diff --git a/packages/corelight/changelog.yml b/packages/corelight/changelog.yml index 25f3c56905f..089c5dbd005 100644 --- a/packages/corelight/changelog.yml +++ b/packages/corelight/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.2.0" + changes: + - description: Support aggregation logs in the data explorer dashboards. + type: enhancement + link: https://github.com/elastic/integrations/pull/20283 - version: "1.1.0" changes: - description: Add AWS VPC Flow dashboard. diff --git a/packages/corelight/img/asset-classification.png b/packages/corelight/img/asset-classification.png new file mode 100644 index 00000000000..87a2fe82d4c Binary files /dev/null and b/packages/corelight/img/asset-classification.png differ diff --git a/packages/corelight/img/connections.png b/packages/corelight/img/connections.png index e64af976bb4..10037473977 100644 Binary files a/packages/corelight/img/connections.png and b/packages/corelight/img/connections.png differ diff --git a/packages/corelight/img/dns.png b/packages/corelight/img/dns.png index b28bb710a2f..d6686189f71 100644 Binary files a/packages/corelight/img/dns.png and b/packages/corelight/img/dns.png differ diff --git a/packages/corelight/img/files.png b/packages/corelight/img/files.png index a7d694e14d8..2bbdfe4b3e8 100644 Binary files a/packages/corelight/img/files.png and b/packages/corelight/img/files.png differ diff --git a/packages/corelight/img/http.png b/packages/corelight/img/http.png index bef45f40394..86734864a4d 100644 Binary files a/packages/corelight/img/http.png and b/packages/corelight/img/http.png differ diff --git a/packages/corelight/img/software.png b/packages/corelight/img/software.png index 42b018c1210..cf0bcd8f374 100644 Binary files a/packages/corelight/img/software.png and b/packages/corelight/img/software.png differ diff --git a/packages/corelight/img/ssl-and-x509.png b/packages/corelight/img/ssl-and-x509.png index 95622c9811c..2ab6db7db6e 100644 Binary files a/packages/corelight/img/ssl-and-x509.png and b/packages/corelight/img/ssl-and-x509.png differ diff --git a/packages/corelight/kibana/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce.json b/packages/corelight/kibana/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce.json index 60ff117eb44..a644cc9f1df 100644 --- a/packages/corelight/kibana/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce.json +++ b/packages/corelight/kibana/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "15c3dcbc-d25f-44e9-a9ad-7b773eaa0a8e", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -31,6 +32,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "vpn.inferences", + "id": "7d61094e-24f9-42db-8d54-acd2e006aea4", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -48,6 +50,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "vpn.name", + "id": "f4bcd288-056d-4cbf-abb7-7d3c327845af", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -206,7 +209,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - **VPN Insights**\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - **VPN Insights**\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -1503,11 +1506,7 @@ { "embeddableConfig": { "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 10 }, "gridData": { @@ -1525,10 +1524,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] VPN Insights", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:06.193Z", "id": "corelight-023162b6-94da-4d8d-b1f6-de6192356cce", "references": [ { @@ -1556,11 +1555,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[4].meta.index", "type": "index-pattern" }, - { - "id": "corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef", - "name": "7c6146fc-0124-4600-ae05-74789072e669:panel_7c6146fc-0124-4600-ae05-74789072e669", - "type": "search" - }, { "id": "logs-*", "name": "241315f2-1624-4910-a79a-4be4628aba8a:indexpattern-datasource-layer-50f85297-0e80-4346-8a62-e12782abfa6b", @@ -1591,6 +1585,11 @@ "name": "8600f87d-c2ea-41a2-b50d-e494e96beee3:indexpattern-datasource-layer-03c121a4-0295-4ca7-aff1-e30f25a83774", "type": "index-pattern" }, + { + "id": "corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef", + "name": "7c6146fc-0124-4600-ae05-74789072e669:panel_7c6146fc-0124-4600-ae05-74789072e669", + "type": "search" + }, { "id": "logs-*", "name": "controlGroup_15c3dcbc-d25f-44e9-a9ad-7b773eaa0a8e:optionsListDataView", @@ -1605,33 +1604,9 @@ "id": "logs-*", "name": "controlGroup_7d61094e-24f9-42db-8d54-acd2e006aea4:optionsListDataView", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[4].meta.index", - "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9.json b/packages/corelight/kibana/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9.json index db472322ed6..2c2323a6105 100644 --- a/packages/corelight/kibana/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9.json +++ b/packages/corelight/kibana/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "3d267d03-1066-487a-b6c9-ffdcae1941d2", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -32,6 +33,7 @@ "dataViewId": "logs-*", "existsSelected": false, "fieldName": "file.mime_type", + "id": "aa496d39-ac08-41a0-837b-8fccce345bb9", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -79,20 +81,38 @@ "store": "appState" }, "meta": { - "alias": null, + "alias": "event.dataset: files*", "disabled": false, - "field": "event.dataset", "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "event.dataset", + "key": "query", "negate": false, + "type": "custom" + }, + "query": { + "wildcard": { + "event.dataset": "files*" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Aggregation", + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "event.dataset", + "negate": true, "params": { - "query": "files" + "query": "files_agg" }, "type": "phrase" }, "query": { "match_phrase": { - "event.dataset": "files" + "event.dataset": "files_agg" } } } @@ -133,7 +153,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - **Files**\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - **Files**\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -142,7 +162,7 @@ } }, "gridData": { - "h": 36, + "h": 37, "i": "eeaac2aa-7781-425d-8d40-ca07aec4e833", "w": 11, "x": 0, @@ -185,9 +205,9 @@ } }, "gridData": { - "h": 4, + "h": 5, "i": "7cd7bcee-1a07-434b-8729-38270c86442b", - "w": 37, + "w": 28, "x": 11, "y": 0 }, @@ -195,13 +215,97 @@ "title": "", "type": "visualization" }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "timeField": "@timestamp", + "title": "logs-corelight.*" + } + ], + "layers": { + "dbe5d6dc-1339-4577-97b8-0f96db9fae3d": { + "columns": [ + { + "columnId": "Files Aggregation", + "fieldName": "Files Aggregation", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "query": { + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset == \"files_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `Files Aggregation` = CASE(count \u003e 0, \"Files Agg Logs Available\", \"No Files Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `Files Aggregation`, status" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset == \"files_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `Files Aggregation` = CASE(count \u003e 0, \"Files Agg Logs Available\", \"No Files Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `Files Aggregation`, status" + }, + "visualization": { + "columns": [ + { + "columnId": "Files Aggregation" + } + ], + "layerId": "dbe5d6dc-1339-4577-97b8-0f96db9fae3d", + "layerType": "data" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 5, + "i": "70d061fb-aeab-4a2b-9b20-20b21474b02b", + "w": 9, + "x": 39, + "y": 0 + }, + "panelIndex": "70d061fb-aeab-4a2b-9b20-20b21474b02b", + "title": "DNS Aggregation", + "type": "lens" + }, { "embeddableConfig": { "attributes": { "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-82ef7ce8-74e4-42a0-af0b-aeb2e348a234", + "name": "indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" } ], @@ -211,31 +315,13 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "82ef7ce8-74e4-42a0-af0b-aeb2e348a234": { + "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082": { "columnOrder": [ - "8d47a011-22ac-446e-9a54-0a06c551c7c5", - "8ba7e98c-4ccd-4c54-94af-577a27e0f6e6" + "0471bd47-b6e9-491e-8e5c-61bea9e23105", + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "columns": { - "8ba7e98c-4ccd-4c54-94af-577a27e0f6e6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "8d47a011-22ac-446e-9a54-0a06c551c7c5": { + "0471bd47-b6e9-491e-8e5c-61bea9e23105": { "customLabel": true, "dataType": "string", "isBucketed": true, @@ -248,7 +334,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "8ba7e98c-4ccd-4c54-94af-577a27e0f6e6", + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d", "type": "column" }, "orderDirection": "desc", @@ -256,10 +342,28 @@ "parentFormat": { "id": "terms" }, - "size": 20 + "size": 10 }, "scale": "ordinal", "sourceField": "file.mime_type" + }, + "3eb07058-2192-42ab-b3b8-d9bfee65b63d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" } }, "ignoreGlobalFilters": false, @@ -277,94 +381,6 @@ } }, "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "b5bdfd46-0352-4308-b594-75f9b1dc0bc9", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, { "$state": { "store": "appState" @@ -372,18 +388,16 @@ "meta": { "alias": null, "disabled": false, - "field": "file.mime_type", - "index": "f7619cff-3f07-439b-bb70-086277623759", - "key": "file.mime_type", - "negate": true, - "params": { - "query": "application/pkix-cert" - }, - "type": "phrase" + "field": "observer.hostname", + "index": "dd2393e5-874b-4454-be7c-f27ec99baf00", + "key": "observer.hostname", + "negate": false, + "type": "exists", + "value": "exists" }, "query": { - "match_phrase": { - "file.mime_type": "application/pkix-cert" + "exists": { + "field": "observer.hostname" } } }, @@ -394,15 +408,16 @@ "meta": { "alias": null, "disabled": false, - "field": "observer.hostname", - "index": "4901d4e1-cc78-4ac2-947a-3fb128dd1a81", - "key": "observer.hostname", + "field": "file.mime_type", + "index": "01fc0e5e-c2f8-44c5-9f02-a5956e49c616", + "key": "file.mime_type", "negate": false, - "type": "exists" + "type": "exists", + "value": "exists" }, "query": { "exists": { - "field": "observer.hostname" + "field": "file.mime_type" } } }, @@ -414,14 +429,17 @@ "alias": null, "disabled": false, "field": "file.mime_type", - "index": "60ee415e-28fa-48dc-bdd1-143f8219a014", + "index": "b4f0bbdc-64ab-44fd-9003-4f2fc3029fd5", "key": "file.mime_type", - "negate": false, - "type": "exists" + "negate": true, + "params": { + "query": "application/pkix-cert" + }, + "type": "phrase" }, "query": { - "exists": { - "field": "file.mime_type" + "match_phrase": { + "file.mime_type": "application/pkix-cert" } } } @@ -435,7 +453,7 @@ "layers": [ { "accessors": [ - "8ba7e98c-4ccd-4c54-94af-577a27e0f6e6" + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "colorMapping": { "assignments": [], @@ -455,12 +473,12 @@ } ] }, - "layerId": "82ef7ce8-74e4-42a0-af0b-aeb2e348a234", + "layerId": "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "layerType": "data", "position": "top", - "seriesType": "bar_horizontal", + "seriesType": "bar_horizontal_stacked", "showGridlines": false, - "xAccessor": "8d47a011-22ac-446e-9a54-0a06c551c7c5" + "xAccessor": "0471bd47-b6e9-491e-8e5c-61bea9e23105" } ], "legend": { @@ -469,7 +487,7 @@ "shouldTruncate": false, "showSingleSeries": false }, - "preferredSeriesType": "bar", + "preferredSeriesType": "bar_stacked", "title": "Empty XY chart", "valueLabels": "hide" } @@ -478,178 +496,17 @@ "type": "lens", "visualizationType": "lnsXY" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "b5bdfd46-0352-4308-b594-75f9b1dc0bc9", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "f7619cff-3f07-439b-bb70-086277623759", - "key": "file.mime_type", - "negate": true, - "params": { - "query": "application/pkix-cert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "file.mime_type": "application/pkix-cert" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "4901d4e1-cc78-4ac2-947a-3fb128dd1a81", - "key": "observer.hostname", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "60ee415e-28fa-48dc-bdd1-143f8219a014", - "key": "file.mime_type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "file.mime_type" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 16, - "i": "6833a252-fba1-48cb-bd4d-7d8a0c6b054c", + "i": "557e8007-b1b6-4ac9-82d6-7d03242c2e1d", "w": 37, "x": 11, - "y": 4 + "y": 5 }, - "panelIndex": "6833a252-fba1-48cb-bd4d-7d8a0c6b054c", - "title": "Top 20 Mime Types by File Count [Logs Corelight]", + "panelIndex": "557e8007-b1b6-4ac9-82d6-7d03242c2e1d", + "title": "Top 10 Mime Types by File Count", "type": "lens" }, { @@ -658,16 +515,16 @@ "references": [], "state": { "adHocDataViews": { - "2054fad719cad1586f4939c0fd43d4071c8862ffeb29dc9033641358407a31e0": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "2054fad719cad1586f4939c0fd43d4071c8862ffeb29dc9033641358407a31e0", - "name": "logs-corelight.files*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.files*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -675,13 +532,13 @@ "textBased": { "indexPatternRefs": [ { - "id": "2054fad719cad1586f4939c0fd43d4071c8862ffeb29dc9033641358407a31e0", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.files*" + "title": "logs-corelight.*" } ], "layers": { - "cde03ffc-0b20-4571-a8b9-2b676e0fadf0": { + "4e602105-31c7-4b9f-b80c-074a636b2a51": { "columns": [ { "columnId": "Mime Type", @@ -709,9 +566,9 @@ } } ], - "index": "2054fad719cad1586f4939c0fd43d4071c8862ffeb29dc9033641358407a31e0", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.files*\r\n| WHERE event.dataset == \"files\" AND file.mime_type == \"application/x-dosexec\" AND (NOT file.name RLIKE \".*exe.*\")\r\n| LIMIT 10000\r\n| STATS COUNT() by file.name, file.mime_type \r\n| RENAME file.mime_type AS `Mime Type`, file.name AS Filename, `COUNT()` AS Count\r\n| SORT Count DESC\r\n| LIMIT 15\r\n| KEEP `Mime Type`, Filename, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE observer.hostname IS NOT NULL AND event.dataset LIKE \"files*\" AND file.mime_type == \"application/x-dosexec\" AND (NOT file.name RLIKE \".*exe.*\")\r\n| LIMIT 10000\r\n| STATS COUNT() by file.name, file.mime_type \r\n| RENAME file.mime_type AS `Mime Type`, file.name AS Filename, `COUNT()` AS Count\r\n| SORT Count DESC\r\n| LIMIT 15\r\n| KEEP `Mime Type`, Filename, Count" }, "timeField": "@timestamp" } @@ -720,7 +577,7 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.files*\r\n| WHERE event.dataset == \"files\" AND file.mime_type == \"application/x-dosexec\" AND (NOT file.name RLIKE \".*exe.*\")\r\n| LIMIT 10000\r\n| STATS COUNT() by file.name, file.mime_type \r\n| RENAME file.mime_type AS `Mime Type`, file.name AS Filename, `COUNT()` AS Count\r\n| SORT Count DESC\r\n| LIMIT 15\r\n| KEEP `Mime Type`, Filename, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE observer.hostname IS NOT NULL AND event.dataset LIKE \"files*\" AND file.mime_type == \"application/x-dosexec\" AND (NOT file.name RLIKE \".*exe.*\")\r\n| LIMIT 10000\r\n| STATS COUNT() by file.name, file.mime_type \r\n| RENAME file.mime_type AS `Mime Type`, file.name AS Filename, `COUNT()` AS Count\r\n| SORT Count DESC\r\n| LIMIT 15\r\n| KEEP `Mime Type`, Filename, Count" }, "visualization": { "columns": [ @@ -734,12 +591,8 @@ "columnId": "Count" } ], - "layerId": "cde03ffc-0b20-4571-a8b9-2b676e0fadf0", - "layerType": "data", - "paging": { - "enabled": true, - "size": 10 - } + "layerId": "4e602105-31c7-4b9f-b80c-074a636b2a51", + "layerType": "data" } }, "title": "Bar vertical stacked", @@ -747,28 +600,20 @@ "visualizationType": "lnsDatatable" }, "description": "Executables hidden by filename (Corelight threat hunting use case #7)", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "FROM logs-corelight.files*\r\n| WHERE event.dataset == \"files\" AND file.mime_type == \"application/x-dosexec\" AND (NOT file.name RLIKE \".*exe.*\")\r\n| LIMIT 10000\r\n| STATS COUNT() by file.name, file.mime_type \r\n| RENAME file.mime_type AS `Mime Type`, file.name AS Filename, `COUNT()` AS Count\r\n| SORT Count DESC\r\n| LIMIT 15\r\n| KEEP `Mime Type`, Filename, Count" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { "h": 16, - "i": "2cbb6e54-2d29-433d-b0f7-514421d221cd", + "i": "a3b863e1-7939-4662-b9e5-aa004603a2b8", "w": 23, "x": 11, - "y": 20 + "y": 21 }, - "panelIndex": "2cbb6e54-2d29-433d-b0f7-514421d221cd", - "title": "Corelight Mime Type to Filename Check [Logs Corelight]", + "panelIndex": "a3b863e1-7939-4662-b9e5-aa004603a2b8", + "title": "Corelight Mime Type to Filename Check", "type": "lens" }, { @@ -777,7 +622,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-f73d497e-9555-4428-b949-a7f0ef5a3194", + "name": "indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" } ], @@ -787,13 +632,13 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "f73d497e-9555-4428-b949-a7f0ef5a3194": { + "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082": { "columnOrder": [ - "c50cb4aa-6fe4-46f2-9273-a9e439196fa1", - "c6924b31-50a1-4c4a-97e9-60714aacb677" + "0471bd47-b6e9-491e-8e5c-61bea9e23105", + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "columns": { - "c50cb4aa-6fe4-46f2-9273-a9e439196fa1": { + "0471bd47-b6e9-491e-8e5c-61bea9e23105": { "customLabel": true, "dataType": "string", "isBucketed": true, @@ -806,7 +651,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "c6924b31-50a1-4c4a-97e9-60714aacb677", + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d", "type": "column" }, "orderDirection": "desc", @@ -814,16 +659,17 @@ "parentFormat": { "id": "terms" }, + "secondaryFields": [], "size": 10 }, "scale": "ordinal", "sourceField": "network.protocol" }, - "c6924b31-50a1-4c4a-97e9-60714aacb677": { + "3eb07058-2192-42ab-b3b8-d9bfee65b63d": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "File Count", + "label": "Count", "operationType": "count", "params": { "emptyAsNull": false, @@ -853,94 +699,6 @@ } }, "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "7ba3ef82-a999-4eb2-8952-918c66dfe0ac", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, { "$state": { "store": "appState" @@ -949,10 +707,11 @@ "alias": null, "disabled": false, "field": "observer.hostname", - "index": "93cb4c07-a68a-4c9c-949d-3a60a06ddd33", + "index": "dd2393e5-874b-4454-be7c-f27ec99baf00", "key": "observer.hostname", "negate": false, - "type": "exists" + "type": "exists", + "value": "exists" }, "query": { "exists": { @@ -968,17 +727,15 @@ "alias": null, "disabled": false, "field": "file.mime_type", - "index": "f99edf26-8f35-4944-a136-386a4e9236d2", + "index": "01fc0e5e-c2f8-44c5-9f02-a5956e49c616", "key": "file.mime_type", - "negate": true, - "params": { - "query": "application/pkix-cert" - }, - "type": "phrase" + "negate": false, + "type": "exists", + "value": "exists" }, "query": { - "match_phrase": { - "file.mime_type": "application/pkix-cert" + "exists": { + "field": "file.mime_type" } } }, @@ -990,14 +747,17 @@ "alias": null, "disabled": false, "field": "file.mime_type", - "index": "f6eb4f73-8cb4-412d-a5a7-5b21981a6811", + "index": "b4f0bbdc-64ab-44fd-9003-4f2fc3029fd5", "key": "file.mime_type", - "negate": false, - "type": "exists" + "negate": true, + "params": { + "query": "application/pkix-cert" + }, + "type": "phrase" }, "query": { - "exists": { - "field": "file.mime_type" + "match_phrase": { + "file.mime_type": "application/pkix-cert" } } } @@ -1029,199 +789,38 @@ } ] }, - "layerId": "f73d497e-9555-4428-b949-a7f0ef5a3194", + "layerId": "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "layerType": "data", "legendDisplay": "show", "metrics": [ - "c6924b31-50a1-4c4a-97e9-60714aacb677" + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "nestedLegend": false, "numberDisplay": "percent", "primaryGroups": [ - "c50cb4aa-6fe4-46f2-9273-a9e439196fa1" + "0471bd47-b6e9-491e-8e5c-61bea9e23105" ], "truncateLegend": false - } - ], - "shape": "pie" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "7ba3ef82-a999-4eb2-8952-918c66dfe0ac", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "93cb4c07-a68a-4c9c-949d-3a60a06ddd33", - "key": "observer.hostname", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "f99edf26-8f35-4944-a136-386a4e9236d2", - "key": "file.mime_type", - "negate": true, - "params": { - "query": "application/pkix-cert" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "file.mime_type": "application/pkix-cert" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "f6eb4f73-8cb4-412d-a5a7-5b21981a6811", - "key": "file.mime_type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "file.mime_type" - } + } + ], + "shape": "pie" } - } - ], - "query": { - "language": "kuery", - "query": "" + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 16, - "i": "7db4925b-9c90-4d60-a780-37213bd85f3e", + "i": "d954507f-85d9-45cf-9919-810d9a886b7a", "w": 14, "x": 34, - "y": 20 + "y": 21 }, - "panelIndex": "7db4925b-9c90-4d60-a780-37213bd85f3e", - "title": "Top File Protocols by File Count [Logs Corelight]", + "panelIndex": "d954507f-85d9-45cf-9919-810d9a886b7a", + "title": "Top File Protocols by File Count", "type": "lens" }, { @@ -1261,7 +860,7 @@ "i": "9f2ae999-7a4d-43a4-b8f3-02a2f5ed4698", "w": 48, "x": 0, - "y": 36 + "y": 37 }, "panelIndex": "9f2ae999-7a4d-43a4-b8f3-02a2f5ed4698", "title": "", @@ -1273,7 +872,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" } ], @@ -1283,17 +882,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "aa62b6fc-5c2a-4906-949c-6f312a971d54": { + "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082": { "columnOrder": [ - "41bd222e-daaf-4170-865a-32211359d183", - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d" + "0471bd47-b6e9-491e-8e5c-61bea9e23105", + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "columns": { - "41bd222e-daaf-4170-865a-32211359d183": { + "0471bd47-b6e9-491e-8e5c-61bea9e23105": { "customLabel": true, - "dataType": "string", + "dataType": "ip", "isBucketed": true, - "label": "Source Host", + "label": "Source IP", "operationType": "terms", "params": { "exclude": [], @@ -1302,7 +901,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d", "type": "column" }, "orderDirection": "desc", @@ -1314,9 +913,9 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "files.tx_hosts" + "sourceField": "source.ip" }, - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d": { + "3eb07058-2192-42ab-b3b8-d9bfee65b63d": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -1357,7 +956,7 @@ "meta": { "alias": "NOT is_broadcast: true", "disabled": false, - "index": "5759ec8b-2424-4fba-be6a-96bc6da0cd90", + "index": "00c2a7e5-f733-417b-afd7-58abdd872562", "negate": false, "params": [ { @@ -1433,11 +1032,30 @@ } } ], - "relation": "OR", + "relation": "AND", "type": "combined" }, "query": {} }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "dd2393e5-874b-4454-be7c-f27ec99baf00", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, { "$state": { "store": "appState" @@ -1446,7 +1064,7 @@ "alias": null, "disabled": false, "field": "file.mime_type", - "index": "9c51268e-315a-4270-aab0-c370f3461b91", + "index": "01fc0e5e-c2f8-44c5-9f02-a5956e49c616", "key": "file.mime_type", "negate": false, "type": "exists" @@ -1466,17 +1084,13 @@ "visualization": { "columns": [ { - "columnId": "41bd222e-daaf-4170-865a-32211359d183", - "isMetric": false, - "isTransposed": false + "columnId": "0471bd47-b6e9-491e-8e5c-61bea9e23105" }, { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", - "isMetric": true, - "isTransposed": false + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d" } ], - "layerId": "aa62b6fc-5c2a-4906-949c-6f312a971d54", + "layerId": "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "layerType": "data" } }, @@ -1484,137 +1098,17 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "5759ec8b-2424-4fba-be6a-96bc6da0cd90", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "9c51268e-315a-4270-aab0-c370f3461b91", - "key": "file.mime_type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "file.mime_type" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 16, - "i": "7071f201-af3a-4a3d-a4b7-f4ca911951dc", + "i": "8dfcee30-fff0-475f-8476-4649e037563f", "w": 24, "x": 0, - "y": 40 + "y": 41 }, - "panelIndex": "7071f201-af3a-4a3d-a4b7-f4ca911951dc", - "title": "Top Transmitting (tx_host) Hosts by number of files [Logs Corelight]", + "panelIndex": "8dfcee30-fff0-475f-8476-4649e037563f", + "title": "Top Transmitting (src_ip) Hosts by Number of Files", "type": "lens" }, { @@ -1623,7 +1117,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" } ], @@ -1633,17 +1127,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "aa62b6fc-5c2a-4906-949c-6f312a971d54": { + "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082": { "columnOrder": [ - "41bd222e-daaf-4170-865a-32211359d183", - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d" + "0471bd47-b6e9-491e-8e5c-61bea9e23105", + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "columns": { - "41bd222e-daaf-4170-865a-32211359d183": { + "0471bd47-b6e9-491e-8e5c-61bea9e23105": { "customLabel": true, - "dataType": "string", + "dataType": "ip", "isBucketed": true, - "label": "Source Host", + "label": "Source IP", "operationType": "terms", "params": { "exclude": [], @@ -1652,7 +1146,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d", "type": "column" }, "orderDirection": "desc", @@ -1664,9 +1158,9 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "files.tx_hosts" + "sourceField": "source.ip" }, - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d": { + "3eb07058-2192-42ab-b3b8-d9bfee65b63d": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -1675,7 +1169,7 @@ "params": { "emptyAsNull": false, "format": { - "id": "number", + "id": "bytes", "params": { "decimals": 0 } @@ -1707,7 +1201,7 @@ "meta": { "alias": "NOT is_broadcast: true", "disabled": false, - "index": "05c6758c-1d97-4315-9b6b-e5e298c8b973", + "index": "00c2a7e5-f733-417b-afd7-58abdd872562", "negate": false, "params": [ { @@ -1783,11 +1277,30 @@ } } ], - "relation": "OR", + "relation": "AND", "type": "combined" }, "query": {} }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "dd2393e5-874b-4454-be7c-f27ec99baf00", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, { "$state": { "store": "appState" @@ -1796,7 +1309,7 @@ "alias": null, "disabled": false, "field": "file.mime_type", - "index": "bc08c59e-cb41-4d2e-8871-eab303e041c5", + "index": "01fc0e5e-c2f8-44c5-9f02-a5956e49c616", "key": "file.mime_type", "negate": false, "type": "exists" @@ -1816,17 +1329,13 @@ "visualization": { "columns": [ { - "columnId": "41bd222e-daaf-4170-865a-32211359d183", - "isMetric": false, - "isTransposed": false + "columnId": "0471bd47-b6e9-491e-8e5c-61bea9e23105" }, { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", - "isMetric": true, - "isTransposed": false + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d" } ], - "layerId": "aa62b6fc-5c2a-4906-949c-6f312a971d54", + "layerId": "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "layerType": "data" } }, @@ -1834,137 +1343,17 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "05c6758c-1d97-4315-9b6b-e5e298c8b973", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "bc08c59e-cb41-4d2e-8871-eab303e041c5", - "key": "file.mime_type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "file.mime_type" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 16, - "i": "90d89b9c-b506-45fb-a721-3cb9ab29fed4", + "i": "322b313f-3210-480b-ab42-c39cde71f3b7", "w": 24, "x": 24, - "y": 40 + "y": 41 }, - "panelIndex": "90d89b9c-b506-45fb-a721-3cb9ab29fed4", - "title": "Top Transmitting (tx_host) Hosts - Bytes [Logs Corelight]", + "panelIndex": "322b313f-3210-480b-ab42-c39cde71f3b7", + "title": "Top Transmitting (src_ip) Hosts - Bytes", "type": "lens" }, { @@ -1973,7 +1362,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" } ], @@ -1983,17 +1372,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "aa62b6fc-5c2a-4906-949c-6f312a971d54": { + "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082": { "columnOrder": [ - "41bd222e-daaf-4170-865a-32211359d183", - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d" + "0471bd47-b6e9-491e-8e5c-61bea9e23105", + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "columns": { - "41bd222e-daaf-4170-865a-32211359d183": { + "0471bd47-b6e9-491e-8e5c-61bea9e23105": { "customLabel": true, - "dataType": "string", + "dataType": "ip", "isBucketed": true, - "label": "Destination