564 lines
39 KiB
JSON
564 lines
39 KiB
JSON
{
|
|
"version": "7.10.0",
|
|
"objects": [
|
|
{
|
|
"id": "29a1b290-eb98-11e9-a384-0fcf32210194",
|
|
"type": "dashboard",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-11T14:51:43.748Z",
|
|
"version": "WzE2NzksMV0=",
|
|
"attributes": {
|
|
"title": "EtherNet/IP",
|
|
"hits": 0,
|
|
"description": "Dashboard for Ethernet/IP and CIP Protocols",
|
|
"panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":37,\"i\":\"1\",\"w\":8,\"x\":0,\"y\":0},\"panelIndex\":\"1\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"2\",\"w\":9,\"x\":8,\"y\":0},\"panelIndex\":\"2\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{\"legendOpen\":false,\"vis\":{\"legendOpen\":true}},\"gridData\":{\"h\":19,\"i\":\"3\",\"w\":31,\"x\":17,\"y\":0},\"panelIndex\":\"3\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":18,\"i\":\"5bbd48d6-a3e7-4b7e-9c1d-9883d519dc76\",\"w\":15,\"x\":8,\"y\":19},\"panelIndex\":\"5bbd48d6-a3e7-4b7e-9c1d-9883d519dc76\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":3,\"direction\":\"desc\"}}}},\"gridData\":{\"h\":18,\"i\":\"a38de599-91bf-4ce0-9ba1-fcdacb57c943\",\"w\":25,\"x\":23,\"y\":19},\"panelIndex\":\"a38de599-91bf-4ce0-9ba1-fcdacb57c943\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}},\"gridData\":{\"h\":19,\"i\":\"a73b04d1-99ec-42e7-858d-5edd5c8ae15a\",\"w\":12,\"x\":11,\"y\":37},\"panelIndex\":\"a73b04d1-99ec-42e7-858d-5edd5c8ae15a\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":1,\"direction\":\"desc\"}}}},\"gridData\":{\"h\":19,\"i\":\"c25cc903-12d2-43af-9841-89bba26a32a9\",\"w\":11,\"x\":0,\"y\":37},\"panelIndex\":\"c25cc903-12d2-43af-9841-89bba26a32a9\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"desc\"}}}},\"gridData\":{\"h\":19,\"i\":\"7ccb6ae1-5068-4a2d-b147-2baa12a7ac92\",\"w\":25,\"x\":23,\"y\":37},\"panelIndex\":\"7ccb6ae1-5068-4a2d-b147-2baa12a7ac92\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{\"params\":{\"sort\":{\"columnIndex\":6,\"direction\":\"asc\"}},\"vis\":{\"params\":{\"sort\":{\"columnIndex\":6,\"direction\":\"desc\"}}}},\"gridData\":{\"h\":16,\"i\":\"dcd19ab8-f6f7-403f-ac14-c02ccc7128fe\",\"w\":24,\"x\":0,\"y\":56},\"panelIndex\":\"dcd19ab8-f6f7-403f-ac14-c02ccc7128fe\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"desc\"}}}},\"gridData\":{\"h\":16,\"i\":\"a66a1ab3-eeaf-4c7b-a56e-b8663be6ab9f\",\"w\":24,\"x\":24,\"y\":56},\"panelIndex\":\"a66a1ab3-eeaf-4c7b-a56e-b8663be6ab9f\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"bb66342b-bad1-4592-b5cf-18fbe68ec1a2\",\"w\":48,\"x\":0,\"y\":72},\"panelIndex\":\"bb66342b-bad1-4592-b5cf-18fbe68ec1a2\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"faa4d891-2c11-4393-acec-cea800f017e7\",\"w\":48,\"x\":0,\"y\":91},\"panelIndex\":\"faa4d891-2c11-4393-acec-cea800f017e7\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"4608eca0-796d-4482-b62a-887c799e423f\",\"w\":48,\"x\":0,\"y\":104},\"panelIndex\":\"4608eca0-796d-4482-b62a-887c799e423f\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"9d193b0a-a8d1-48ad-88cc-16a325686f91\",\"w\":48,\"x\":0,\"y\":120},\"panelIndex\":\"9d193b0a-a8d1-48ad-88cc-16a325686f91\",\"version\":\"7.10.0\",\"panelRefName\":\"panel_13\"}]",
|
|
"optionsJSON": "{\"useMargins\":true}",
|
|
"version": 1,
|
|
"timeRestore": false,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"*\"},\"filter\":[]}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "panel_0",
|
|
"type": "visualization",
|
|
"id": "df9e399b-efa5-4e33-b0ac-a7668a8ac2b3"
|
|
},
|
|
{
|
|
"name": "panel_1",
|
|
"type": "visualization",
|
|
"id": "b2548270-eb98-11e9-a384-0fcf32210194"
|
|
},
|
|
{
|
|
"name": "panel_2",
|
|
"type": "visualization",
|
|
"id": "3c2b11d0-eb99-11e9-a384-0fcf32210194"
|
|
},
|
|
{
|
|
"name": "panel_3",
|
|
"type": "visualization",
|
|
"id": "c3b30a40-5682-11eb-a702-bff6ecd13bea"
|
|
},
|
|
{
|
|
"name": "panel_4",
|
|
"type": "visualization",
|
|
"id": "fa86bb10-cab0-11ea-84cd-4f7b1f416f80"
|
|
},
|
|
{
|
|
