added Malcolm
This commit is contained in:
@@ -0,0 +1,534 @@
|
||||
{
|
||||
"version": "7.10.0",
|
||||
"objects": [
|
||||
{
|
||||
"id": "42e831b9-41a9-4f35-8b7d-e1566d368773",
|
||||
"type": "dashboard",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-11T18:04:53.082Z",
|
||||
"version": "WzMxNjAsMV0=",
|
||||
"attributes": {
|
||||
"title": "SMB",
|
||||
"hits": 0,
|
||||
"description": "",
|
||||
"panelsJSON": "[{\"version\":\"7.10.0\",\"gridData\":{\"x\":0,\"y\":0,\"w\":8,\"h\":32,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{},\"panelRefName\":\"panel_0\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":16,\"y\":0,\"w\":32,\"h\":13,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"panelRefName\":\"panel_1\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":0,\"y\":50,\"w\":20,\"h\":19,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"table\":null,\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}},\"panelRefName\":\"panel_2\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":20,\"y\":50,\"w\":20,\"h\":19,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}},\"panelRefName\":\"panel_3\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":21,\"y\":13,\"w\":12,\"h\":19,\"i\":\"8\"},\"panelIndex\":\"8\",\"embeddableConfig\":{},\"panelRefName\":\"panel_4\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":0,\"y\":32,\"w\":23,\"h\":18,\"i\":\"9\"},\"panelIndex\":\"9\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}},\"panelRefName\":\"panel_5\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":23,\"y\":32,\"w\":25,\"h\":18,\"i\":\"10\"},\"panelIndex\":\"10\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}},\"panelRefName\":\"panel_6\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":0,\"y\":69,\"w\":48,\"h\":18,\"i\":\"11\"},\"panelIndex\":\"11\",\"embeddableConfig\":{},\"panelRefName\":\"panel_7\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":8,\"y\":0,\"w\":8,\"h\":13,\"i\":\"13\"},\"panelIndex\":\"13\",\"embeddableConfig\":{},\"panelRefName\":\"panel_8\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":40,\"y\":50,\"w\":8,\"h\":19,\"i\":\"14\"},\"panelIndex\":\"14\",\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}},\"panelRefName\":\"panel_9\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":8,\"y\":13,\"w\":13,\"h\":19,\"i\":\"c9b45e56-7e2e-4949-ad5f-05504515cc70\"},\"panelIndex\":\"c9b45e56-7e2e-4949-ad5f-05504515cc70\",\"embeddableConfig\":{},\"panelRefName\":\"panel_10\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":33,\"y\":13,\"w\":15,\"h\":19,\"i\":\"67e0e34e-49ae-46da-a9a3-83ca7676bee0\"},\"panelIndex\":\"67e0e34e-49ae-46da-a9a3-83ca7676bee0\",\"embeddableConfig\":{},\"panelRefName\":\"panel_11\"},{\"version\":\"7.10.0\",\"gridData\":{\"x\":0,\"y\":87,\"w\":48,\"h\":42,\"i\":\"cf75e7f0-cce1-449c-a40d-15e8fa40325d\"},\"panelIndex\":\"cf75e7f0-cce1-449c-a40d-15e8fa40325d\",\"embeddableConfig\":{},\"panelRefName\":\"panel_12\"}]",
|
||||
"optionsJSON": "{\"useMargins\":true}",
|
||||
"version": 1,
|
||||
"timeRestore": false,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"*\"},\"filter\":[]}"
|
||||
}
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "panel_0",
|
||||
"type": "visualization",
|
||||
"id": "df9e399b-efa5-4e33-b0ac-a7668a8ac2b3"
|
||||
},
|
||||
{
|
||||
"name": "panel_1",
|
||||
"type": "visualization",
|
||||
"id": "c4829cb4-ed05-4154-ab6c-9240f0ea0b04"
|
||||
},
|
||||
{
|
||||
"name": "panel_2",
|
||||
"type": "visualization",
|
||||
"id": "3b82d24e-d3dd-48fa-a539-98a46ccbfd49"
|
||||
},
|
||||
{
|
||||
"name": "panel_3",
|
||||
"type": "visualization",
|
||||
"id": "974779e2-ab49-4fe8-88db-bf5321664f1a"
|
||||
},
|
||||
{
|
||||
"name": "panel_4",
|
||||
"type": "visualization",
|
||||
"id": "3282a033-fff4-41cb-abe6-d896b4a2e03d"
|
||||
},
|
||||
{
|
||||
"name": "panel_5",
|
||||
"type": "visualization",
|
||||
"id": "02359f84-0114-4d9d-8731-2b6820722e32"
|
||||
},
|
||||
{
|
||||
"name": "panel_6",
|
||||
"type": "visualization",
|
||||
"id": "c8f1ff18-93e9-4ce9-a188-c947f7dadc05"
|
||||
},
|
||||
{
|
||||
"name": "panel_7",
|
||||
"type": "visualization",
|
||||