Host", + "label": "Destination IP", "operationType": "terms", "params": { "exclude": [], @@ -2002,7 +1391,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d", "type": "column" }, "orderDirection": "desc", @@ -2014,9 +1403,9 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "files.rx_hosts" + "sourceField": "destination.ip" }, - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d": { + "3eb07058-2192-42ab-b3b8-d9bfee65b63d": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -2036,6 +1425,7 @@ } }, "ignoreGlobalFilters": false, + "incompleteColumns": {}, "indexPatternId": "logs-*", "sampling": 1 } @@ -2056,7 +1446,7 @@ "meta": { "alias": "NOT is_broadcast: true", "disabled": false, - "index": "ac7eb31a-de51-470f-9aee-ca8e0814bea8", + "index": "00c2a7e5-f733-417b-afd7-58abdd872562", "negate": false, "params": [ { @@ -2132,11 +1522,30 @@ } } ], - "relation": "OR", + "relation": "AND", "type": "combined" }, "query": {} }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "dd2393e5-874b-4454-be7c-f27ec99baf00", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, { "$state": { "store": "appState" @@ -2145,7 +1554,7 @@ "alias": null, "disabled": false, "field": "file.mime_type", - "index": "9c51268e-315a-4270-aab0-c370f3461b91", + "index": "01fc0e5e-c2f8-44c5-9f02-a5956e49c616", "key": "file.mime_type", "negate": false, "type": "exists" @@ -2165,17 +1574,13 @@ "visualization": { "columns": [ { - "columnId": "41bd222e-daaf-4170-865a-32211359d183", - "isMetric": false, - "isTransposed": false + "columnId": "0471bd47-b6e9-491e-8e5c-61bea9e23105" }, { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", - "isMetric": true, - "isTransposed": false + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d" } ], - "layerId": "aa62b6fc-5c2a-4906-949c-6f312a971d54", + "layerId": "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "layerType": "data" } }, @@ -2183,137 +1588,17 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "ac7eb31a-de51-470f-9aee-ca8e0814bea8", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "9c51268e-315a-4270-aab0-c370f3461b91", - "key": "file.mime_type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "file.mime_type" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 16, - "i": "fb79a20f-f69e-44e8-aaad-ea59433e3263", + "i": "d66593cf-bb96-42da-81e8-3c99a8eb8537", "w": 24, "x": 0, - "y": 56 + "y": 57 }, - "panelIndex": "fb79a20f-f69e-44e8-aaad-ea59433e3263", - "title": "Top Receiving (rx_host) Hosts by number of files [Logs Corelight]", + "panelIndex": "d66593cf-bb96-42da-81e8-3c99a8eb8537", + "title": "Top Receiving (dest_ip) Hosts by Number of Files", "type": "lens" }, { @@ -2322,7 +1607,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" } ], @@ -2332,17 +1617,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "aa62b6fc-5c2a-4906-949c-6f312a971d54": { + "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082": { "columnOrder": [ - "41bd222e-daaf-4170-865a-32211359d183", - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d" + "0471bd47-b6e9-491e-8e5c-61bea9e23105", + "3eb07058-2192-42ab-b3b8-d9bfee65b63d" ], "columns": { - "41bd222e-daaf-4170-865a-32211359d183": { + "0471bd47-b6e9-491e-8e5c-61bea9e23105": { "customLabel": true, - "dataType": "string", + "dataType": "ip", "isBucketed": true, - "label": "Destination Host", + "label": "Destination IP", "operationType": "terms", "params": { "exclude": [], @@ -2351,7 +1636,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d", "type": "column" }, "orderDirection": "desc", @@ -2363,18 +1648,18 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "files.rx_hosts" + "sourceField": "destination.ip" }, - "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d": { + "3eb07058-2192-42ab-b3b8-d9bfee65b63d": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Destination Bytes", - "operationType": "sum", + "operationType": "count", "params": { "emptyAsNull": false, "format": { - "id": "number", + "id": "bytes", "params": { "decimals": 0 } @@ -2406,7 +1691,7 @@ "meta": { "alias": "NOT is_broadcast: true", "disabled": false, - "index": "79439baa-afe1-4f91-875f-eea279b35006", + "index": "00c2a7e5-f733-417b-afd7-58abdd872562", "negate": false, "params": [ { @@ -2482,11 +1767,30 @@ } } ], - "relation": "OR", + "relation": "AND", "type": "combined" }, "query": {} }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "dd2393e5-874b-4454-be7c-f27ec99baf00", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, { "$state": { "store": "appState" @@ -2495,7 +1799,7 @@ "alias": null, "disabled": false, "field": "file.mime_type", - "index": "bc08c59e-cb41-4d2e-8871-eab303e041c5", + "index": "01fc0e5e-c2f8-44c5-9f02-a5956e49c616", "key": "file.mime_type", "negate": false, "type": "exists" @@ -2515,17 +1819,13 @@ "visualization": { "columns": [ { - "columnId": "41bd222e-daaf-4170-865a-32211359d183", - "isMetric": false, - "isTransposed": false + "columnId": "0471bd47-b6e9-491e-8e5c-61bea9e23105" }, { - "columnId": "b541bdcb-e210-4ae1-8ecf-9b61254c6a0d", - "isMetric": true, - "isTransposed": false + "columnId": "3eb07058-2192-42ab-b3b8-d9bfee65b63d" } ], - "layerId": "aa62b6fc-5c2a-4906-949c-6f312a971d54", + "layerId": "a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "layerType": "data" } }, @@ -2533,146 +1833,26 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "79439baa-afe1-4f91-875f-eea279b35006", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.mime_type", - "index": "bc08c59e-cb41-4d2e-8871-eab303e041c5", - "key": "file.mime_type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "file.mime_type" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 16, - "i": "29a70d86-29f0-41ab-9559-88505fbe645c", + "i": "7b823179-06aa-4d99-99e5-b0ab2d52fd84", "w": 24, "x": 24, - "y": 56 + "y": 57 }, - "panelIndex": "29a70d86-29f0-41ab-9559-88505fbe645c", - "title": "Top Receiving (dest_host) Hosts - Bytes [Logs Corelight]", + "panelIndex": "7b823179-06aa-4d99-99e5-b0ab2d52fd84", + "title": "Top Receiving (dest_ip) Hosts - Bytes", "type": "lens" } ], "timeRestore": false, "title": "[Logs Corelight] Files ", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-03-17T11:29:07.632Z", "id": "corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9", "references": [ { @@ -2687,55 +1867,51 @@ }, { "id": "logs-*", - "name": "6833a252-fba1-48cb-bd4d-7d8a0c6b054c:indexpattern-datasource-layer-82ef7ce8-74e4-42a0-af0b-aeb2e348a234", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7db4925b-9c90-4d60-a780-37213bd85f3e:indexpattern-datasource-layer-f73d497e-9555-4428-b949-a7f0ef5a3194", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", "type": "index-pattern" }, { "id": "logs-*", - "name": "7071f201-af3a-4a3d-a4b7-f4ca911951dc:indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "557e8007-b1b6-4ac9-82d6-7d03242c2e1d:indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" }, { "id": "logs-*", - "name": "90d89b9c-b506-45fb-a721-3cb9ab29fed4:indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "d954507f-85d9-45cf-9919-810d9a886b7a:indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" }, { "id": "logs-*", - "name": "fb79a20f-f69e-44e8-aaad-ea59433e3263:indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "8dfcee30-fff0-475f-8476-4649e037563f:indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" }, { "id": "logs-*", - "name": "29a70d86-29f0-41ab-9559-88505fbe645c:indexpattern-datasource-layer-aa62b6fc-5c2a-4906-949c-6f312a971d54", + "name": "322b313f-3210-480b-ab42-c39cde71f3b7:indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_3d267d03-1066-487a-b6c9-ffdcae1941d2:optionsListDataView", + "name": "d66593cf-bb96-42da-81e8-3c99a8eb8537:indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_aa496d39-ac08-41a0-837b-8fccce345bb9:optionsListDataView", + "name": "7b823179-06aa-4d99-99e5-b0ab2d52fd84:indexpattern-datasource-layer-a4d36c81-1466-4bc5-a37e-fe4fe1cd0082", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "controlGroup_3d267d03-1066-487a-b6c9-ffdcae1941d2:optionsListDataView", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "controlGroup_aa496d39-ac08-41a0-837b-8fccce345bb9:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba.json b/packages/corelight/kibana/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba.json index 05dd4aed95b..380f2247b84 100644 --- a/packages/corelight/kibana/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba.json +++ b/packages/corelight/kibana/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "4549862d-38df-42ca-b2f8-a6af9513f195", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -135,7 +136,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - **RDP Inferences Overview**\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - **RDP Inferences Overview**\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -947,6 +948,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1129,11 +1133,7 @@ { "embeddableConfig": { "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 10 }, "gridData": { @@ -1151,10 +1151,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] RDP Inferences Overview", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:23:56.102Z", "id": "corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba", "references": [ { @@ -1172,11 +1172,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", "type": "index-pattern" }, - { - "id": "corelight-039807c4-9ec2-4778-b548-0e08877fb8d2", - "name": "957528ec-d710-45a9-ad1c-fe0ad6e805be:panel_957528ec-d710-45a9-ad1c-fe0ad6e805be", - "type": "search" - }, { "id": "logs-*", "name": "fce0a642-e5ca-4aa5-841a-fa38a93f295f:indexpattern-datasource-layer-5212acf0-6cbf-4a0d-ae00-8289aa08722b", @@ -1208,26 +1203,17 @@ "type": "index-pattern" }, { - "id": "logs-*", - "name": "controlGroup_4549862d-38df-42ca-b2f8-a6af9513f195:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" + "id": "corelight-039807c4-9ec2-4778-b548-0e08877fb8d2", + "name": "957528ec-d710-45a9-ad1c-fe0ad6e805be:panel_957528ec-d710-45a9-ad1c-fe0ad6e805be", + "type": "search" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "name": "controlGroup_4549862d-38df-42ca-b2f8-a6af9513f195:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11.json b/packages/corelight/kibana/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11.json index 9694ea2e5d0..1bd1aae9c9e 100644 --- a/packages/corelight/kibana/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11.json +++ b/packages/corelight/kibana/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "source.ip", + "id": "2e26dda9-4629-418b-948f-d930abc2d268", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -31,6 +32,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "intel.seen.indicator", + "id": "3250c956-8432-4557-afc0-649c2e6be37f", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -48,6 +50,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "destination.ip", + "id": "572a9344-4353-412d-8476-36fff1fa0cd3", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -65,6 +68,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "sources", + "id": "a8e04b33-0231-46ee-b6fc-cfc94adea468", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -82,6 +86,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "intel.seen.indicator_type", + "id": "cd3840ba-b9d5-4f8c-97c7-676725c045f5", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -101,6 +106,7 @@ "exclude": false, "existsSelected": false, "fieldName": "destination.port", + "id": "f789122e-05b5-43ed-b110-9b15ac9d24ad", "searchTechnique": "exact", "selectedOptions": [], "sort": { @@ -202,7 +208,7 @@ "description": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - **Intel**\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)\n", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - **Intel**\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)\n", "openLinksInNewTab": false }, "title": "", @@ -867,6 +873,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -894,11 +903,7 @@ { "embeddableConfig": { "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 10 }, "gridData": { @@ -916,10 +921,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] Intel", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:00.135Z", "id": "corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11", "references": [ { @@ -932,11 +937,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" }, - { - "id": "corelight-845d2914-3a55-4057-9dca-a3fd4e226d54", - "name": "242aacc6-7504-411a-8d27-d9e7f8e89436:panel_242aacc6-7504-411a-8d27-d9e7f8e89436", - "type": "search" - }, { "id": "logs-*", "name": "a8456378-79f5-42d0-ab62-1d340b433a42:indexpattern-datasource-layer-51b17fd0-e0ee-4b06-94c2-775000fd4536", @@ -947,6 +947,11 @@ "name": "187aea9d-272d-420a-92dd-cd015b601c5b:indexpattern-datasource-layer-5e59c2cf-2751-46ea-8daa-6f105e954299", "type": "index-pattern" }, + { + "id": "corelight-845d2914-3a55-4057-9dca-a3fd4e226d54", + "name": "242aacc6-7504-411a-8d27-d9e7f8e89436:panel_242aacc6-7504-411a-8d27-d9e7f8e89436", + "type": "search" + }, { "id": "logs-*", "name": "controlGroup_cd3840ba-b9d5-4f8c-97c7-676725c045f5:optionsListDataView", @@ -976,18 +981,9 @@ "id": "logs-*", "name": "controlGroup_a8e04b33-0231-46ee-b6fc-cfc94adea468:optionsListDataView", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde.json b/packages/corelight/kibana/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde.json index 19cddc5305a..475ecc603cf 100644 --- a/packages/corelight/kibana/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde.json +++ b/packages/corelight/kibana/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "source.ip", + "id": "283ff494-ed87-44c1-b0cf-9eb8fdce11c4", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -93,7 +94,7 @@ "description": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - **IP Interrogation**\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - **IP Interrogation**\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -240,6 +241,9 @@ "visualizationType": "lnsXY" }, "description": "Connections", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -371,6 +375,9 @@ "visualizationType": "lnsPie" }, "description": "Connections", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -525,6 +532,9 @@ "visualizationType": "lnsDatatable" }, "description": "Connections", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -666,6 +676,9 @@ "visualizationType": "lnsDatatable" }, "description": "HTTP", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1639,10 +1652,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] IP Interrogation", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:11.245Z", "id": "corelight-3a4a279f-f238-47de-90ba-f643c5647fde", "references": [ { @@ -1669,13 +1682,9 @@ "id": "logs-*", "name": "controlGroup_283ff494-ed87-44c1-b0cf-9eb8fdce11c4:optionsListDataView", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902.json b/packages/corelight/kibana/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902.json index d716bd8ee7d..b5bec3623ae 100644 --- a/packages/corelight/kibana/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902.json +++ b/packages/corelight/kibana/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "software.type", + "id": "33b707fd-5632-45e4-adde-3726f43184ac", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -31,6 +32,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "611612e4-c8a9-4e1a-a860-6069ae0f6eb6", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -48,6 +50,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "software.name", + "id": "7599eabd-b77e-4d04-b8e8-8b228997098a", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -67,6 +70,7 @@ "exclude": false, "existsSelected": false, "fieldName": "host_header", + "id": "97e450fd-b2c6-4502-aa23-4e5b0e032455", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -207,7 +211,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - **Software**\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - **Software**\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -379,7 +383,7 @@ "y": 0 }, "panelIndex": "0075eb75-678b-42d3-9fb8-1c4aa3799392", - "title": "Top Software [Logs Corelight]", + "title": "Top Software", "type": "lens" }, { @@ -472,6 +476,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -493,7 +500,7 @@ "y": 0 }, "panelIndex": "376f2059-7cb4-46e9-954d-bd33c4e2ddb1", - "title": "Top Software Versions [Logs Corelight]", + "title": "Top Software Versions", "type": "lens" }, { @@ -522,7 +529,7 @@ "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Software Type", + "label": "Software Name", "operationType": "terms", "params": { "exclude": [], @@ -543,7 +550,7 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "software.type" + "sourceField": "software.name" }, "ab35b7c2-b46b-45f6-96d7-a35f245444a4": { "customLabel": true, @@ -623,38 +630,34 @@ "y": 16 }, "panelIndex": "e1efe476-2256-4262-af95-40cb2311cea1", - "title": "Top Software Types [Logs Corelight]", + "title": "Top Software Types", "type": "lens" }, { "embeddableConfig": { "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 10 }, "gridData": { "h": 29, - "i": "61d50e7c-6cd9-4b07-a60a-6f7f2b8b0be8", + "i": "586f0801-9f42-41b3-a7cc-b5d6981a7006", "w": 48, "x": 0, "y": 33 }, - "panelIndex": "61d50e7c-6cd9-4b07-a60a-6f7f2b8b0be8", - "panelRefName": "panel_61d50e7c-6cd9-4b07-a60a-6f7f2b8b0be8", + "panelIndex": "586f0801-9f42-41b3-a7cc-b5d6981a7006", + "panelRefName": "panel_586f0801-9f42-41b3-a7cc-b5d6981a7006", "title": "Software Details [Logs Corelight]", "type": "search" } ], "timeRestore": false, "title": "[Logs Corelight] Software", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-03-14T10:18:58.891Z", "id": "corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902", "references": [ { @@ -677,11 +680,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", "type": "index-pattern" }, - { - "id": "corelight-34498312-f418-4e47-9931-bc5fc46c0bff", - "name": "61d50e7c-6cd9-4b07-a60a-6f7f2b8b0be8:panel_61d50e7c-6cd9-4b07-a60a-6f7f2b8b0be8", - "type": "search" - }, { "id": "logs-*", "name": "0075eb75-678b-42d3-9fb8-1c4aa3799392:indexpattern-datasource-layer-8464528f-193e-4f3b-9cd6-5841fd337567", @@ -692,6 +690,11 @@ "name": "e1efe476-2256-4262-af95-40cb2311cea1:indexpattern-datasource-layer-8464528f-193e-4f3b-9cd6-5841fd337567", "type": "index-pattern" }, + { + "id": "corelight-9d31f033-1900-47c6-b7cf-f34a9c00c2d6", + "name": "586f0801-9f42-41b3-a7cc-b5d6981a7006:panel_586f0801-9f42-41b3-a7cc-b5d6981a7006", + "type": "search" + }, { "id": "logs-*", "name": "controlGroup_611612e4-c8a9-4e1a-a860-6069ae0f6eb6:optionsListDataView", @@ -711,28 +714,9 @@ "id": "logs-*", "name": "controlGroup_97e450fd-b2c6-4502-aa23-4e5b0e032455:optionsListDataView", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", - "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963.json b/packages/corelight/kibana/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963.json index b5906f32ac9..f942f8fd1ca 100644 --- a/packages/corelight/kibana/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963.json +++ b/packages/corelight/kibana/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "b7b4bc2e-98d1-453a-a412-a37228a386b1", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -113,7 +114,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- **Data Insights**\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - **Secure Channel Insights**\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- **Data Insights**\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - **Secure Channel Insights**\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -196,6 +197,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -325,6 +329,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -489,6 +496,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -619,6 +629,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -707,6 +720,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -836,6 +852,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1039,6 +1058,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1201,6 +1223,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1289,6 +1314,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1418,6 +1446,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1621,6 +1652,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1770,6 +1804,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1837,7 +1874,7 @@ ], "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", "query": { - "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences \r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is inititated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The inititation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| rename event.id as uid, source.ip as src_ip, destination.ip as dest_ip, ssh.inferences as inference, `count()` as count\r\n| keep uid , src_ip, dest_ip, inference,count\r\n| stats count()\r\n| rename `count()` as `Advanced Threat Indicators`\r\n| keep `Advanced Threat Indicators`" + "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences \r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is initiated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The initiation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| rename event.id as uid, source.ip as src_ip, destination.ip as dest_ip, ssh.inferences as inference, `count()` as count\r\n| keep uid , src_ip, dest_ip, inference,count\r\n| stats count()\r\n| rename `count()` as `Advanced Threat Indicators`\r\n| keep `Advanced Threat Indicators`" }, "timeField": "@timestamp" } @@ -1846,7 +1883,7 @@ }, "filters": [], "query": { - "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences \r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is inititated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The inititation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| rename event.id as uid, source.ip as src_ip, destination.ip as dest_ip, ssh.inferences as inference, `count()` as count\r\n| keep uid , src_ip, dest_ip, inference,count\r\n| stats count()\r\n| rename `count()` as `Advanced Threat Indicators`\r\n| keep `Advanced Threat Indicators`" + "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences \r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is initiated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The initiation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| rename event.id as uid, source.ip as src_ip, destination.ip as dest_ip, ssh.inferences as inference, `count()` as count\r\n| keep uid , src_ip, dest_ip, inference,count\r\n| stats count()\r\n| rename `count()` as `Advanced Threat Indicators`\r\n| keep `Advanced Threat Indicators`" }, "visualization": { "layerId": "8a1695cf-2393-4091-8b98-a6149628d4ca", @@ -1858,6 +1895,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1866,7 +1906,7 @@ "filters": [], "hidePanelTitles": true, "query": { - "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences \r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is inititated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The inititation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| rename event.id as uid, source.ip as src_ip, destination.ip as dest_ip, ssh.inferences as inference, `count()` as count\r\n| keep uid , src_ip, dest_ip, inference,count\r\n| stats count()\r\n| rename `count()` as `Advanced Threat Indicators`\r\n| keep `Advanced Threat Indicators`" + "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences \r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is initiated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The initiation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| rename event.id as uid, source.ip as src_ip, destination.ip as dest_ip, ssh.inferences as inference, `count()` as count\r\n| keep uid , src_ip, dest_ip, inference,count\r\n| stats count()\r\n| rename `count()` as `Advanced Threat Indicators`\r\n| keep `Advanced Threat Indicators`" }, "syncColors": false, "syncCursor": true, @@ -2046,7 +2086,7 @@ ], "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", "query": { - "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is inititated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The inititation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| rename event.id as UID, source.ip as `Source IP`, destination.ip as `Destination IP`, ssh.inferences as Inference, `count()` as Count\r\n| keep UID, `Source IP`, `Destination IP`, Inference, Count, Description" + "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is initiated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The initiation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| rename event.id as UID, source.ip as `Source IP`, destination.ip as `Destination IP`, ssh.inferences as Inference, `count()` as Count\r\n| keep UID, `Source IP`, `Destination IP`, Inference, Count, Description" }, "timeField": "@timestamp" } @@ -2055,7 +2095,7 @@ }, "filters": [], "query": { - "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is inititated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The inititation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| rename event.id as UID, source.ip as `Source IP`, destination.ip as `Destination IP`, ssh.inferences as Inference, `count()` as Count\r\n| keep UID, `Source IP`, `Destination IP`, Inference, Count, Description" + "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is initiated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The initiation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| rename event.id as UID, source.ip as `Source IP`, destination.ip as `Destination IP`, ssh.inferences as Inference, `count()` as Count\r\n| keep UID, `Source IP`, `Destination IP`, Inference, Count, Description" }, "visualization": { "columns": [ @@ -2102,6 +2142,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -2109,7 +2152,7 @@ }, "filters": [], "query": { - "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is inititated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The inititation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| rename event.id as UID, source.ip as `Source IP`, destination.ip as `Destination IP`, ssh.inferences as Inference, `count()` as Count\r\n| keep UID, `Source IP`, `Destination IP`, Inference, Count, Description" + "esql": "from logs-corelight.various-*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\" and event.dataset == \"ssh\" and observer.hostname is not null\r\n| stats count() by event.id, source.ip, destination.ip, ssh.inferences\r\n| eval Description =case(\r\n ssh.inferences == \"ABP\", \"The client did not complete the SSH state machine for authentication and likely sent the server an exploit\",\r\n ssh.inferences == \"RSP\", \"The client connected with a -R flag, which provisions the ports to be used for a Reverse Session to be set up at any point onwards. ssh -R 31337:localhost:22 user@192.168.20.33\",\r\n ssh.inferences == \"RSI\", \"The Reverse session is initiated from the server back to the Client. This initiation can be done at any stage during the session. From the Server, the attacker would initiate the Reverse session by e.g.ssh victim@localhost -p 31337\",\r\n ssh.inferences == \"RSIA\", \"The initiation of the Reverse session happened very early in the packet stream, indicating automation\",\r\n ssh.inferences == \"RSL\", \"The Reverse tunnel login login has succeeded, the attacker now has shell on the victim's device\",\r\n ssh.inferences == \"RSK\", \"Keystrokes are detected within the Reverse tunnel\"\r\n)\r\n| where Description is not null\r\n| rename event.id as UID, source.ip as `Source IP`, destination.ip as `Destination IP`, ssh.inferences as Inference, `count()` as Count\r\n| keep UID, `Source IP`, `Destination IP`, Inference, Count, Description" }, "syncColors": false, "syncCursor": true, @@ -2570,6 +2613,9 @@ "visualizationType": "lnsDatatable" }, "description": "Classification based on Industry best practices", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -2603,10 +2649,10 @@ "timeRestore": true, "timeTo": "now", "title": "[Logs Corelight] Secure Channel Insights", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:05.193Z", "id": "corelight-45197477-c13f-4e52-a5dd-fb4f53564963", "references": [ { @@ -2626,5 +2672,6 @@ } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17.json