\"},{\"input\":{\"query\":\"severity:[3 TO 4]\"},\"label\":\"Error/Warning\"},{\"input\":{\"query\":\"severity:[5 TO 6]\"},\"label\":\"Notice/Info\"},{\"input\":{\"query\":\"severity:7\"},\"label\":\"Debug\"},{\"input\":{\"query\":\"NOT(severity:[0 TO 7])\"},\"label\":\"Unknown\"}]}}]}", + "uiStateJSON": "{\"vis\":{\"legendOpen\":false}}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "33820360-3022-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "Syslog Source Host", + "visState": "{\"title\":\"Syslog Source Host\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"syslog_hostname.keyword\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Hostname\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "20daa9f0-3023-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "Syslog Program", + "visState": "{\"title\":\"Syslog Program\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"syslog_program.keyword\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Program\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "f8529370-3023-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "Syslog Count", + "visState": "{\"title\":\"Syslog Count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":36}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Syslog Records\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "e45686d0-3021-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}" + } + } + }, + { + "id": "logstash", + "type": "index-pattern", + "attributes": { + "timeFieldName": "@timestamp", + "title": "logstash-*" + } + }, + { + "id": "ac6e6490-3021-11e8-9faf-f77fbc81a50d", + "type": "dashboard", + "attributes": { + "title": "Syslog Dashboard", + "hits": 0, + "description": "", + "panelsJSON": "[{\"gridData\":{\"h\":35,\"i\":\"2\",\"w\":48,\"x\":0,\"y\":40},\"id\":\"e45686d0-3021-11e8-9faf-f77fbc81a50d\",\"panelIndex\":\"2\",\"type\":\"search\",\"version\":\"6.3.0\"},{\"gridData\":{\"h\":25,\"i\":\"3\",\"w\":48,\"x\":0,\"y\":0},\"id\":\"a7b68c60-3022-11e8-9faf-f77fbc81a50d\",\"panelIndex\":\"3\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"gridData\":{\"h\":15,\"i\":\"4\",\"w\":16,\"x\":0,\"y\":25},\"id\":\"33820360-3022-11e8-9faf-f77fbc81a50d\",\"panelIndex\":\"4\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"gridData\":{\"h\":15,\"i\":\"5\",\"w\":16,\"x\":16,\"y\":25},\"id\":\"20daa9f0-3023-11e8-9faf-f77fbc81a50d\",\"panelIndex\":\"5\",\"type\":\"visualization\",\"version\":\"6.3.0\"},{\"gridData\":{\"h\":6,\"i\":\"6\",\"w\":16,\"x\":32,\"y\":25},\"id\":\"f8529370-3023-11e8-9faf-f77fbc81a50d\",\"panelIndex\":\"6\",\"type\":\"visualization\",\"version\":\"6.3.0\"}]", + "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}" + } + } + } + ] +} diff --git a/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d_fieldFormatMap.txt b/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d_fieldFormatMap.txt new file mode 100644 index 0000000..8941775 --- /dev/null +++ b/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d_fieldFormatMap.txt @@ -0,0 +1,32 @@ +{ + "destination_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "source_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "ports": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "@timestamp": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "source_geo.asnstr": { + "id": "string", + "params": { + "transform": "false" + } + } +} diff --git a/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d_fields.txt b/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d_fields.txt new file mode 100644 index 0000000..8322148 --- /dev/null +++ b/sof-elk/dashboards/ac6e6490-3021-11e8-9faf-f77fbc81a50d_fields.txt @@ -0,0 +1,223 @@ +{"name":"@timestamp","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"@version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"_id","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_index","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_source","type":"_source","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"answer","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"answer_ip_v6","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"answer_ip_v6.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"auth_reason","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"auth_reason.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.version.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"cachehits","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"cachehits.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"cookie","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"cookie.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.area_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asnstr","type":"string","count":0,"scripted":true,"script":"if ( !doc.containsKey('destination_geo.asn') || !doc.containsKey('destination_geo.as_org.keyword') ) { return 'ASN: Not Available' } else { return 'ASN' + doc['destination_geo.asn'].value + ': ' + doc['destination_geo.as_org.keyword'].value }","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"destination_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.number","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"destination_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_mac","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_mac.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dhcp_hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_hwaddr","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dhcp_hwaddr.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dhcp_messagetype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dhcp_messagetype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dns_query","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dns_query.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"dns_rectype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"dns_rectype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"eth_type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"eth_type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_category","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_category.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_criticality","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_id","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_logsource","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_logsource.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_logtype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_logtype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_sidtype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_sidtype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"event_source","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"event_source.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"facility","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"host.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"host.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"input.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"input.type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"input_interface","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"input_interface.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ips","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"key_id","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"label","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"label.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"login_method","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"login_method.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"login_result","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"login_result.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"logsource","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"logsource.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"message","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"message.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"offset","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"original_message","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"output_interface","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"output_interface.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_destusername","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_destusername.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_event","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_event.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_module","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_module.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_service","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_service.