"id": "24b9dbff-7362-4982-9ce7-660001594ff9"
|
||||
},
|
||||
{
|
||||
"name": "panel_8",
|
||||
"type": "visualization",
|
||||
"id": "AWDHDfDkxQT5EBNmq4fQ"
|
||||
},
|
||||
{
|
||||
"name": "panel_9",
|
||||
"type": "visualization",
|
||||
"id": "0fa8205d-717f-4385-a031-d15e5f1b6c08"
|
||||
},
|
||||
{
|
||||
"name": "panel_10",
|
||||
"type": "visualization",
|
||||
"id": "b9aaa580-4e9a-11ea-b504-97aa449f6abc"
|
||||
},
|
||||
{
|
||||
"name": "panel_11",
|
||||
"type": "visualization",
|
||||
"id": "b74e39c0-49ca-11ea-812f-2bc51df4ea1e"
|
||||
},
|
||||
{
|
||||
"name": "panel_12",
|
||||
"type": "search",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"dashboard": "7.9.3"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "df9e399b-efa5-4e33-b0ac-a7668a8ac2b3",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:25:09.616Z",
|
||||
"version": "Wzg3MiwxXQ==",
|
||||
"attributes": {
|
||||
"title": "Zeek Logs",
|
||||
"visState": "{\"title\":\"Zeek Logs\",\"type\":\"markdown\",\"params\":{\"markdown\":\"### General\\n[Overview](/kibana/app/dashboards#/view/0ad3d7c2-3441-485e-9dfe-dbb22e84e576) \\n[Security Overview](/kibana/app/dashboards#/view/95479950-41f2-11ea-88fa-7151df485405) \\n[ICS/IoT Security Overview](/kibana/app/dashboards#/view/4a4bde20-4760-11ea-949c-bbb5a9feecbf) \\n[Connections](/kibana/app/dashboards#/view/abdd7550-2c7c-40dc-947e-f6d186a158c4) \\n[Actions and Results](/kibana/app/dashboards#/view/a33e0a50-afcd-11ea-993f-b7d8522a8bed) \\n[Files](/kibana/app/dashboards#/view/9ee51f94-3316-4fc5-bd89-93a52af69714) \\n[Executables](/kibana/app/dashboards#/view/0a490422-0ce9-44bf-9a2d-19329ddde8c3) \\n[Software](/kibana/app/dashboards#/view/87d990cc-9e0b-41e5-b8fe-b10ae1da0c85) \\n[Notices](/kibana/app/dashboards#/view/f1f09567-fc7f-450b-a341-19d2f2bb468b) \\n[Weird](/kibana/app/dashboards#/view/1fff49f6-0199-4a0f-820b-721aff9ff1f1) \\n[Signatures](/kibana/app/dashboards#/view/665d1610-523d-11e9-a30e-e3576242f3ed) \\n[Intel Feeds](/kibana/app/dashboards#/view/36ed695f-edcc-47c1-b0ec-50d20c93ce0f) \\n[↪ Arkime](/sessions) \\n\\n### Common Protocols\\n[DCE/RPC](/kibana/app/dashboards#/view/432af556-c5c0-4cc3-8166-b274b4e3a406) ● [DHCP](/kibana/app/dashboards#/view/2d98bb8e-214c-4374-837b-20e1bcd63a5e) ● [DNS](/kibana/app/dashboards#/view/2cf94cd0-ecab-40a5-95a7-8419f3a39cd9) ● [FTP](/kibana/app/dashboards#/view/078b9aa5-9bd4-4f02-ae5e-cf80fa6f887b) / [TFTP](/kibana/app/dashboards#/view/bf5efbb0-60f1-11eb-9d60-dbf0411cfc48) ● [HTTP](/kibana/app/dashboards#/view/37041ee1-79c0-4684-a436-3173b0e89876) ● [IRC](/kibana/app/dashboards#/view/76f2f912-80da-44cd-ab66-6a73c8344cc3) ● [Kerberos](/kibana/app/dashboards#/view/82da3101-2a9c-4ae2-bb61-d447a3fbe673) ● [LDAP](/kibana/app/dashboards#/view/05e3e000-f118-11e9-acda-83a8e29e1a24) ● [MySQL](/kibana/app/dashboards#/view/50ced171-1b10-4c3f-8b67-2db9635661a6) ● [NTLM](/kibana/app/dashboards#/view/543118a9-02d7-43fe-b669-b8652177fc37) ● [NTP](/kibana/app/dashboards#/view/af5df620-eeb6-11e9-bdef-65a192b7f586) ● [QUIC](/kibana/app/dashboards#/view/11ddd980-e388-11e9-b568-cf17de8e860c) ● [RADIUS](/kibana/app/dashboards#/view/ae79b7d1-4281-4095-b2f6-fa7eafda9970) ● [RDP](/kibana/app/dashboards#/view/7f41913f-cba8-43f5-82a8-241b7ead03e0) ● [RFB](/kibana/app/dashboards#/view/f77bf097-18a8-465c-b634-eb2acc7a4f26) ● [SIP](/kibana/app/dashboards#/view/0b2354ae-0fe9-4fd9-b156-1c3870e5c7aa) ● [SMB](/kibana/app/dashboards#/view/42e831b9-41a9-4f35-8b7d-e1566d368773) ● [SMTP](/kibana/app/dashboards#/view/bb827f8e-639e-468c-93c8-9f5bc132eb8f) ● [SNMP](/kibana/app/dashboards#/view/4e5f106e-c60a-4226-8f64-d534abb912ab) ● [SSH](/kibana/app/dashboards#/view/caef3ade-d289-4d05-a511-149f3e97f238) ● [SSL](/kibana/app/dashboards#/view/7f77b58a-df3e-4cc2-b782-fd7f8bad8ffb) / [X.509 Certificates](/kibana/app/dashboards#/view/024062a6-48d6-498f-a91a-3bf2da3a3cd3) ● [Syslog](/kibana/app/dashboards#/view/92985909-dc29-4533-9e80-d3182a0ecf1d) ● [TDS](/kibana/app/dashboards#/view/bed185a0-ef82-11e9-b38a-2db3ee640e88) / [TDS RPC](/kibana/app/dashboards#/view/32587740-ef88-11e9-b38a-2db3ee640e88) / [TDS SQL](/kibana/app/dashboards#/view/fa141950-ef89-11e9-b38a-2db3ee640e88) ● [Telnet / rlogin / rsh](/kibana/app/dashboards#/view/c2549e10-7f2e-11ea-9f8a-1fe1327e2cd2) ● [Tunnels](/kibana/app/dashboards#/view/11be6381-beef-40a7-bdce-88c5398392fc)\\n\\n### ICS/IoT Protocols\\n[BACnet](/kibana/app/dashboards#/view/2bec1490-eb94-11e9-a384-0fcf32210194) ● [BSAP](/kibana/app/dashboards#/view/ca5799a0-56b5-11eb-b749-576de068f8ad) ● [DNP3](/kibana/app/dashboards#/view/870a5862-6c26-4a08-99fd-0c06cda85ba3) ● [EtherCAT](/kibana/app/dashboards#/view/4a073440-b286-11eb-a4d4-09fa12a6ebd4) ● [EtherNet/IP](/kibana/app/dashboards#/view/29a1b290-eb98-11e9-a384-0fcf32210194) ● [Modbus](/kibana/app/dashboards#/view/152f29dc-51a2-4f53-93e9-6e92765567b8) ● [MQTT](/kibana/app/dashboards#/view/87a32f90-ef58-11e9-974e-9d600036d105) ● [PROFINET](/kibana/app/dashboards#/view/a7514350-eba6-11e9-a384-0fcf32210194) ● [S7comm](/kibana/app/dashboards#/view/e76d05c0-eb9f-11e9-a384-0fcf32210194) ● [Best Guess](/kibana/app/dashboards#/view/12e3a130-d83b-11eb-a0b0-f328ce09b0b7)\",\"type\":\"markdown\",\"fontSize\":10,\"openLinksInNewTab\":false},\"aggs\":[]}",
|
||||
"uiStateJSON": "{}",
|
||||
"description": "",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\"}},\"language\":\"lucene\"},\"filter\":[]}"
|
||||
}
|
||||
},
|
||||
"references": [],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "c4829cb4-ed05-4154-ab6c-9240f0ea0b04",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyMiwxXQ==",
|
||||
"attributes": {
|
||||
"visState": "{\"title\":\"SMB - Log Count Over Time\",\"type\":\"line\",\"params\":{\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{\"text\":\"firstPacket per minute\"}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"mode\":\"normal\",\"type\":\"line\",\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"showCircles\":true,\"interpolate\":\"linear\",\"scale\":\"linear\",\"drawLinesBetweenPoints\":true,\"radiusRatio\":9,\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"firstPacket\",\"interval\":\"auto\",\"min_doc_count\":1,\"extended_bounds\":{}}}],\"listeners\":{}}",
|
||||
"description": "",
|
||||
"title": "SMB - Log Count Over Time",
|
||||
"uiStateJSON": "{}",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "search",
|
||||
"name": "search_0",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "3b82d24e-d3dd-48fa-a539-98a46ccbfd49",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyMywxXQ==",
|
||||
"attributes": {
|
||||
"visState": "{\"title\":\"SMB - Source IP Address\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"srcIp\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":100,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Address\"}}],\"listeners\":{}}",
|
||||
"description": "",
|
||||
"title": "SMB - Source IP Address",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "search",
|
||||
"name": "search_0",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "974779e2-ab49-4fe8-88db-bf5321664f1a",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyNCwxXQ==",
|
||||
"attributes": {
|
||||
"visState": "{\"title\":\"SMB - Destination IP Address\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"dstIp\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":100,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"IP Address\"}}],\"listeners\":{}}",
|
||||
"description": "",
|
||||
"title": "SMB - Destination IP Address",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "search",
|
||||
"name": "search_0",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "3282a033-fff4-41cb-abe6-d896b4a2e03d",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyNSwxXQ==",
|
||||
"attributes": {
|
||||
"title": "SMB - Version",
|
||||
"visState": "{\"title\":\"SMB - Version\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"type\":\"pie\",\"labels\":{\"show\":true,\"values\":false,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"SMB Version\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"zeek.service_version\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"SMB Version\"}}]}",
|
||||
"uiStateJSON": "{\"vis\":{\"legendOpen\":false}}",
|
||||
"description": "",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "search_0",