b/packages/corelight/kibana/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17.json index d82d43f6df6..52f6011ccd8 100644 --- a/packages/corelight/kibana/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17.json +++ b/packages/corelight/kibana/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "destination.port", + "id": "716b7efb-887b-41b6-9e26-3211630e5305", "searchTechnique": "exact", "selectedOptions": [ 53 @@ -22,7 +23,7 @@ "by": "_count", "direction": "desc" }, - "title": "Responder Port (id_resp_p)" + "title": "Responder Port (dest_port)" }, "grow": true, "order": 1, @@ -33,6 +34,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "d6ddd074-8637-4e45-850b-1af34924737f", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -50,6 +52,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "dns.question.type", + "id": "f30e42d8-e9d4-44b1-bb10-9ca6c649c763", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -66,7 +69,7 @@ }, "showApplySelections": false }, - "description": "", + "description": "Summary of Corelight network connection activity and trends.", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -97,20 +100,16 @@ "store": "appState" }, "meta": { - "alias": null, + "alias": "event.dataset: dns*", "disabled": false, - "field": "event.dataset", "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "event.dataset", + "key": "query", "negate": false, - "params": { - "query": "dns" - }, - "type": "phrase" + "type": "custom" }, "query": { - "match_phrase": { - "event.dataset": "dns" + "wildcard": { + "event.dataset": "dns*" } } }, @@ -119,17 +118,20 @@ "store": "appState" }, "meta": { - "alias": null, + "alias": "Aggregation", "disabled": false, - "field": "observer.hostname", + "field": "event.dataset", "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "key": "observer.hostname", - "negate": false, - "type": "exists" + "key": "event.dataset", + "negate": true, + "params": { + "query": "dns_agg" + }, + "type": "phrase" }, "query": { - "exists": { - "field": "observer.hostname" + "match_phrase": { + "event.dataset": "dns_agg" } } } @@ -171,7 +173,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - **DNS**\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - **DNS**\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -180,7 +182,7 @@ } }, "gridData": { - "h": 32, + "h": 38, "i": "41390c4e-8a11-45f8-9e82-20aeb22dd457", "w": 12, "x": 0, @@ -196,7 +198,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-8d61793d-b09e-4753-9178-efc0b6f492ae", + "name": "indexpattern-datasource-layer-4beab937-e3c5-44db-90b8-d899847a1f9b", "type": "index-pattern" } ], @@ -206,44 +208,16 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "8d61793d-b09e-4753-9178-efc0b6f492ae": { + "4beab937-e3c5-44db-90b8-d899847a1f9b": { "columnOrder": [ - "3cee9e5b-a64b-48f6-8522-f49eb159635e", - "57e9812b-3e07-477f-bb08-f96ae75106df" + "11b102d6-d7ee-495e-8738-e1bbdf7a78d1" ], "columns": { - "3cee9e5b-a64b-48f6-8522-f49eb159635e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Record Type", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "57e9812b-3e07-477f-bb08-f96ae75106df", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "dns.question.type" - }, - "57e9812b-3e07-477f-bb08-f96ae75106df": { + "11b102d6-d7ee-495e-8738-e1bbdf7a78d1": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", + "label": "Total DNS Requests", "operationType": "count", "params": { "emptyAsNull": false, @@ -255,7 +229,7 @@ } }, "scale": "ratio", - "sourceField": "___records___" + "sourceField": "dns.question.name" } }, "ignoreGlobalFilters": false, @@ -273,6 +247,48 @@ } }, "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "index": "afac6375-ef4f-497c-bb5c-d202008cd916", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "observer.vendor": "Corelight" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "bf6cf0cc-7397-447d-9bde-0d9ecde66e46", + "key": "observer.hostname", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, { "$state": { "store": "appState" @@ -280,7 +296,7 @@ "meta": { "alias": "NOT is_broadcast: true", "disabled": false, - "index": "f5457800-6d5c-4a8f-b130-6d56936acc98", + "index": "c4fceb1a-b9b9-4a5e-92c7-4aa2b4f1115e", "negate": false, "params": [ { @@ -356,29 +372,10 @@ } } ], - "relation": "OR", + "relation": "AND", "type": "combined" }, "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.type", - "index": "5b1a7d3e-64e1-4c38-be1b-d548d1c0ef23", - "key": "dns.question.type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "dns.question.type" - } - } } ], "internalReferences": [], @@ -387,244 +384,815 @@ "query": "" }, "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "8d61793d-b09e-4753-9178-efc0b6f492ae", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "57e9812b-3e07-477f-bb08-f96ae75106df" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "3cee9e5b-a64b-48f6-8522-f49eb159635e" - ], - "truncateLegend": false - } - ], - "shape": "pie" + "color": "#6092C0", + "layerId": "4beab937-e3c5-44db-90b8-d899847a1f9b", + "layerType": "data", + "metricAccessor": "11b102d6-d7ee-495e-8738-e1bbdf7a78d1" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "f5457800-6d5c-4a8f-b130-6d56936acc98", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.type", - "index": "5b1a7d3e-64e1-4c38-be1b-d548d1c0ef23", - "key": "dns.question.type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "dns.question.type" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" + "visualizationType": "lnsMetric" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 16, - "i": "198a30fc-31cb-416d-a087-42d3d1905705", - "w": 16, + "h": 6, + "i": "88d8cfed-e967-45ea-96aa-ab87c43d6e8b", + "w": 9, "x": 12, "y": 0 }, - "panelIndex": "198a30fc-31cb-416d-a087-42d3d1905705", - "title": "Top Query Types [Logs Corelight]", + "panelIndex": "88d8cfed-e967-45ea-96aa-ab87c43d6e8b", + "title": "Total DNS Requests", "type": "lens" }, { "embeddableConfig": { "attributes": { - "references": [], - "state": { - "adHocDataViews": { - "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2": { - "allowHidden": false, - "allowNoIndex": false, - "fieldFormats": {}, - "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", - "name": "logs-corelight.dns*", - "runtimeFieldMap": {}, - "sourceFilters": [], - "timeFieldName": "@timestamp", - "title": "logs-corelight.dns*", - "type": "esql" - } + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4beab937-e3c5-44db-90b8-d899847a1f9b", + "type": "index-pattern" }, + { + "id": "logs-*", + "name": "fd3486d4-28fc-469a-9b91-1b1fcc10d9ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ad01b2e0-7bcd-4e88-9309-0cee883b6710", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, "datasourceStates": { - "textBased": { - "indexPatternRefs": [ - { - "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", - "timeField": "@timestamp", - "title": "logs-corelight.dns*" - } - ], + "formBased": { "layers": { - "2e981f47-df96-43db-b5f9-fbf631d48e9f": { - "columns": [ - { - "columnId": "Query", - "fieldName": "Query", - "meta": { - "esType": "keyword", - "type": "string" - } - }, - { - "columnId": "Count", - "fieldName": "Count", - "inMetricDimension": true, - "meta": { - "esType": "long", - "type": "number" - } - } + "4beab937-e3c5-44db-90b8-d899847a1f9b": { + "columnOrder": [ + "11b102d6-d7ee-495e-8738-e1bbdf7a78d1" ], - "index": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", - "query": { - "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where event.dataset == \"dns\" and observer.hostname is not null and (source.ip not in (\"0.0.0.0\",\"255.255.255.255\") or destination.ip not in (\"0.0.0.0\",\"255.255.255.255\")) and dns.question.type is not null and dns.question.type != \"PTR\"\r\n| stats COUNT() by source.ip, dns.response_code, destination.domain, dns.question.type \r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" + "columns": { + "11b102d6-d7ee-495e-8738-e1bbdf7a78d1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total DNS Response", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "dns.question.name" + } }, - "timeField": "@timestamp" + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 } } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} } }, - "filters": [], - "query": { - "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where event.dataset == \"dns\" and observer.hostname is not null and (source.ip not in (\"0.0.0.0\",\"255.255.255.255\") or destination.ip not in (\"0.0.0.0\",\"255.255.255.255\")) and dns.question.type is not null and dns.question.type != \"PTR\"\r\n| stats COUNT() by source.ip, dns.response_code, destination.domain, dns.question.type \r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" - }, - "visualization": { + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "dns.answers.name", + "index": "fd3486d4-28fc-469a-9b91-1b1fcc10d9ef", + "key": "dns.answers.name", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "dns.answers.name" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "dns.question.type", + "index": "ad01b2e0-7bcd-4e88-9309-0cee883b6710", + "key": "dns.question.type", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "dns.question.type" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "index": "afac6375-ef4f-497c-bb5c-d202008cd916", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "observer.vendor": "Corelight" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "bf6cf0cc-7397-447d-9bde-0d9ecde66e46", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "NOT