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_sessiontype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_sessiontype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"pam_sourceuid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"pam_sourceuid.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"path","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ports","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"prospector.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"prospector.type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"protocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"protocol.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"query","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"query.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"querytype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"querytype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"received_at","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"relay_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"relay_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"relay_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"request_method","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"request_method.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"rrclass","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"rrclass.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"severity","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"snare_counter","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asnstr","type":"string","count":0,"scripted":true,"script":"if ( !doc.containsKey('source_geo.asn') || !doc.containsKey('source_geo.as_org.keyword') ) { return 'ASN: Not Available' } else { return 'ASN' + doc['source_geo.asn'].value + ': ' + doc['source_geo.as_org.keyword'].value }","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_kex_methods","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_kex_methods.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_mac","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_mac.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssh_disconnect_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssh_disconnect_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssh_disconnect_statement","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssh_disconnect_statement.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssh_protocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssh_protocol.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"syslog_hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_pid","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_program","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"syslog_program.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_timestamp","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"syslog_timestamp.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"tags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"tags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ttl","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"uptime","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"uptime.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"user","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"user.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"user_validity","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"user_validity.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"username","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"username.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} diff --git a/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d.json b/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d.json new file mode 100644 index 0000000..e0a11b7 --- /dev/null +++ b/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d.json @@ -0,0 +1,149 @@ +{ + "version": "6.5.3", + "objects": [ + { + "id": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "type": "search", + "attributes": { + "title": "HTTPD Discovery", + "description": "", + "hits": 0, + "columns": [ + "source_ip", + "request_method", + "hostname", + "request", + "response_code" + ], + "sort": [ + "@timestamp", + "desc" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"httpdlog\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}" + } + } + }, + { + "id": "27462ba0-2f1c-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "HTTPD Timeline", + "visState": "{\n \"aggs\": [\n {\n \"enabled\": true,\n \"id\": \"1\",\n \"params\": {\n \"customLabel\": \"Records\"\n },\n \"schema\": \"metric\",\n \"type\": \"count\"\n },\n {\n \"enabled\": true,\n \"id\": \"2\",\n \"params\": {\n \"customInterval\": \"2h\",\n \"extended_bounds\": {},\n \"field\": \"@timestamp\",\n \"interval\": \"auto\",\n \"min_doc_count\": 1\n },\n \"schema\": \"segment\",\n \"type\": \"date_histogram\"\n },\n {\n \"enabled\": true,\n \"id\": \"3\",\n \"params\": {\n \"field\": \"request_method\",\n \"missingBucket\": false,\n \"missingBucketLabel\": \"Missing\",\n \"order\": \"desc\",\n \"orderBy\": \"1\",\n \"otherBucket\": false,\n \"otherBucketLabel\": \"Other\",\n \"size\": 5\n },\n \"schema\": \"group\",\n \"type\": \"terms\"\n }\n ],\n \"params\": {\n \"addLegend\": true,\n \"addTimeMarker\": false,\n \"addTooltip\": true,\n \"categoryAxes\": [\n {\n \"id\": \"CategoryAxis-1\",\n \"labels\": {\n \"filter\": false,\n \"rotate\": 0,\n \"show\": true,\n \"truncate\": 100\n },\n \"position\": \"bottom\",\n \"scale\": {\n \"type\": \"linear\"\n },\n \"show\": true,\n \"style\": {},\n \"title\": {},\n \"type\": \"category\"\n }\n ],\n \"grid\": {\n \"categoryLines\": false,\n \"style\": {\n \"color\": \"#eee\"\n }\n },\n \"legendPosition\": \"right\",\n \"seriesParams\": [\n {\n \"data\": {\n \"id\": \"1\",\n \"label\": \"Records\"\n },\n \"drawLinesBetweenPoints\": true,\n \"interpolate\": \"linear\",\n \"mode\": \"normal\",\n \"show\": \"true\",\n \"showCircles\": true,\n \"type\": \"line\",\n \"valueAxis\": \"ValueAxis-1\"\n }\n ],\n \"times\": [],\n \"type\": \"line\",\n \"valueAxes\": [\n {\n \"id\": \"ValueAxis-1\",\n \"labels\": {\n \"filter\": false,\n \"rotate\": 0,\n \"show\": true,\n \"truncate\": 100\n },\n \"name\": \"LeftAxis-1\",\n \"position\": \"left\",\n \"scale\": {\n \"mode\": \"normal\",\n \"type\": \"log\"\n },\n \"show\": true,\n \"style\": {},\n \"title\": {\n \"text\": \"Records\"\n },\n \"type\": \"value\"\n }\n ]\n },\n \"title\": \"HTTPD Timeline\",\n \"type\": \"line\"\n}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"filter\": [],\n \"query\": {\n \"language\": \"lucene\",\n \"query\": \"\"\n }\n}" + } + } + }, + { + "id": "fc97bf70-2f2c-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "HTTPD Log Count", + "visState": "{\"title\":\"HTTPD Log Count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":36}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"HTTPD Records\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "617743c0-2f2d-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "HTTPD Response Code Timeline", + "visState": "{\n \"title\": \"HTTPD Response Code Timeline\",\n \"type\": \"line\",\n \"params\": {\n \"type\": \"line\",\n \"grid\": {\n \"categoryLines\": false,\n \"style\": {\n \"color\": \"#eee\"\n }\n },\n \"categoryAxes\": [\n {\n \"id\": \"CategoryAxis-1\",\n \"type\": \"category\",\n \"position\": \"bottom\",\n \"show\": true,\n \"style\": {},\n \"scale\": {\n \"type\": \"linear\"\n },\n \"labels\": {\n \"show\": true,\n \"truncate\": 100\n },\n \"title\": {}\n }\n ],\n \"valueAxes\": [\n {\n \"id\": \"ValueAxis-1\",\n \"name\": \"LeftAxis-1\",\n \"type\": \"value\",\n \"position\": \"left\",\n \"show\": true,\n \"style\": {},\n \"scale\": {\n \"type\": \"log\",\n \"mode\": \"normal\"\n },\n \"labels\": {\n \"show\": true,\n \"rotate\": 0,\n \"filter\": false,\n \"truncate\": 100\n },\n \"title\": {\n \"text\": \"Records\"\n }\n }\n ],\n \"seriesParams\": [\n {\n \"show\": \"true\",\n \"type\": \"line\",\n \"mode\": \"normal\",\n \"data\": {\n \"label\": \"Records\",\n \"id\": \"1\"\n },\n \"valueAxis\": \"ValueAxis-1\",\n \"drawLinesBetweenPoints\": true,\n \"showCircles\": true\n }\n ],\n \"addTooltip\": true,\n \"addLegend\": true,\n \"legendPosition\": \"right\",\n \"times\": [],\n \"addTimeMarker\": false\n },\n \"aggs\": [\n {\n \"id\": \"1\",\n \"enabled\": true,\n \"type\": \"count\",\n \"schema\": \"metric\",\n \"params\": {\n \"customLabel\": \"Records\"\n }\n },\n {\n \"id\": \"2\",\n \"enabled\": true,\n \"type\": \"date_histogram\",\n \"schema\": \"segment\",\n \"params\": {\n \"field\": \"@timestamp\",\n \"interval\": \"auto\",\n \"customInterval\": \"2h\",\n \"min_doc_count\": 1,\n \"extended_bounds\": {}\n }\n },\n {\n \"id\": \"3\",\n \"enabled\": true,\n \"type\": \"terms\",\n \"schema\": \"group\",\n \"params\": {\n \"field\": \"response_code\",\n \"otherBucket\": false,\n \"otherBucketLabel\": \"Other\",\n \"missingBucket\": false,\n \"missingBucketLabel\": \"Missing\",\n \"size\": 5,\n \"order\": \"desc\",\n \"orderBy\": \"1\"\n }\n }\n ]\n}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"filter\": [],\n \"query\": {\n \"query\": \"\",\n \"language\": \"lucene\"\n }\n}" + } + } + }, + { + "id": "ab7426f0-2f2d-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "HTTPD Source ASNs", + "visState": "{\"title\":\"HTTPD Source ASNs\",\"type\":\"table\",\"params\":{\"perPage\":12,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"source_geo.asnstr\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":12,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source ASN\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}" + } + } + }, + { + "id": "970ab5b0-2f2f-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "Vhost Pie Graph", + "visState": "{\"title\":\"Vhost Pie Graph\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"hostname.keyword\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"VirtualHost Name\"}}]}", + "uiStateJSON": "{}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" + } + } + }, + { + "id": "1554e120-2f30-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "HTTP User Agents", + "visState": "{\"title\":\"HTTP User Agents\",\"type\":\"table\",\"params\":{\"perPage\":7,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Records\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"agent.keyword\",\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":20,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"HTTP User Agent\"}}]}", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}" + } + } + }, + { + "id": "fcc684b0-2f39-11e8-9faf-f77fbc81a50d", + "type": "visualization", + "attributes": { + "title": "HTTPD Access Source", + "visState": "{\"title\":\"HTTPD Access Source\",\"type\":\"tile_map\",\"params\":{\"addTooltip\":true,\"heatClusterSize\":1.3,\"isDesaturated\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[0,0],\"mapType\":\"Heatmap\",\"mapZoom\":2,\"wms\":{\"baseLayersAreLoaded\":{},\"enabled\":false,\"options\":{\"format\":\"image/png\",\"transparent\":true},\"selectedTmsLayer\":{\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"id\":\"road_map\",\"maxZoom\":10,\"minZoom\":0,\"subdomains\":[],\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.3\"},\"tmsLayers\":[{\"attribution\":\"

© OpenStreetMap contributors | Elastic Maps Service

\",\"id\":\"road_map\",\"maxZoom\":10,\"minZoom\":0,\"subdomains\":[],\"url\":\"https://tiles.maps.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana&my_app_version=6.2.3\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"source_geo.location\",\"autoPrecision\":true,\"isFilteredByCollar\":true,\"useGeocentroid\":true,\"precision\":2}}]}", + "uiStateJSON": "{\"mapCenter\":[16.947354170252698,-6.432500062510371],\"mapZoom\":2}", + "description": "", + "savedSearchId": "9744c560-2f17-11e8-9faf-f77fbc81a50d", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}" + } + } + }, + { + "id": "httpdlog", + "type": "index-pattern", + "attributes": { + "timeFieldName": "@timestamp", + "title": "httpdlog-*" + } + }, + { + "id": "ba531340-2f17-11e8-9faf-f77fbc81a50d", + "type": "dashboard", + "attributes": { + "title": "HTTPD Log Dashboard", + "hits": 0, + "description": "", + "panelsJSON": "[{\"panelIndex\":\"1\",\"gridData\":{\"x\":0,\"y\":12,\"w\":12,\"h\":5,\"i\":\"1\"},\"id\":\"9744c560-2f17-11e8-9faf-f77fbc81a50d\",\"type\":\"search\",\"version\":\"6.2.3\"},{\"panelIndex\":\"2\",\"gridData\":{\"x\":0,\"y\":0,\"w\":9,\"h\":4,\"i\":\"2\"},\"id\":\"27462ba0-2f1c-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"3\",\"gridData\":{\"x\":9,\"y\":0,\"w\":3,\"h\":2,\"i\":\"3\"},\"id\":\"fc97bf70-2f2c-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"4\",\"gridData\":{\"x\":0,\"y\":4,\"w\":9,\"h\":4,\"i\":\"4\"},\"id\":\"617743c0-2f2d-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":9,\"y\":2,\"w\":3,\"h\":6,\"i\":\"5\"},\"id\":\"ab7426f0-2f2d-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"6\",\"gridData\":{\"x\":0,\"y\":8,\"w\":4,\"h\":4,\"i\":\"6\"},\"id\":\"970ab5b0-2f2f-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"7\",\"gridData\":{\"x\":9,\"y\":8,\"w\":3,\"h\":4,\"i\":\"7\"},\"id\":\"1554e120-2f30-11e8-9faf-f77fbc81a50d\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"8\",\"gridData\":{\"x\":4,\"y\":8,\"w\":5,\"h\":4,\"i\":\"8\"},\"version\":\"6.2.3\",\"type\":\"visualization\",\"id\":\"fcc684b0-2f39-11e8-9faf-f77fbc81a50d\",\"embeddableConfig\":{\"mapCenter\":[16.947354170252698,-6.432500062510371],\"mapZoom\":1}}]", + "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}" + } + } + } + ] +} diff --git a/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d_fieldFormatMap.txt b/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d_fieldFormatMap.txt new file mode 100644 index 0000000..01271dd --- /dev/null +++ b/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d_fieldFormatMap.txt @@ -0,0 +1,32 @@ +{ + "source_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "destination_port": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "ports": { + "id": "number", + "params": { + "pattern": "00" + } + }, + "@timestamp": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm:ss.SSS\\Z" + } + }, + "source_geo.asnstr": { + "id": "string", + "params": { + "transform": "false" + } + } +} diff --git a/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d_fields.txt b/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d_fields.txt new file mode 100644 index 0000000..7548cea --- /dev/null +++ b/sof-elk/dashboards/ba531340-2f17-11e8-9faf-f77fbc81a50d_fields.txt @@ -0,0 +1,176 @@ +{"name":"@timestamp","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"@version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"_id","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_index","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_source","type":"_source","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false} +{"name":"_type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"agent","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agent.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.build","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.build.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.device","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.device.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.major","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.major.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.minor","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.minor.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os_major","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os_major.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os_minor","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os_minor.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.os_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.os_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"agentinfo.patch","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"agentinfo.patch.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"beat.version","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"beat.version.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"cookie","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"cookie.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"count","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.area_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asn","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.asn.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.asnstr","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.asnstr.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.number","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.number.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"destination_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"destination_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"facility","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"fields","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"host","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"host.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"http_tags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"http_tags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"httpversion","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ident","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"info_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"info_phrase","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"info_phrase.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"input.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"input.type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ips","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"logsource","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"logsource.