"name": "panel_5",
|
|
"type": "visualization",
|
|
"id": "4ce6e380-cab6-11ea-84cd-4f7b1f416f80"
|
|
},
|
|
{
|
|
"name": "panel_6",
|
|
"type": "visualization",
|
|
"id": "378fefe0-cab6-11ea-84cd-4f7b1f416f80"
|
|
},
|
|
{
|
|
"name": "panel_7",
|
|
"type": "visualization",
|
|
"id": "5f626310-ca96-11ea-8578-f3ff6bdd82b2"
|
|
},
|
|
{
|
|
"name": "panel_8",
|
|
"type": "visualization",
|
|
"id": "3612d370-cb7f-11ea-b8b9-778c41cae039"
|
|
},
|
|
{
|
|
"name": "panel_9",
|
|
"type": "visualization",
|
|
"id": "6f73cf80-cb7e-11ea-b8b9-778c41cae039"
|
|
},
|
|
{
|
|
"name": "panel_10",
|
|
"type": "search",
|
|
"id": "ca878ac0-c790-11ea-8578-f3ff6bdd82b2"
|
|
},
|
|
{
|
|
"name": "panel_11",
|
|
"type": "search",
|
|
"id": "f75bfb80-c790-11ea-8578-f3ff6bdd82b2"
|
|
},
|
|
{
|
|
"name": "panel_12",
|
|
"type": "search",
|
|
"id": "972f9f00-c790-11ea-8578-f3ff6bdd82b2"
|
|
},
|
|
{
|
|
"name": "panel_13",
|
|
"type": "search",
|
|
"id": "a2d6d220-caaa-11ea-84cd-4f7b1f416f80"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"dashboard": "7.9.3"
|
|
}
|
|
},
|
|
{
|
|
"id": "df9e399b-efa5-4e33-b0ac-a7668a8ac2b3",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:25:09.616Z",
|
|
"version": "Wzg3MiwxXQ==",
|
|
"attributes": {
|
|
"title": "Zeek Logs",
|
|
"visState": "{\"title\":\"Zeek Logs\",\"type\":\"markdown\",\"params\":{\"markdown\":\"### General\\n[Overview](/kibana/app/dashboards#/view/0ad3d7c2-3441-485e-9dfe-dbb22e84e576) \\n[Security Overview](/kibana/app/dashboards#/view/95479950-41f2-11ea-88fa-7151df485405) \\n[ICS/IoT Security Overview](/kibana/app/dashboards#/view/4a4bde20-4760-11ea-949c-bbb5a9feecbf) \\n[Connections](/kibana/app/dashboards#/view/abdd7550-2c7c-40dc-947e-f6d186a158c4) \\n[Actions and Results](/kibana/app/dashboards#/view/a33e0a50-afcd-11ea-993f-b7d8522a8bed) \\n[Files](/kibana/app/dashboards#/view/9ee51f94-3316-4fc5-bd89-93a52af69714) \\n[Executables](/kibana/app/dashboards#/view/0a490422-0ce9-44bf-9a2d-19329ddde8c3) \\n[Software](/kibana/app/dashboards#/view/87d990cc-9e0b-41e5-b8fe-b10ae1da0c85) \\n[Notices](/kibana/app/dashboards#/view/f1f09567-fc7f-450b-a341-19d2f2bb468b) \\n[Weird](/kibana/app/dashboards#/view/1fff49f6-0199-4a0f-820b-721aff9ff1f1) \\n[Signatures](/kibana/app/dashboards#/view/665d1610-523d-11e9-a30e-e3576242f3ed) \\n[Intel Feeds](/kibana/app/dashboards#/view/36ed695f-edcc-47c1-b0ec-50d20c93ce0f) \\n[↪ Arkime](/sessions) \\n\\n### Common Protocols\\n[DCE/RPC](/kibana/app/dashboards#/view/432af556-c5c0-4cc3-8166-b274b4e3a406) ● [DHCP](/kibana/app/dashboards#/view/2d98bb8e-214c-4374-837b-20e1bcd63a5e) ● [DNS](/kibana/app/dashboards#/view/2cf94cd0-ecab-40a5-95a7-8419f3a39cd9) ● [FTP](/kibana/app/dashboards#/view/078b9aa5-9bd4-4f02-ae5e-cf80fa6f887b) / [TFTP](/kibana/app/dashboards#/view/bf5efbb0-60f1-11eb-9d60-dbf0411cfc48) ● [HTTP](/kibana/app/dashboards#/view/37041ee1-79c0-4684-a436-3173b0e89876) ● [IRC](/kibana/app/dashboards#/view/76f2f912-80da-44cd-ab66-6a73c8344cc3) ● [Kerberos](/kibana/app/dashboards#/view/82da3101-2a9c-4ae2-bb61-d447a3fbe673) ● [LDAP](/kibana/app/dashboards#/view/05e3e000-f118-11e9-acda-83a8e29e1a24) ● [MySQL](/kibana/app/dashboards#/view/50ced171-1b10-4c3f-8b67-2db9635661a6) ● [NTLM](/kibana/app/dashboards#/view/543118a9-02d7-43fe-b669-b8652177fc37) ● [NTP](/kibana/app/dashboards#/view/af5df620-eeb6-11e9-bdef-65a192b7f586) ● [QUIC](/kibana/app/dashboards#/view/11ddd980-e388-11e9-b568-cf17de8e860c) ● [RADIUS](/kibana/app/dashboards#/view/ae79b7d1-4281-4095-b2f6-fa7eafda9970) ● [RDP](/kibana/app/dashboards#/view/7f41913f-cba8-43f5-82a8-241b7ead03e0) ● [RFB](/kibana/app/dashboards#/view/f77bf097-18a8-465c-b634-eb2acc7a4f26) ● [SIP](/kibana/app/dashboards#/view/0b2354ae-0fe9-4fd9-b156-1c3870e5c7aa) ● [SMB](/kibana/app/dashboards#/view/42e831b9-41a9-4f35-8b7d-e1566d368773) ● [SMTP](/kibana/app/dashboards#/view/bb827f8e-639e-468c-93c8-9f5bc132eb8f) ● [SNMP](/kibana/app/dashboards#/view/4e5f106e-c60a-4226-8f64-d534abb912ab) ● [SSH](/kibana/app/dashboards#/view/caef3ade-d289-4d05-a511-149f3e97f238) ● [SSL](/kibana/app/dashboards#/view/7f77b58a-df3e-4cc2-b782-fd7f8bad8ffb) / [X.509 