69 lines
3.0 KiB
JSON
69 lines
3.0 KiB
JSON
{
|
|
"doc": {
|
|
"enabled": true,
|
|
"createEnabled": true,
|
|
"webEnabled": true,
|
|
"headerAuthEnabled": true,
|
|
"emailSearch": true,
|
|
"removeEnabled": true,
|
|
"packetSearch": true,
|
|
"hideStats": false,
|
|
"hideFiles": false,
|
|
"hidePcap": false,
|
|
"disablePcapDownload": false,
|
|
"settings": {
|
|
"timezone": "local",
|
|
"detailFormat": "last",
|
|
"showTimestamps": "last",
|
|
"sortColumn": "start",
|
|
"sortDirection": "desc",
|
|
"spiGraph": "protocol",
|
|
"connSrcField": "srcIp",
|
|
"connDstField": "dstIp",
|
|
"numPackets": "last",
|
|
"theme" : "custom1: #222222,#E2E2E2,#FFFFFF,#00789E,#004A79,#017D73,#092B40,#42b7c5,#2A7580,#ecb30a,#333333,#89ADCC,#6D6D6D,#FFE7E7,#ECFEFF",
|
|
"manualQuery": false
|
|
},
|
|
"views": {
|
|
"Public IP Addresses": {
|
|
"expression": "(country.dst == EXISTS!) || (country.src == EXISTS!) || (ip.dst == EXISTS! && ip.dst != 0.0.0.0/8 && ip.dst != 10.0.0.0/8 && ip.dst != 100.64.0.0/10 && ip.dst != 127.0.0.0/8 && ip.dst != 169.254.0.0/16 && ip.dst != 172.16.0.0/12 && ip.dst != 192.0.0.0/24 && ip.dst != 192.0.2.0/24 && ip.dst != 192.88.99.0/24 && ip.dst != 192.168.0.0/16 && ip.dst != 198.18.0.0/15 && ip.dst != 198.51.100.0/24 && ip.dst != 203.0.113.0/24 && ip.dst != 224.0.0.0/4 && ip.dst != 232.0.0.0/8 && ip.dst != 233.0.0.0/8 && ip.dst != 234.0.0.0/8 && ip.dst != 239.0.0.0/8 && ip.dst != 240.0.0.0/4 && ip.dst != 255.255.255.255 && ip.dst != :: && ip.dst != ::1 && ip.dst != ff00::/8 && ip.dst != fe80::/10 && ip.dst != fc00::/7 && ip.dst != fd00::/8) || (ip.src == EXISTS! && ip.src != 0.0.0.0/8 && ip.src != 10.0.0.0/8 && ip.src != 100.64.0.0/10 && ip.src != 127.0.0.0/8 && ip.src != 169.254.0.0/16 && ip.src != 172.16.0.0/12 && ip.src != 192.0.0.0/24 && ip.src != 192.0.2.0/24 && ip.src != 192.88.99.0/24 && ip.src != 192.168.0.0/16 && ip.src != 198.18.0.0/15 && ip.src != 198.51.100.0/24 && ip.src != 203.0.113.0/24 && ip.src != 224.0.0.0/4 && ip.src != 232.0.0.0/8 && ip.src != 233.0.0.0/8 && ip.src != 234.0.0.0/8 && ip.src != 239.0.0.0/8 && ip.src != 240.0.0.0/4 && ip.src != 255.255.255.255 && ip.src != :: && ip.src != ::1 && ip.src != ff00::/8 && ip.src != fe80::/10 && ip.src != fc00::/7 && ip.src != fd00::/8)"
|
|
},
|
|
"PCAP Files": {
|
|
"expression": "zeek.logType != EXISTS!"
|
|
},
|
|
"Zeek Logs": {
|
|
"expression": "zeek.logType == EXISTS!"
|
|
},
|
|
"Zeek conn.log": {
|
|
"expression": "zeek.logType == conn"
|
|
},
|
|
"Zeek Exclude conn.log": {
|
|
"expression": "zeek.logType == EXISTS! && zeek.logType != conn"
|
|
}
|
|
},
|
|
"tableStates": {
|
|
"sessionsNew": {
|
|
"order": [
|
|
[
|
|
"firstPacket",
|
|
"desc"
|
|
]
|
|
],
|
|
"visibleHeaders": [
|
|
"protocol",
|
|
"zeek.logType",
|
|
"firstPacket",
|
|
"lastPacket",
|
|
"src",
|
|
"srcPort",
|
|
"dst",
|
|
"dstPort",
|
|
"totPackets",
|
|
"dbby",
|
|
"tags",
|
|
"info"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
} |