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"offset","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"original_message","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"password","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"path","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ports","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"prospector.type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"prospector.type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"protocol","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"proxied","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"proxied.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"proxy_cachestatus","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"proxy_hierarchystatus","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"query_string","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"query_string.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"rawrequest","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"rawrequest.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"received_at","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"referrer","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"referrer.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"request","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"request.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"request_method","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"request_url","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"request_url.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"response_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"response_filename","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"response_filename.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_fuid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_mimetype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"response_mimetype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_phrase","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"response_phrase.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"response_sub","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"response_time","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"severity","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_bytes","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_filename","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_filename.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_fuid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_geo.as_org","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.as_org.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asn","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.asnstr","type":"string","count":0,"scripted":true,"script":"if ( !doc.containsKey('source_geo.asn') || !doc.containsKey('source_geo.as_org.keyword') ) { return 'ASN: Not Available' } else { return 'ASN' + doc['source_geo.asn'].value + ': ' + doc['source_geo.as_org.keyword'].value }","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_geo.asnstr.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.city_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.city_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.continent_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.continent_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code2","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code2.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_code3","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_code3.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.country_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.country_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.dma_code","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.latitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.location","type":"geo_point","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.longitude","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.postal_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.postal_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_code","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_code.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.region_name","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.region_name.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_geo.timezone","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_geo.timezone.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_ip","type":"ip","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"source_mimetype","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"source_mimetype.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"source_port","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"ssl_cipher","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"ssl_cipher.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_hostname","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"syslog_hostname.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_program","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"syslog_program.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"syslog_timestamp","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"tags","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"tags.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"trans_depth","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"type.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"uid","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false} +{"name":"username","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false} +{"name":"username.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} +{"name":"version","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true} diff --git a/sof-elk/dashboards/timelineplaso/dashboard/Plaso-Timeline b/sof-elk/dashboards/timelineplaso/dashboard/Plaso-Timeline new file mode 100644 index 0000000..ab79d4b --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/dashboard/Plaso-Timeline @@ -0,0 +1,13 @@ +{ + "title": "Plaso Timeline", + "hits": 0, + "description": "", + "panelsJSON": "[{\"col\":3,\"id\":\"TL-Users-over-time\",\"panelIndex\":1,\"row\":1,\"size_x\":5,\"size_y\":5,\"type\":\"visualization\"},{\"col\":8,\"id\":\"TL-Events-over-time\",\"panelIndex\":2,\"row\":1,\"size_x\":5,\"size_y\":5,\"type\":\"visualization\"},{\"col\":7,\"id\":\"TL-Member_Changes\",\"panelIndex\":3,\"row\":6,\"size_x\":6,\"size_y\":4,\"type\":\"visualization\"},{\"col\":3,\"id\":\"TL-Group_Changes\",\"panelIndex\":4,\"row\":10,\"size_x\":5,\"size_y\":4,\"type\":\"visualization\"},{\"col\":3,\"id\":\"TL-Domain_Ctrl_Auth\",\"panelIndex\":6,\"row\":14,\"size_x\":5,\"size_y\":4,\"type\":\"visualization\"},{\"col\":1,\"id\":\"TL-Logon_Session_Evts\",\"panelIndex\":7,\"row\":6,\"size_x\":6,\"size_y\":4,\"type\":\"visualization\"},{\"col\":8,\"id\":\"TL-Markup-Powershell\",\"panelIndex\":11,\"row\":10,\"size_x\":5,\"size_y\":2,\"type\":\"visualization\"},{\"col\":8,\"id\":\"TL-Powershell_all\",\"panelIndex\":12,\"row\":12,\"size_x\":5,\"size_y\":6,\"type\":\"visualization\"},{\"col\":1,\"id\":\"TL-Mark-AllEventIDs\",\"panelIndex\":14,\"row\":1,\"size_x\":2,\"size_y\":5,\"type\":\"visualization\"},{\"col\":1,\"id\":\"TL-Mark-AllEventIDs\",\"panelIndex\":15,\"row\":10,\"size_x\":2,\"size_y\":8,\"type\":\"visualization\"}]", + "optionsJSON": "{\"darkTheme\":false}", + "uiStateJSON": "{\"P-1\":{\"spy\":{\"mode\":{\"fill\":false,\"name\":null}}},\"P-2\":{\"spy\":{\"mode\":{\"fill\":false,\"name\":null}}},\"P-7\":{\"spy\":{\"mode\":{\"fill\":false,\"name\":null}}}}", + "version": 1, + "timeRestore": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}]}" + } +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-Domain_Ctrl_Auth b/sof-elk/dashboards/timelineplaso/search/TL-Domain_Ctrl_Auth new file mode 100644 index 0000000..674e611 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-Domain_Ctrl_Auth @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"evt-eventid:4768 OR evt-eventid:4771 OR evt-eventid:4772\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-Domain_Ctrl_Auth" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-Group_Changes b/sof-elk/dashboards/timelineplaso/search/TL-Group_Changes new file mode 100644 index 0000000..fc61d78 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-Group_Changes @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"evt-eventid:4727 OR evt-eventid:[4730 TO 4731] OR evt-eventid:[4734 TO 4735] OR evt-eventid:4737 OR evt-eventid:[4744 TO 4745] OR evt-eventid:[4748 TO 4750] OR evt-eventid:[4753 TO 4755] OR evt-eventid:[4758 TO 4760] OR