Certificates](/kibana/app/dashboards#/view/024062a6-48d6-498f-a91a-3bf2da3a3cd3) ● [Syslog](/kibana/app/dashboards#/view/92985909-dc29-4533-9e80-d3182a0ecf1d) ● [TDS](/kibana/app/dashboards#/view/bed185a0-ef82-11e9-b38a-2db3ee640e88) / [TDS RPC](/kibana/app/dashboards#/view/32587740-ef88-11e9-b38a-2db3ee640e88) / [TDS SQL](/kibana/app/dashboards#/view/fa141950-ef89-11e9-b38a-2db3ee640e88) ● [Telnet / rlogin / rsh](/kibana/app/dashboards#/view/c2549e10-7f2e-11ea-9f8a-1fe1327e2cd2) ● [Tunnels](/kibana/app/dashboards#/view/11be6381-beef-40a7-bdce-88c5398392fc)\\n\\n### ICS/IoT Protocols\\n[BACnet](/kibana/app/dashboards#/view/2bec1490-eb94-11e9-a384-0fcf32210194) ● [BSAP](/kibana/app/dashboards#/view/ca5799a0-56b5-11eb-b749-576de068f8ad) ● [DNP3](/kibana/app/dashboards#/view/870a5862-6c26-4a08-99fd-0c06cda85ba3) ● [EtherCAT](/kibana/app/dashboards#/view/4a073440-b286-11eb-a4d4-09fa12a6ebd4) ● [EtherNet/IP](/kibana/app/dashboards#/view/29a1b290-eb98-11e9-a384-0fcf32210194) ● [Modbus](/kibana/app/dashboards#/view/152f29dc-51a2-4f53-93e9-6e92765567b8) ● [MQTT](/kibana/app/dashboards#/view/87a32f90-ef58-11e9-974e-9d600036d105) ● [PROFINET](/kibana/app/dashboards#/view/a7514350-eba6-11e9-a384-0fcf32210194) ● [S7comm](/kibana/app/dashboards#/view/e76d05c0-eb9f-11e9-a384-0fcf32210194) ● [Best Guess](/kibana/app/dashboards#/view/12e3a130-d83b-11eb-a0b0-f328ce09b0b7)\",\"type\":\"markdown\",\"fontSize\":10,\"openLinksInNewTab\":false},\"aggs\":[]}",
|
|
"uiStateJSON": "{}",
|
|
"description": "",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\"}},\"language\":\"lucene\"},\"filter\":[]}"
|
|
}
|
|
},
|
|
"references": [],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "b2548270-eb98-11e9-a384-0fcf32210194",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2MiwxXQ==",
|
|
"attributes": {
|
|
"title": "EtherNet/IP - Log Count",
|
|
"visState": "{\"title\":\"EtherNet/IP - Log Count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":36}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Log Count\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"zeek.logType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Log Type\"}}]}",
|
|
"uiStateJSON": "{}",
|
|
"description": "",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"query\":{\"query\":\"zeek.logType:(enip* OR cip*)\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "3c2b11d0-eb99-11e9-a384-0fcf32210194",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2MywxXQ==",
|
|
"attributes": {
|
|
"title": "EtherNet/IP - Logs Over Time",
|
|
"visState": "{\"title\":\"EtherNet/IP - Logs Over Time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"square root\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":false},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY\"}},\"params\":{\"date\":true,\"interval\":\"P365D\",\"intervalESValue\":365,\"intervalESUnit\":\"d\",\"format\":\"YYYY\",\"bounds\":{\"min\":\"1971-01-14T16:48:06.557Z\",\"max\":\"2021-01-14T16:48:06.557Z\"}},\"label\":\"firstPacket per 365 days\",\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"drilldown\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"Log Type\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"firstPacket\",\"timeRange\":{\"from\":\"now-50y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"scaleMetricValues\":false,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"zeek.logType\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Log Type\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"legendOpen\":true}}",
|
|
"description": "",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"query\":{\"query\":\"zeek.logType:(enip* OR cip*)\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "c3b30a40-5682-11eb-a702-bff6ecd13bea",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2NCwxXQ==",
|
|
"attributes": {
|
|