|
||||
"type": "search",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "02359f84-0114-4d9d-8731-2b6820722e32",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyNiwxXQ==",
|
||||
"attributes": {
|
||||
"visState": "{\"title\":\"SMB - File Path\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_smb_files.path\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":100,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"File Path\"}}],\"listeners\":{}}",
|
||||
"description": "",
|
||||
"title": "SMB - FIle Path",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "search",
|
||||
"name": "search_0",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "c8f1ff18-93e9-4ce9-a188-c947f7dadc05",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyNywxXQ==",
|
||||
"attributes": {
|
||||
"visState": "{\"title\":\"SMB - File Name\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_smb_files.name\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":100,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"File Name\"}}],\"listeners\":{}}",
|
||||
"description": "",
|
||||
"title": "SMB - File Name",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "search",
|
||||
"name": "search_0",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "24b9dbff-7362-4982-9ce7-660001594ff9",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyOCwxXQ==",
|
||||
"attributes": {
|
||||
"visState": "{\"title\":\"SMB - File/Path Summary\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_smb_files.path\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"File Path\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_smb_files.name\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"_term\",\"customLabel\":\"File Name\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek.action\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Action\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"srcIp\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Source IP Address\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"dstIp\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":25,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Destination IP Address\"}}],\"listeners\":{}}",
|
||||
"description": "",
|
||||
"title": "SMB - File/Path Summary",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"desc\"}}}}",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"type": "search",
|
||||
"name": "search_0",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "AWDHDfDkxQT5EBNmq4fQ",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQyOSwxXQ==",
|
||||
"attributes": {
|
||||
"title": "SMB - Log Count",
|
||||
"visState": "{\"title\":\"SMB - Log Count\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":100}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#FB9E00\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":30}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":1,\"format\":{\"id\":\"number\",\"params\":{}}}],\"bucket\":{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}}}},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"zeek.logType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"SMB Log Type\"}}]}",
|
||||
"uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}",
|
||||
"description": "",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "search_0",
|
||||
"type": "search",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "0fa8205d-717f-4385-a031-d15e5f1b6c08",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQzMCwxXQ==",
|
||||
"attributes": {
|
||||
"title": "SMB - Destination Port",
|
||||
"visState": "{\"title\":\"SMB - Destination Port\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"showMetricsAtAllLevels\":false,\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"number\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"dstPort\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination Port\"}}]}",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
||||
"description": "",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "search_0",
|
||||