evt-eventid:4763\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-Group_Changes" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-Logon_Session_Evts b/sof-elk/dashboards/timelineplaso/search/TL-Logon_Session_Evts new file mode 100644 index 0000000..6a99faa --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-Logon_Session_Evts @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"evt-eventid:[4624 TO 4625] OR evt-eventid:4647 OR evt-eventid:[4778 TO 4779] OR evt-eventid:[4800 TO 4803]\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-Logon_Session_Evts" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-Member_Changes b/sof-elk/dashboards/timelineplaso/search/TL-Member_Changes new file mode 100644 index 0000000..eb75fa1 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-Member_Changes @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"evt-eventid:[4728 TO 4729] OR evt-eventid:[4732 TO 4733] OR evt-eventid:[4746 TO 4747] OR evt-eventid:[4751 TO 4752] OR evt-eventid:[4756 TO 4757] OR evt-eventid:[4761 TO 4762]\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-Member_Changes" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-Powershell-All b/sof-elk/dashboards/timelineplaso/search/TL-Powershell-All new file mode 100644 index 0000000..d064383 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-Powershell-All @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"evt-eventid:400 OR evt-eventid:403 OR evt-eventid:6 OR evt-eventid:40961 OR evt-eventid:4100 OR evt-eventid:169 OR evt-eventid:81 OR evt-eventid:134 OR evt-eventid:7937 OR evt-eventid:32850 OR evt-eventid:32867 OR evt-eventid:32868\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-Powershell-All" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-User_Acct_Changes b/sof-elk/dashboards/timelineplaso/search/TL-User_Acct_Changes new file mode 100644 index 0000000..fa90203 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-User_Acct_Changes @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"evt-eventid:4720 OR evt-eventid:[4722 TO 4726] OR evt-eventid:[4738 TO 4740] OR evt-eventid:4767 OR evt-eventid:4781\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-User_Acct_Changes" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-atime b/sof-elk/dashboards/timelineplaso/search/TL-atime new file mode 100644 index 0000000..0d3d808 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-atime @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"timestamp_desc:*atime*\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-atime" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-ctime b/sof-elk/dashboards/timelineplaso/search/TL-ctime new file mode 100644 index 0000000..bd78569 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-ctime @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"timestamp_desc:*ctime*\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-ctime" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-has-path b/sof-elk/dashboards/timelineplaso/search/TL-has-path new file mode 100644 index 0000000..35a2018 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-has-path @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"_exists_:evt-path\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-has-path" +} diff --git a/sof-elk/dashboards/timelineplaso/search/TL-mtime b/sof-elk/dashboards/timelineplaso/search/TL-mtime new file mode 100644 index 0000000..4c3c330 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/search/TL-mtime @@ -0,0 +1,16 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"timestamp_desc:*mtime*\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}" + }, + "version": 1, + "sort": [ + "@timestamp", + "desc" + ], + "columns": [ + "_source" + ], + "hits": 0, + "description": "", + "title": "TL-mtime" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Domain_Ctrl_Auth b/sof-elk/dashboards/timelineplaso/visualization/TL-Domain_Ctrl_Auth new file mode 100644 index 0000000..ce2dd9d --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Domain_Ctrl_Auth @@ -0,0 +1,11 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[]}" + }, + "version": 1, + "savedSearchId": "TL-Domain_Ctrl_Auth", + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"New Visualization\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"evt-eventid\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", + "title": "TL-Domain_Ctrl_Auth" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Event-Data b/sof-elk/dashboards/timelineplaso/visualization/TL-Event-Data new file mode 100644 index 0000000..a0f1686 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Event-Data @@ -0,0 +1,10 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "version": 1, + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"New Visualization\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"evt-eventid\",\"size\":20,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Event ID\"}},{\"id\":\"3\",\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"evt-logon_type\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Logon Type\"}},{\"id\":\"4\",\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"evt-provider\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Provider\"}},{\"id\":\"5\",\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"parser\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Parser\"}}],\"listeners\":{}}", + "title": "TL-Event-Data" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Events-over-time b/sof-elk/dashboards/timelineplaso/visualization/TL-Events-over-time new file mode 100644 index 0000000..cc3041b --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Events-over-time @@ -0,0 +1,10 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "version": 1, + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"TL-Events-by-user\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"evt-eventid\",\"size\":15,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Windows Event ID #\"}}],\"listeners\":{}}", + "title": "TL-Events-over-time" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-FN-and-EventID b/sof-elk/dashboards/timelineplaso/visualization/TL-FN-and-EventID new file mode 100644 index 0000000..3ea4bfe --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-FN-and-EventID @@ -0,0 +1,10 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"index\": \"timelineplaso-*\",\n \"query\": {\n \"query_string\": {\n \"query\": \"*\",\n \"analyze_wildcard\": true\n }\n },\n \"filter\": []\n}" + }, + "version": 1, + "description": "", + "uiStateJSON": "{}", + "visState": "{\n \"title\": \"New Visualization\",\n \"type\": \"histogram\",\n \"params\": {\n \"shareYAxis\": true,\n \"addTooltip\": true,\n \"addLegend\": true,\n \"scale\": \"linear\",\n \"mode\": \"stacked\",\n \"times\": [],\n \"addTimeMarker\": false,\n \"defaultYExtents\": false,\n \"setYExtents\": false,\n \"yAxis\": {}\n },\n \"aggs\": [\n {\n \"id\": \"1\",\n \"type\": \"count\",\n \"schema\": \"metric\",\n \"params\": {}\n },\n {\n \"id\": \"2\",\n \"type\": \"date_histogram\",\n \"schema\": \"segment\",\n \"params\": {\n \"field\": \"@timestamp\",\n \"interval\": \"auto\",\n \"customInterval\": \"2h\",\n \"min_doc_count\": 1,\n \"extended_bounds\": {}\n }\n },\n {\n \"id\": \"3\",\n \"type\": \"terms\",\n \"schema\": \"group\",\n \"params\": {\n \"field\": \"evt-eventid\",\n \"size\": 20,\n \"order\": \"desc\",\n \"orderBy\": \"1\"\n }\n },\n {\n \"id\": \"4\",\n \"type\": \"terms\",\n \"schema\": \"split\",\n \"params\": {\n \"field\": \"filename.raw\",\n \"size\": 13,\n \"order\": \"desc\",\n \"orderBy\": \"1\",\n \"row\": true\n }\n }\n ],\n \"listeners\": {}\n}", + "title": "TL - FN and EventID" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Group_Changes b/sof-elk/dashboards/timelineplaso/visualization/TL-Group_Changes new file mode 100644 index 0000000..1619275 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Group_Changes @@ -0,0 +1,11 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[]}" + }, + "version": 1, + "savedSearchId": "TL-Group_Changes", + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"New Visualization\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"evt-eventid\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\"}},{\"id\":\"4\",\"type\":\"terms\",\"schema\":\"split\",\"params\":{\"field\":\"evt-logon_type\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"row\":true}}],\"listeners\":{}}", + "title": "TL-Group_Changes" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Logon_Session_Evts b/sof-elk/dashboards/timelineplaso/visualization/TL-Logon_Session_Evts new file mode 100644 index 0000000..a1e88b0 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Logon_Session_Evts @@ -0,0 +1,11 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"filter\": []\n}" + }, + "version": 1, + "savedSearchId": "TL-Logon_Session_Evts", + "description": "", + "uiStateJSON": "{}", + "visState": "{\n \"title\": \"New Visualization\",\n \"type\": \"histogram\",\n \"params\": {\n \"shareYAxis\": true,\n \"addTooltip\": true,\n \"addLegend\": true,\n \"scale\": \"linear\",\n \"mode\": \"stacked\",\n \"times\": [],\n \"addTimeMarker\": false,\n \"defaultYExtents\": false,\n \"setYExtents\": false,\n \"yAxis\": {}\n },\n \"aggs\": [\n {\n \"id\": \"1\",\n \"type\": \"count\",\n \"schema\": \"metric\",\n \"params\": {}\n },\n {\n \"id\": \"2\",\n \"type\": \"date_histogram\",\n \"schema\": \"segment\",\n \"params\": {\n \"field\": \"@timestamp\",\n \"interval\": \"auto\",\n \"customInterval\": \"2h\",\n \"min_doc_count\": 1,\n \"extended_bounds\": {}\n }\n },\n {\n \"id\": \"3\",\n \"type\": \"terms\",\n \"schema\": \"group\",\n \"params\": {\n \"field\": \"evt-eventid\",\n \"size\": 10,\n \"order\": \"desc\",\n \"orderBy\": \"1\"\n }\n },\n {\n \"id\": \"4\",\n \"type\": \"terms\",\n \"schema\": \"split\",\n \"params\": {\n \"field\": \"evt-logon_type\",\n \"size\": 5,\n \"order\": \"desc\",\n \"orderBy\": \"1\",\n \"row\": true\n }\n }\n ],\n \"listeners\": {}\n}", + "title": "TL-Logon_Session_Evts" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Mark-AllEventIDs b/sof-elk/dashboards/timelineplaso/visualization/TL-Mark-AllEventIDs new file mode 100644 index 0000000..9423be8 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Mark-AllEventIDs @@ -0,0 +1,10 @@ +{ + "title": "TL-HTML-AllEventIDs", + "visState": "{\n \"title\": \"New Visualization\",\n \"type\": \"html\",\n \"params\": {\n \"html\": \"

All Event ID's

\\n51 nt starting up
\\n513 shutting down
\\n514 auth pkg loaded by lsa
\\n515 logon register with lsa
\\n516 audit messages queue full
\\n517 audit log cleared
\\n518 notif pkg loaded by sam
\\n519 invalid lpc port
\\n520 sys time chg
\\n521 unable to log to sec log
\\n528 success logon
\\n529 logonfail-unk user-bad pw
\\n530 logonfail-acct logon time
\\n531 logonfail-acct disabled
\\n532 logonfail-acct expired
\\n533 logonfail-not allowed to logon
\\n534 logonfail-not granted logon type
\\n535 logonfail-pw expired
\\n536 logonfail-netlogon not active
\\n537 logonfail-logon attempt fail
\\n538 user logoff
\\n539 logonfail- acct locked out
\\n540 success network logon
\\n551 user initiated logoff
\\n552 logon attempt using explicit creds
\\n560 obj open
\\n561 handle allocated
\\n562 handle closed
\\n563 obj open for delete
\\n564 obj deleted
\\n565 obj open-ad
\\n566 obj operation-w3 ad
\\n567 obj access attempt
\\n576 special privs for new logon
\\n577 priv svc called
\\n578 priv obj operation
\\n592 new process been add
\\n593 process exited
\\n594 handle to obj been duplicated
\\n595 indirect access to obj obtained
\\n596 backup of data prot master key
\\n600 process assigned primary token
\\n601 attempt to install svc
\\n602 scheduled task add
\\n608 user right assigned
\\n609 user right removed
\\n610 new trusted domain
\\n611 removing trusted domain
\\n612 audit policy change
\\n613 ipsec agent started
\\n614 ipsec agent disabled
\\n615 ipsec agent svc
\\n616 ipsec agent failure
\\n617 kerberos policy changed
\\n618 encryp data recov policy chg
\\n619 quality of svc policy changed
\\n620 trusted domain info chg
\\n621 sys sec access granted
\\n622 sys sec access removed
\\n623 per user audit policy refreshed
\\n624 user acct created
\\n625 user acct type changed
\\n626 user acct enabl
\\n627 change pw attempt
\\n628 user acct pw set
\\n629 user acct disab
\\n630 user acct deleted
\\n631 enabl global grp created
\\n632 enabl global grp member added
\\n633 enabl global grp member removed
\\n634 enabl global grp deleted
\\n635 enabl local grp created
\\n636 enabl local grp member added
\\n637 enabl local grp member removed
\\n638 enabl local grp deleted
\\n639 enabl local grp changed
\\n640 general acct database change
\\n641 sec enabl global grp changed
\\n642 user acct changed
\\n643 domain policy changed
\\n644 user acct locked out
\\n645 computer acct created
\\n646 computer acct changed
\\n647 computer acct deleted
\\n648 disab local grp add
\\n649 disab local grp chg
\\n650 disab local grp member add
\\n651 disab local grp member del
\\n652 disab local grp del
\\n653 disab glob grp add
\\n654 disab glob grp chg
\\n655 disab glob grp member add
\\n656 disab glob grp member del
\\n657 disab glob grp del
\\n658 enabl univ grp add
\\n659 enabl univ grp chg
\\n660 enabl univ grp member add
\\n661 enabl univ grp member del
\\n662 enabl univ grp del
\\n663 disab univ grp add
\\n664 disab univ grp chg
\\n665 disab univ grp member add
\\n666 disab univ grp member del
\\n667 disab univ grp del
\\n668 grp type changed
\\n669 add sid history
\\n670 add sid history
\\n671 user acct unlocked
\\n672 auth ticket granted
\\n673 svc ticket granted
\\n674 ticket granted renewed
\\n675 pre-auth fail
\\n676 auth ticket request failed
\\n677 svc ticket request failed
\\n678 acct mapped for logon by
\\n679 could not map user
\\n680 acct used for logon by
\\n681 logon to acct fail
\\n682 sess reconn to winstation
\\n683 sess disconn from winstation
\\n684 set acls in admin grps
\\n685 acct name changed
\\n686 pw of user accessed
\\n687 appl grp created
\\n688 appl grp changed
\\n689 appl grp member added
\\n690 appl grp member removed
\\n691 appl grp non-member added
\\n692 appl grp non-member removed
\\n693 appl grp deleted
\\n694 ldap query grp created
\\n695 ldap query grp changed
\\n696 ldap query grp deleted
\\n697 pw policy check api called
\\n806 per user audit policy refreshed
\\n807 per user auditing policy set
\\n808 sec event attempt to register
\\n809 sec event attempt to unregister
\\n848 policy active when fw started
\\n849 appl listed as except at start
\\n850 port listed as except at start
\\n851 chg made to fw appl except list
\\n852 chg made to fw port except list
\\n853 fw operational mode chg
\\n854 fw logging settings have chg
\\n855 fw icmp setting chg
\\n856 fw setting chg
\\n857 fw setting chg
\\n858 fw grp policy settings add
\\n859 fw grp policy settings del
\\n860 fw switched active profile
\\n861 fw detect appl listening for traffic
\\n1100 event logging svc shut down
\\n1101 audit events dropped
\\n1102 audit log cleared
\\n1104 sec log now full
\\n1105 event log automatic backup
\\n1108 event logging svc error
\\n4608 starting up
\\n4609 shutting down
\\n4610 auth pkg loaded by lsa
\\n4611 trusted logon regist with lsa
\\n4612 queuing of audit msg exhausted
\\n4614 notif package loaded by sam
\\n4615 invalid use of lpc port
\\n4616 sys time chg
\\n4618 monitored sec event occurred
\\n4621 crashonauditfail recovery
\\n4622 sec package loaded by lsa
\\n4624 acct success logged on
\\n4625 acct fail to log on
\\n4626 user/device claims information
\\n4627 grp membership information
\\n4634 acct logged off
\\n4646 ike dos-prevention mode started
\\n4647 user initiated logoff
\\n4648 logon attempt using explicit creds
\\n4649 replay attack detected
\\n4650 ipsec main mode sec assoc establ
\\n4651 ipsec main mode sec assoc establ
\\n4652 ipsec main mode neg fail
\\n4653 ipsec main mode neg fail
\\n4654 ipsec quick mode neg fail
\\n4655 ipsec main mode sec assoc ended
\\n4656 handle to obj requested
\\n4657 registry value chg
\\n4658 handle to obj closed
\\n4659 handle request w intent to del
\\n4660 obj del
\\n4661 handle to obj requested
\\n4662 operation performed on obj
\\n4663 attempt to access obj
\\n4664 attempt to create hard link
\\n4665 attempt to create appl client context
\\n4666 appl attempt operation
\\n4667 appl client context del
\\n4668 appl initialized
\\n4670 permissions on obj chg
\\n4671 appl access blocked ordinal
\\n4672 special privs assigned to new logon
\\n4673 priv svc called
\\n4674 operation attempt on priv obj
\\n4675 sids filtered
\\n4688 new process been add
\\n4689 process exited
\\n4690 attempt made to duplicate handle to obj
\\n4691 indirect access to obj requested
\\n4692 data protect master key attempt
\\n4693 data protect master key attempt
\\n4694 data protect attempt
\\n4695 data protect unprotect
\\n4696 token assigned to process
\\n4697 svc installed in sys
\\n4698 scheduled task add
\\n4699 scheduled task del
\\n4700 scheduled task enabled
\\n4701 scheduled task disabled
\\n4702 scheduled task updated
\\n4704 user right assigned
\\n4705 user right del
\\n4706 new trust add to domain
\\n4707 trust to domain del
\\n4709 ipsec svcs started
\\n4710 ipsec svcs disabled
\\n4711 pastore engine
\\n4712 ipsec serious failure
\\n4713 kerberos policy chg
\\n4714 encrypted data recovery policy chg
\\n4715 audit policy on obj chg
\\n4716 trusted domain information chg
\\n4717 sys sec access granted to acct
\\n4718 sys sec access del from acct
\\n4719 sys audit policy chg
\\n4720 user acct add
\\n4722 user acct enabled
\\n4723 attempt made to chg acct's pw
\\n4724 attempt made to reset accts pw
\\n4725 user acct disabled
\\n4726 user acct del
\\n4727 sec-enabled glob grp add
\\n4728 member add to sec-enabled glob grp
\\n4729 member del from sec-enabled glob grp