"title": "Ethernet/IP - Commands",
|
|
"visState": "{\"title\":\"Ethernet/IP - Commands\",\"type\":\"horizontal_bar\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":200},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"square root\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":75,\"filter\":true,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"lineWidth\":2,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false,\"labels\":{},\"thresholdLine\":{\"show\":false,\"value\":10,\"width\":1,\"style\":\"full\",\"color\":\"#E7664C\"},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"drilldown\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"\"}},\"params\":{},\"label\":\"Command\",\"aggType\":\"terms\"},\"y\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"zeek_enip.enip_command\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"\",\"customLabel\":\"Command\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"legendOpen\":false}}",
|
|
"description": "",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{}"
|
|
},
|
|
"savedSearchRefName": "search_0"
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "search_0",
|
|
"type": "search",
|
|
"id": "972f9f00-c790-11ea-8578-f3ff6bdd82b2"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "fa86bb10-cab0-11ea-84cd-4f7b1f416f80",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2NSwxXQ==",
|
|
"attributes": {
|
|
"title": "CIP - Services",
|
|
"visState": "{\"title\":\"CIP - Services\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"drilldown\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"Request/Response\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.cip_service\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":500,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"CIP Service\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.cip_status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Status\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.direction\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Request/Response\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
|
"description": "CIP Services and Status",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{}"
|
|
},
|
|
"savedSearchRefName": "search_0"
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "search_0",
|
|
"type": "search",
|
|
"id": "ca878ac0-c790-11ea-8578-f3ff6bdd82b2"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "4ce6e380-cab6-11ea-84cd-4f7b1f416f80",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2NiwxXQ==",
|
|
"attributes": {
|
|
"title": "EtherNet/IP - Destination IP",
|
|
"visState": "{\"title\":\"EtherNet/IP - Destination IP\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"drilldown\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"Source IP\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"dstIp\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination IP\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
|
"description": "",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"query\":{\"query\":\"zeek.logType:(\\\"enip\\\" OR \\\"cip\\\" OR \\\"cip_io\\\")\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "378fefe0-cab6-11ea-84cd-4f7b1f416f80",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2NywxXQ==",
|
|
"attributes": {
|
|
"title": "EtherNet/IP - Source IP",
|
|
"visState": "{\"title\":\"EtherNet/IP - Source IP\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"srcIp\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source IP\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
|
"description": "",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"query\":{\"query\":\"zeek.logType:(\\\"enip\\\" OR \\\"cip\\\" OR \\\"cip_io\\\")\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "5f626310-ca96-11ea-8578-f3ff6bdd82b2",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2OCwxXQ==",
|
|
"attributes": {
|
|
"title": "EtherNet/IP - Detailed Information",
|
|