"type": "search",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "b9aaa580-4e9a-11ea-b504-97aa449f6abc",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQzMSwxXQ==",
|
||||
"attributes": {
|
||||
"title": "SMB - Relevant Notices",
|
||||
"visState": "{\"title\":\"SMB - Relevant Notices\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"-\"}},\"params\":{},\"label\":\"Notice Category\",\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"-\"}},\"params\":{},\"label\":\"Notice Subcategory\",\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"ip\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"-\"}},\"params\":{},\"label\":\"Source IP\",\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"ip\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"1\"}},\"params\":{},\"label\":\"Destination IP\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_notice.category\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Notice Category\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_notice.sub_category\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Notice Subcategory\"}}]}",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"desc\"}}}}",
|
||||
"description": "",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"query\":{\"query\":\"zeek_notice.category:(EternalSafety OR SMB OR ATTACK)\",\"language\":\"lucene\"},\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "search_0",
|
||||
"type": "search",
|
||||
"id": "8f003748-a6f8-4244-9d4e-e38e4a48da4c"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "b74e39c0-49ca-11ea-812f-2bc51df4ea1e",
|
||||
"type": "visualization",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQzMiwxXQ==",
|
||||
"attributes": {
|
||||
"title": "SMB Action",
|
||||
"visState": "{\"title\":\"SMB Action\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"zeek.action: Descending\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}",
|
||||
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}}",
|
||||
"description": "",
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"
|
||||
},
|
||||
"savedSearchRefName": "search_0"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "search_0",
|
||||
"type": "search",
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"visualization": "7.10.0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "e0cefef5-911e-4e38-a1ea-e67c982cb7c7",
|
||||
"type": "search",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:24:26.351Z",
|
||||
"version": "WzQzMywxXQ==",
|
||||
"attributes": {
|
||||
"title": "SMB - Logs",
|
||||
"description": "",
|
||||
"hits": 0,
|
||||
"columns": [
|
||||
"zeek.logType",
|
||||
"srcIp",
|
||||
"dstIp",
|
||||
"dstPort",
|
||||
"zeek.service_version",
|
||||
"zeek.action",
|
||||
"zeek.uid"
|
||||
],
|
||||
"sort": [
|
||||
[
|
||||
"firstPacket",
|
||||
"desc"
|
||||
]
|
||||
],
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"zeek.logType:smb*\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
||||
}
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
||||
"type": "index-pattern",
|
||||
"id": "sessions2-*"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"search": "7.9.3"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "8f003748-a6f8-4244-9d4e-e38e4a48da4c",
|
||||
"type": "search",
|
||||
"namespaces": [
|
||||
"default"
|
||||
],
|
||||
"updated_at": "2021-02-10T21:25:06.578Z",
|
||||
"version": "Wzg0OCwxXQ==",
|
||||
"attributes": {
|
||||
"title": "Notices - Logs",
|
||||
"description": "",
|
||||
"hits": 0,
|
||||
"columns": [
|
||||
"zeek_notice.category",
|
||||
"zeek_notice.sub_category",
|
||||
"zeek_notice.msg",
|
||||
"srcIp",
|
||||
"dstIp",
|
||||
"zeek.uid"
|
||||
],
|
||||
"sort": [
|
||||
[
|
||||
"firstPacket",
|
||||
"desc"
|
||||
]
|
||||
],
|
||||
"version": 1,
|
||||
"kibanaSavedObjectMeta": {
|
||||
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"zeek.logType:notice\",\"default_field\":\"*\"}}},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
||||
}
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
||||
"type": "index-pattern",
|
||||
"id": "sessions2-*"
|
||||
}
|
||||
],
|
||||
"migrationVersion": {
|
||||
"search": "7.9.3"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user