\\n4730 sec-enabled glob grp del
\\n4731 sec-enabled local grp add
\\n4732 member add to sec-enabled local grp
\\n4733 member del from sec-enabled local grp
\\n4734 sec-enabled local grp del
\\n4735 sec-enabled local grp chg
\\n4737 sec-enabled glob grp chg
\\n4738 user acct chg
\\n4739 domain policy chg
\\n4740 user acct locked out
\\n4741 computer acct add
\\n4742 computer acct chg
\\n4743 computer acct del
\\n4744 sec-disabled local grp add
\\n4745 sec-disabled local grp chg
\\n4746 member add to sec-disabled local grp
\\n4747 member del from sec-disabled local grp
\\n4748 sec-disabled local grp del
\\n4749 sec-disabled glob grp add
\\n4750 sec-disabled glob grp chg
\\n4751 member add to sec-disabled glob grp
\\n4752 member del from sec-disabled glob grp
\\n4753 sec-disabled glob grp del
\\n4754 sec-enabled univ grp add
\\n4755 sec-enabled univ grp chg
\\n4756 member add to sec-enabled univ grp
\\n4757 member del from sec-enabled univ grp
\\n4758 sec-enabled univ grp del
\\n4759 sec-disabled univ grp add
\\n4760 sec-disabled univ grp chg
\\n4761 member add to sec-disabled univ grp
\\n4762 member del from sec-disabled univ grp
\\n4763 sec-disabled univ grp del
\\n4764 grps type chg
\\n4765 sid history add to acct
\\n4766 add sid history to acct fail
\\n4767 user acct unlocked
\\n4768 kerberos tgt requested
\\n4769 kerberos svc ticket requested
\\n4770 kerberos svc ticket renewed
\\n4771 kerberos pre-auth fail
\\n4772 kerberos auth ticket request fail
\\n4773 kerberos svc ticket request fail
\\n4774 acct mapped for logon
\\n4775 acct could not map for logon
\\n4776 attempt to validate acct
\\n4777 fail to validate creds
\\n4778 sess reconn to window station
\\n4779 sess discon from window station
\\n4780 acl set on admin grp accts
\\n4781 name of acct chg
\\n4782 pw hash acct accessed
\\n4783 app grp add
\\n4784 app grp chg
\\n4785 member add to appl grp
\\n4786 member del from appl grp
\\n4787 non-member add to appl grp
\\n4788 non-member del from appl grp
\\n4789 app grp del
\\n4790 ldap query grp add
\\n4791 app grp chg
\\n4792 ldap query grp del
\\n4793 pw policy check api called
\\n4794 dirsvc restore mode admin pw set
\\n4797 query if blank pw for acct
\\n4798 local grp membership enum
\\n4799 local grp membership enum
\\n4800 workstation locked
\\n4801 workstation unlocked
\\n4802 screen saver invoked
\\n4803 screen saver dismissed
\\n4816 rpc integrity violation
\\n4817 auditing settings on obj chg
\\n4818 central access policy
\\n4819 central access policy
\\n4820 tgt denied
\\n4821 kerberos ticket denied
\\n4822 ntlm auth fail
\\n4823 ntlm auth fail
\\n4824 kerberos preauth fail
\\n4864 namespace collision
\\n4865 trusted forest entry add
\\n4866 trusted forest entry del
\\n4867 trusted forest entry chg
\\n4868 cert mgr denied
\\n4869 cert svcs received cert request
\\n4870 cert svcs revoked cert
\\n4871 cert svcs request to crl
\\n4872 cert svcs published crl
\\n4873 cert request extension chg
\\n4874 cert request attrib chg
\\n4875 cert svcs request to shut down
\\n4876 cert svcs backup start
\\n4877 cert svcs backup complete
\\n4878 cert svcs restore start
\\n4879 cert svcs restore complete
\\n4880 cert svcs started
\\n4881 cert svcs stopped
\\n4882 sec perms for cert svcs chg
\\n4883 cert svcs retrieved key
\\n4884 cert svcs imported cert
\\n4885 audit filter for cert svcs chg
\\n4886 cert svcs received cert request
\\n4887 cert svcs approved issued cert
\\n4888 cert svcs denied cert request
\\n4889 cert svcs cert request now pending
\\n4890 cert mgr settings for cert svcs chg
\\n4891 config entry chg in cert svcs
\\n4892 property of cert svcs chg
\\n4893 cert svcs archived key
\\n4894 cert svcs imported key
\\n4895 cert svcs sent ca to ad domain svcs
\\n4896 rows del from cert db
\\n4897 role separation enabled
\\n4898 cert svcs loaded template
\\n4899 cert svcs template updated
\\n4900 cert svcs template sec updated
\\n4902 per-user audit table add
\\n4904 register sec event source
\\n4905 unregister sec event source
\\n4906 crashonauditfail value chg
\\n4907 auditing settings on obj chg
\\n4908 special grps logon table chg
\\n4909 local policy for tbs chg
\\n4910 grp policy for tbs chg
\\n4911 resource attrib of obj chg
\\n4912 per user audit policy chg
\\n4913 access policy on obj chg
\\n4928 ad replica context chg
\\n4929 ad replica context chg
\\n4930 ad replica context chg
\\n4931 ad replica context chg
\\n4932 sync replica of ad context begun
\\n4933 sync replica of ad context ended
\\n4934 attributes of ad obj replicated
\\n4935 replication failure begins
\\n4936 replication failure ends
\\n4937 lingering obj del from replica
\\n4944 fw started policies
\\n4945 rule listed when fw started
\\n4946 fw exception list rule add
\\n4947 fw exception list rule chg
\\n4948 fw exception list rule del
\\n4949 fw settings restored
\\n4950 fw setting chg
\\n4951 fw rule ignored
\\n4952 fw rule ignored partially
\\n4953 fw rule ignored
\\n4954 fw grp policy chg
\\n4956 fw chg active profile
\\n4957 fw not apply rule
\\n4958 fw not apply rule
\\n4960 ipsec drop packet
\\n4961 ipsec drop packet
\\n4962 ipsec drop packet
\\n4963 ipsec drop packet
\\n4964 special grps for new logon
\\n4965 ipsec invalid spi
\\n4976 ipsec invalid neg packet
\\n4977 ipsec invalid neg packet
\\n4978 ipsec invalid neg packet
\\n4979 ipsec sec assoc establ
\\n4980 ipsec sec assoc establ
\\n4981 ipsec sec assoc establ
\\n4982 ipsec sec assoc establ
\\n4983 ipsec extend mode neg fail
\\n4984 ipsec extend mode neg fail
\\n4985 state of transaction chg
\\n5024 fw svc started success
\\n5025 fw svc been stopped
\\n5027 fw svc fail
\\n5028 fw svc fail
\\n5029 fw svc fail
\\n5030 fw svc fail
\\n5031 fw svc blocked app
\\n5032 fw app notify fail
\\n5033 fw driver started success
\\n5034 fw driver been stopped
\\n5035 fw driver fail to start
\\n5037 fw drv err-terminating
\\n5038 image hash invalid
\\n5039 registry key virtualized
\\n5040 ipsec chg auth set
\\n5041 ipsec chg auth set
\\n5042 ipsec chg auth set
\\n5043 ipsec chg connsec rule
\\n5044 ipsec chg connsec rule
\\n5045 ipsec chg connsec rule
\\n5046 ipsec chg crypto set
\\n5047 ipsec chg crypto set
\\n5048 ipsec chg crypto set
\\n5049 ipsec sec assoc
\\n5050 try to disable fw
\\n5051 file virtualized
\\n5056 crypt self test performed
\\n5057 crypt primitive fail
\\n5058 key file operation
\\n5059 key migration operation
\\n5060 verification operation fail
\\n5061 cryptographic operation
\\n5062 crypt self test
\\n5063 crypt provider op attempt
\\n5064 crypt context op attempt
\\n5065 crypt context mod attempt
\\n5066 crypt op attempt
\\n5067 crypt mod attempt
\\n5068 crypt provider op attempt
\\n5069 crypt property op attempt
\\n5070 crypt property op attempt
\\n5071 key access denied
\\n5120 ocsp responder svc started
\\n5121 ocsp responder svc stopped
\\n5122 ocsp responder chg
\\n5123 config chg in ocsp
\\n5124 sec setting update on ocsp
\\n5125 request submitted to ocsp
\\n5126 signing cert updated by ocsp
\\n5127 ocsp updated revocation info
\\n5136 dir svc obj chg
\\n5137 dir svc obj add
\\n5138 dir svc obj undel
\\n5139 dir svc obj moved
\\n5140 net share obj accessed
\\n5141 dir svc obj del
\\n5142 net share obj add
\\n5143 net share obj chg
\\n5144 net share obj del
\\n5145 net share obj checked
\\n5146 filter blocked packet
\\n5147 filter blocked packet
\\n5148 filter detected dos
\\n5149 dos attack subsided
\\n5150 filter blocked packet
\\n5151 filter blocked packet
\\n5152 filter blocked packet
\\n5153 filter blocked packet
\\n5154 filter permit appl
\\n5155 filter blocked appl
\\n5156 filter allowed conn
\\n5157 filter blocked conn
\\n5158 filter permitted local bind
\\n5159 filter blocked local bind
\\n5168 spn check for smb fails
\\n5376 cred mgr creds backed up
\\n5377 cred mgr creds restored
\\n5378 creds delegation disallowed
\\n5440 filter
\\n5441 filter
\\n5442 filter
\\n5443 filter
\\n5444 filter
\\n5446 filter
\\n5447 filter
\\n5448 filter
\\n5449 filter
\\n5450 filter
\\n5451 ipsec quick mode start
\\n5452 ipsec quick mode end
\\n5453 ipsec failed
\\n5456 pastore engine
\\n5457 pastore engine
\\n5458 pastore engine
\\n5459 pastore engine
\\n5460 pastore engine
\\n5461 pastore engine
\\n5462 pastore engine
\\n5463 pastore engine
\\n5464 pastore engine
\\n5465 pastore engine
\\n5466 pastore engine
\\n5467 pastore engine
\\n5468 pastore engine
\\n5471 pastore engine
\\n5472 pastore engine
\\n5473 pastore engine
\\n5474 pastore engine
\\n5477 pastore engine
\\n5478 ipsec started
\\n5479 ipsec shut down
\\n5480 ipsec fail
\\n5483 ipsec fail
\\n5484 ipsec fail
\\n5485 ipsec fail
\\n5632 auth to wireless net
\\n5633 auth to wired net
\\n5712 rpc attempt
\\n5888 obj in com catalog mod
\\n5889 obj in com catalog del
\\n5890 obj in com catalog add
\\n6144 grp sec policy applied
\\n6145 sec policy error
\\n6272 granted access to user
\\n6273 denied access to user
\\n6274 discarded request
\\n6275 discarded request
\\n6276 quarantined user