"visState": "{\"title\":\"EtherNet/IP - Detailed Information\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"drilldown\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"label\":\"Data Length\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_enip.session_handle\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":500,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Session Identifier\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_enip.sender_context\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Sender Context\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_enip.enip_command\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"EtherNet/IP Command\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_enip.length\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Data Length\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_enip.enip_status\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Status\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
|
"description": "Includes: Session Identifier, Sender Context, EtherNet/IP Command, Data Length, and Status",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{}"
|
|
},
|
|
"savedSearchRefName": "search_0"
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "search_0",
|
|
"type": "search",
|
|
"id": "972f9f00-c790-11ea-8578-f3ff6bdd82b2"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "3612d370-cb7f-11ea-b8b9-778c41cae039",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI2OSwxXQ==",
|
|
"attributes": {
|
|
"title": "CIP - Request Path",
|
|
"visState": "{\"title\":\"CIP - Request Path\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":5,\"direction\":\"desc\"},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"drilldown\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"-\"}},\"params\":{},\"label\":\"Data ID\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.class_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Class ID\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.class_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Class Name\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.instance_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Instance ID\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.attribute_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Attribute ID\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.data_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Data ID\"}},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip.other_id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Other ID\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":5,\"direction\":\"desc\"}}}}",
|
|
"description": "CIP Request Path data",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{}"
|
|
},
|
|
"savedSearchRefName": "search_0"
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "search_0",
|
|
"type": "search",
|
|
"id": "ca878ac0-c790-11ea-8578-f3ff6bdd82b2"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "6f73cf80-cb7e-11ea-b8b9-778c41cae039",
|
|
"type": "visualization",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI3MCwxXQ==",
|
|
"attributes": {
|
|
"title": "CIP - Device Identity",
|
|
"visState": "{\"title\":\"CIP - Device Identity\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"label\":\"Count\",\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"drilldown\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"N/A\"}},\"params\":{},\"label\":\"Serial Number\",\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip_identity.product_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"N/A\",\"customLabel\":\"Product Name\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip_identity.device_type_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"N/A\",\"customLabel\":\"Device Type\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip_identity.vendor_name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"N/A\",\"customLabel\":\"Vendor Name\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip_identity.serial_number\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"N/A\",\"customLabel\":\"Serial Number\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"zeek_cip_identity.revision\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":200,\"otherBucket\":true,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"N/A\",\"customLabel\":\"Revision Number\"}}]}",