\\n6277 granted access
\\n6278 granted access
\\n6279 locked acct-repeat fails
\\n6280 unlocked user acct
\\n6281 invalid image page hashes
\\n6400 incorrectly formatted
\\n6401 incorrectly formatted
\\n6402 incorrectly formatted
\\n6403 incorrectly formatted
\\n6404 cache not authenticated
\\n6405 event id reoccurrences
\\n6406 regist for fw filtering
\\n6408 product fail fw regist
\\n6409 svc conn not parsed
\\n6416 new ext device on sys
\"\n },\n \"aggs\": [],\n \"listeners\": {}\n}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"query\": {\n \"query_string\": {\n \"query\": \"*\",\n \"analyze_wildcard\": true\n }\n },\n \"filter\": []\n}" + } +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Markup-Powershell b/sof-elk/dashboards/timelineplaso/visualization/TL-Markup-Powershell new file mode 100644 index 0000000..d5ea098 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Markup-Powershell @@ -0,0 +1,10 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"filter\":[]}" + }, + "version": 1, + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"TL-Markup-Powershell\",\"type\":\"markdown\",\"params\":{\"markdown\":\"If HostName=ConsoleHost then local session | If HostName=ServerRemoteHost then remote session \\n--------------------- | ------------------\\nID 400: Engine Started | ID 6: Creating WSMan Session\\nID 403: Engine Stopped | ID 169: User X authenticated successfully using NTLM\\nID 40961: PowerShell console is starting up | ID 81: Processing client request for operation CreateShell\\nID 4100: Error Messages (PS 3.0 and higher) | ID 134: Sending response for operation DeleteShell \\nID 7937: Executed cmdlets, scripts, or commands .. | ID 32850: Creating a server remote session. Username listed \\n | ID 32867: Received remoting fragment. Payload data. Encoded. \\n | ID 32868: Sent remoting fragment. Payload data. Encoded.\"},\"aggs\":[],\"listeners\":{}}", + "title": "TL-Markup-Powershell" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Member_Changes b/sof-elk/dashboards/timelineplaso/visualization/TL-Member_Changes new file mode 100644 index 0000000..b3fe52d --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Member_Changes @@ -0,0 +1,11 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[]}" + }, + "version": 1, + "savedSearchId": "TL-Member_Changes", + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"New Visualization\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"evt-eventid\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", + "title": "TL-Member_Changes" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Powershell_all b/sof-elk/dashboards/timelineplaso/visualization/TL-Powershell_all new file mode 100644 index 0000000..b9e2d57 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Powershell_all @@ -0,0 +1,11 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[]}" + }, + "version": 1, + "savedSearchId": "TL-Powershell-All", + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"New Visualization\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{},\"customLabel\":\"Powershell events over time\"}},{\"id\":\"3\",\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"evt-eventid\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Event ID #\"}},{\"id\":\"4\",\"type\":\"terms\",\"schema\":\"split\",\"params\":{\"field\":\"user_sid.raw\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"User SID\",\"row\":true}}],\"listeners\":{}}", + "title": "TL-Powershell_all" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-Users-over-time b/sof-elk/dashboards/timelineplaso/visualization/TL-Users-over-time new file mode 100644 index 0000000..0d13f71 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-Users-over-time @@ -0,0 +1,10 @@ +{ + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"timelineplaso-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "version": 1, + "description": "", + "uiStateJSON": "{}", + "visState": "{\"title\":\"TL - FN and EventID\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"user_sid.raw\",\"size\":20,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", + "title": "TL - Users over time" +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-mark-group b/sof-elk/dashboards/timelineplaso/visualization/TL-mark-group new file mode 100644 index 0000000..bc47f03 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-mark-group @@ -0,0 +1,10 @@ +{ + "title": "TL-mark-group", + "visState": "{\"title\":\"TL-mark-group\",\"type\":\"markdown\",\"params\":{\"markdown\":\"####Group account adds, deletes, modifications \\nColumn 1 | Column 2 | Column 3\\n------ | -------- | -----\\n4727 Security Global Created | 4744 Distrib Local Created | 4749 Distrib Global Created\\n4730 Security Global Deleted | 4750 Distrib Global Changed | 4760 Distrib Universal Changed\\n4731 Security Local Created | 4753 Distrib Global Deleted | 4745 Distrib Local Changed\\n4734 Security Local Deleted | 4755 Security Universal Changed . | 4763 Distrib Universal Deleted\\n4735 Security Global Changed . | 4758 Security Universal Deleted | 4748 Distrib Local Deleted\\n4737 Security Local Changed | 4759 Distrib Glob/Univ Deleted\"},\"aggs\":[],\"listeners\":{}}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + } +} diff --git a/sof-elk/dashboards/timelineplaso/visualization/TL-mark-user b/sof-elk/dashboards/timelineplaso/visualization/TL-mark-user new file mode 100644 index 0000000..5048da5 --- /dev/null +++ b/sof-elk/dashboards/timelineplaso/visualization/TL-mark-user @@ -0,0 +1,10 @@ +{ + "title": "TL-mark-user", + "visState": "{\"title\":\"TL-mark-user\",\"type\":\"markdown\",\"params\":{\"markdown\":\"####User account adds, deletes, modifications\\nColumn 1 | Column 2 | Column 3\\n---- | ---- | ----\\n4728 Sec Global Added | 4746 Distrib Local Added | 4756 Sec Univeral Added\\n4729 Sec Global Removed .| 4747 Distrib Local Removed | 4757 Sec Universal Removed\\n4732 Sec Local Added | 4751 Distrib Global Added | 4761 Distrib Univ Added\\n4733 Sec Local Added | 4752 Distrib Global Removed . | 4762 Distrib Univ Removed\"},\"aggs\":[],\"listeners\":{}}", + "uiStateJSON": "{}", + "description": "", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + } +} diff --git a/sof-elk/supporting-scripts/load_all_dashboards.sh b/sof-elk/supporting-scripts/load_all_dashboards.sh index 5433c7b..0516be1 100755 --- a/sof-elk/supporting-scripts/load_all_dashboards.sh +++ b/sof-elk/supporting-scripts/load_all_dashboards.sh @@ -8,16 +8,18 @@ ARGC=$# -es_host=localhost +es_host=elasticsearch es_port=9200 -kibana_host=localhost +kibana_host=kibana kibana_port=5601 kibana_index=.kibana -kibana_version=$( jq -r '.version' < /usr/share/kibana/package.json ) -kibana_build=$(jq -r '.build.number' < /usr/share/kibana/package.json ) +kibana_version=${ES_VERSION:-6.5.0} +kibana_build=${ES_VERSION:-6.5.0} -dashboard_dir="/usr/local/sof-elk/dashboards/" +#sofelk_dir="/usr/local/sof-elk" +sofelk_dir=$(pwd)/sof-elk +dashboard_dir=${sofelk_dir}/dashboards # enter a holding pattern until the elasticsearch server is available, but don't wait too long max_wait=60 @@ -35,8 +37,8 @@ done # re-insert all ES templates in case anything has changed # this will not change existing mappings, just new indexes as they are created # (And why-oh-why isn't this handled by "template_overwrite = true" in the logstash output section?!?!?!?!) -for es_template in $( ls -1 /usr/local/sof-elk/lib/elasticsearch-*-template.json | sed 's/.*elasticsearch-\(.*\)-template.json/\1/' ); do - curl -s -XPUT -H 'Content-Type: application/json' http://${es_host}:${es_port}/_template/${es_template} -d @/usr/local/sof-elk/lib/elasticsearch-${es_template}-template.json > /dev/null +for es_template in $( ls -1 ${sofelk_dir}/lib/elasticsearch-*-template.json | sed 's/.*elasticsearch-\(.*\)-template.json/\1/' ); do + curl -s -XPUT -H 'Content-Type: application/json' http://${es_host}:${es_port}/_template/${es_template} -d @${sofelk_dir}/lib/elasticsearch-${es_template}-template.json > /dev/null done # set the default index pattern, time zone, and add TZ offset to the default date format diff --git a/startup/Dockerfile b/startup/Dockerfile new file mode 100644 index 0000000..1bfee6c --- /dev/null +++ b/startup/Dockerfile @@ -0,0 +1,12 @@ +# This file is used to run necessary startup and various tasks in the stack + +FROM debian:9 + +RUN apt-get update && apt-get install -y curl + +RUN mkdir /app +COPY startup.sh /app +WORKDIR /app +RUN chmod +x startup.sh + +CMD ./startup.sh \ No newline at end of file diff --git a/startup/startup.sh b/startup/startup.sh new file mode 100644 index 0000000..408bf9c --- /dev/null +++ b/startup/startup.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +echo "Running scripts" +if [ -f /sof-elk/already_done ]; then + echo "Already ran scripts!" + exit 0 +fi +#touch /sof-elk/already_done + +bash /sof-elk/supporting-scripts/load_all_dashboards.sh \ No newline at end of file