|
|
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
|
|
"description": "CIP Identity Results",
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{}"
|
|
},
|
|
"savedSearchRefName": "search_0"
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "search_0",
|
|
"type": "search",
|
|
"id": "f75bfb80-c790-11ea-8578-f3ff6bdd82b2"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"visualization": "7.10.0"
|
|
}
|
|
},
|
|
{
|
|
"id": "ca878ac0-c790-11ea-8578-f3ff6bdd82b2",
|
|
"type": "search",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI3MSwxXQ==",
|
|
"attributes": {
|
|
"title": "CIP - Logs",
|
|
"description": "",
|
|
"hits": 0,
|
|
"columns": [
|
|
"srcIp",
|
|
"dstIp",
|
|
"zeek_cip.cip_service",
|
|
"zeek_cip.cip_status",
|
|
"zeek_cip.direction",
|
|
"zeek_cip.cip_sequence_count",
|
|
"zeek_cip.class_id",
|
|
"zeek_cip.class_name",
|
|
"zeek_cip.instance_id"
|
|
],
|
|
"sort": [
|
|
[
|
|
"firstPacket",
|
|
"desc"
|
|
]
|
|
],
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"filter\":[],\"query\":{\"query\":\"zeek.logType:cip\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"search": "7.9.3"
|
|
}
|
|
},
|
|
{
|
|
"id": "f75bfb80-c790-11ea-8578-f3ff6bdd82b2",
|
|
"type": "search",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI3MiwxXQ==",
|
|
"attributes": {
|
|
"title": "CIP - Identity Logs",
|
|
"description": "",
|
|
"hits": 0,
|
|
"columns": [
|
|
"srcIp",
|
|
"dstIp",
|
|
"zeek_cip_identity.device_type_name",
|
|
"zeek_cip_identity.product_name",
|
|
"zeek_cip_identity.vendor_name",
|
|
"zeek_cip_identity.revision",
|
|
"zeek_cip_identity.serial_number"
|
|
],
|
|
"sort": [
|
|
[
|
|
"firstPacket",
|
|
"desc"
|
|
]
|
|
],
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"filter\":[],\"query\":{\"query\":\"zeek.logType:cip_identity\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"search": "7.9.3"
|
|
}
|
|
},
|
|
{
|
|
"id": "972f9f00-c790-11ea-8578-f3ff6bdd82b2",
|
|
"type": "search",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI3MywxXQ==",
|
|
"attributes": {
|
|
"title": "Ethernet/IP - Logs",
|
|
"description": "",
|
|
"hits": 0,
|
|
"columns": [
|
|
"srcIp",
|
|
"dstIp",
|
|
"zeek_enip.enip_command",
|
|
"zeek_enip.enip_status",
|
|
"zeek_enip.options",
|
|
"zeek_enip.sender_context",
|
|
"zeek_enip.session_handle",
|
|
"zeek.uid"
|
|
],
|
|
"sort": [
|
|
[
|
|
"firstPacket",
|
|
"desc"
|
|
]
|
|
],
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"filter\":[],\"query\":{\"query\":\"zeek.logType:enip\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"search": "7.9.3"
|
|
}
|
|
},
|
|
{
|
|
"id": "a2d6d220-caaa-11ea-84cd-4f7b1f416f80",
|
|
"type": "search",
|
|
"namespaces": [
|
|
"default"
|
|
],
|
|
"updated_at": "2021-02-10T21:24:18.060Z",
|
|
"version": "WzI3NCwxXQ==",
|
|
"attributes": {
|
|
"title": "CIP - IO Logs",
|
|
"description": "",
|
|
"hits": 0,
|
|
"columns": [
|
|
"srcIp",
|
|
"dstIp",
|
|
"zeek_cip_io.connection_id",
|
|
"zeek_cip_io.sequence_number",
|
|
"zeek_cip_io.data_length",
|
|
"zeek.uid"
|
|
],
|
|
"sort": [
|
|
[
|
|
"firstPacket",
|
|
"desc"
|
|
]
|
|
],
|
|
"version": 1,
|
|
"kibanaSavedObjectMeta": {
|
|
"searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"filter\":[],\"query\":{\"query\":\"zeek.logType:cip_io\",\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
|
|
}
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
|
|
"type": "index-pattern",
|
|
"id": "sessions2-*"
|
|
}
|
|
],
|
|
"migrationVersion": {
|
|
"search": "7.9.3"
|
|
}
|
|
}
|
|
]
|
|
} |