is_broadcast: true", + "disabled": false, + "index": "742b8f76-0e46-403f-89f5-db6f1a1d7a70", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "source.ip", + "index": "logs-*", + "key": "source.ip", + "negate": true, + "params": [ + "0.0.0.0", + "255.255.255.255" + ], + "type": "phrases", + "value": [ + "0.0.0.0", + "255.255.255.255" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "source.ip": "0.0.0.0" + } + }, + { + "match_phrase": { + "source.ip": "255.255.255.255" + } + } + ] + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "destination.ip", + "index": "logs-*", + "key": "destination.ip", + "negate": true, + "params": [ + "0.0.0.0", + "255.255.255.255" + ], + "type": "phrases", + "value": [ + "0.0.0.0", + "255.255.255.255" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "destination.ip": "0.0.0.0" + } + }, + { + "match_phrase": { + "destination.ip": "255.255.255.255" + } + } + ] + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "4beab937-e3c5-44db-90b8-d899847a1f9b", + "layerType": "data", + "metricAccessor": "11b102d6-d7ee-495e-8738-e1bbdf7a78d1" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "777810ab-fa79-438c-81d5-429b97465e43", + "w": 9, + "x": 21, + "y": 0 + }, + "panelIndex": "777810ab-fa79-438c-81d5-429b97465e43", + "title": "Total DNS Response", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "name": "logs-corelight.dns*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.dns*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "timeField": "@timestamp", + "title": "logs-corelight.dns*" + } + ], + "layers": { + "d35a12fc-c75f-4c42-ae9e-2fd299167225": { + "columns": [ + { + "columnId": "Top Non-Existent Domains", + "fieldName": "Top Non-Existent Domains", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + } + ], + "index": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "query": { + "esql": "FROM logs-corelight.dns*\r\n| WHERE observer.vendor==\"Corelight\" \r\n AND observer.hostname IS NOT NULL\r\n AND event.dataset LIKE \"dns*\"\r\n AND NOT (COALESCE(source.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false) OR COALESCE(destination.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false)\r\n)\r\n AND dns.response_code == \"NXDOMAIN\"\r\n AND dns.response_code IS NOT NULL\r\n| STATS COUNT() BY source.ip, destination.ip\r\n// stats by event.ids\r\n| RENAME `COUNT()` AS `Top Non-Existent Domains`\r\n| KEEP `Top Non-Existent Domains`\r\n" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.dns*\r\n| WHERE observer.vendor==\"Corelight\" \r\n AND observer.hostname IS NOT NULL\r\n AND event.dataset LIKE \"dns*\"\r\n AND NOT (COALESCE(source.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false) OR COALESCE(destination.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false)\r\n)\r\n AND dns.response_code == \"NXDOMAIN\"\r\n AND dns.response_code IS NOT NULL\r\n| STATS COUNT() BY source.ip, destination.ip\r\n// stats by event.ids\r\n| RENAME `COUNT()` AS `Top Non-Existent Domains`\r\n| KEEP `Top Non-Existent Domains`\r\n" + }, + "visualization": { + "color": "#6092C0", + "layerId": "d35a12fc-c75f-4c42-ae9e-2fd299167225", + "layerType": "data", + "metricAccessor": "Top Non-Existent Domains" + } + }, + "title": "Metric", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "755b1080-64c8-46db-beaf-df866c81ffda", + "w": 9, + "x": 30, + "y": 0 + }, + "panelIndex": "755b1080-64c8-46db-beaf-df866c81ffda", + "title": "Top Non-Existent Domains", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "name": "logs-corelight.dns*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.dns*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "timeField": "@timestamp", + "title": "logs-corelight.dns*" + } + ], + "layers": { + "7e6cd594-0360-425e-8fb5-88f89d811383": { + "columns": [ + { + "columnId": "DNS Aggregation", + "fieldName": "DNS Aggregation", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "query": { + "esql": "FROM logs-corelight.dns*\r\n| WHERE event.dataset == \"dns_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `DNS Aggregation` = CASE(count \u003e 0, \"DNS Agg Logs Available\", \"No DNS Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `DNS Aggregation`, status" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.dns*\r\n| WHERE event.dataset == \"dns_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `DNS Aggregation` = CASE(count \u003e 0, \"DNS Agg Logs Available\", \"No DNS Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `DNS Aggregation`, status" + }, + "visualization": { + "columns": [ + { + "columnId": "DNS Aggregation" + } + ], + "layerId": "7e6cd594-0360-425e-8fb5-88f89d811383", + "layerType": "data" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "07abb188-7033-4f5e-95cb-a66cc3817767", + "w": 9, + "x": 39, + "y": 0 + }, + "panelIndex": "07abb188-7033-4f5e-95cb-a66cc3817767", + "title": "DNS Aggregation", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "c5c7446a-f512-48dd-87cb-5a2958b34dca": { + "columnOrder": [ + "be18c230-e126-49aa-b56e-4a4b08e9be63", + "fa6cad12-4cbe-40a4-a16e-4512dce84450" + ], + "columns": { + "be18c230-e126-49aa-b56e-4a4b08e9be63": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Record Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "fa6cad12-4cbe-40a4-a16e-4512dce84450", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "dns.question.type" + }, + "fa6cad12-4cbe-40a4-a16e-4512dce84450": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "index": "639d5e72-0f5a-4052-8893-0a48bcf0b617", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "observer.vendor": "Corelight" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "5887bfdc-c8d6-4c27-94e0-37dab1ba075f", + "key": "observer.hostname", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "NOT is_broadcast: true", + "disabled": false, + "index": "1ffbe57c-2cbd-4bd9-98f5-bbd76b6753eb", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "source.ip", + "index": "logs-*", + "key": "source.ip", + "negate": true, + "params": [ + "0.0.0.0", + "255.255.255.255" + ], + "type": "phrases", + "value": [ + "0.0.0.0", + "255.255.255.255" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "source.ip": "0.0.0.0" + } + }, + { + "match_phrase": { + "source.ip": "255.255.255.255" + } + } + ] + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "destination.ip", + "index": "logs-*", + "key": "destination.ip", + "negate": true, + "params": [ + "0.0.0.0", + "255.255.255.255" + ], + "type": "phrases", + "value": [ + "0.0.0.0", + "255.255.255.255" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "destination.ip": "0.0.0.0" + } + }, + { + "match_phrase": { + "destination.ip": "255.255.255.255" + } + } + ] + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "dns.question.type", + "index": "25b1bb9e-ff1d-406f-b4d4-a6a6a381a142", + "key": "dns.question.type", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "dns.question.type" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "c5c7446a-f512-48dd-87cb-5a2958b34dca", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "fa6cad12-4cbe-40a4-a16e-4512dce84450" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "be18c230-e126-49aa-b56e-4a4b08e9be63" + ] + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "df9bfc1a-b21d-4ff3-8a77-201a75a364e8", + "w": 16, + "x": 12, + "y": 6 + }, + "panelIndex": "df9bfc1a-b21d-4ff3-8a77-201a75a364e8", + "title": "Top Query Types", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "name": "logs-corelight.dns*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.dns*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "timeField": "@timestamp", + "title": "logs-corelight.dns*" + } + ], + "layers": { + "debcf745-075f-45e4-9cda-0a291a025829": { + "columns": [ + { + "columnId": "Query", + "fieldName": "Query", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "Count", + "fieldName": "Count", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + } + ], + "index": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", + "query": { + "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\"\r\n and event.dataset LIKE \"dns*\"\r\n and observer.hostname is not null \r\n and not (COALESCE(source.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false) OR COALESCE(destination.ip in (\"0.0.0.0\",\"255.255.255.255\"), false)\r\n)\r\n and dns.question.type is not null and dns.question.type != \"PTR\"\r\n| stats COUNT() by source.ip, dns.status_code, destination.domain, dns.question.type\r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where observer.vendor == \"Corelight\"\r\n and event.dataset LIKE \"dns*\"\r\n and observer.hostname is not null \r\n and not (COALESCE(source.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false) OR COALESCE(destination.ip in (\"0.0.0.0\",\"255.255.255.255\"), false)\r\n)\r\n and dns.question.type is not null and dns.question.type != \"PTR\"\r\n| stats COUNT() by source.ip, dns.status_code, destination.domain, dns.question.type\r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" + }, + "visualization": { "columns": [ { "columnId": "Query" @@ -633,7 +1201,7 @@ "columnId": "Count" } ], - "layerId": "2e981f47-df96-43db-b5f9-fbf631d48e9f", + "layerId": "debcf745-075f-45e4-9cda-0a291a025829", "layerType": "data" } }, @@ -641,28 +1209,20 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where event.dataset == \"dns\" and observer.hostname is not null and (source.ip not in (\"0.0.0.0\",\"255.255.255.255\") or destination.ip not in (\"0.0.0.0\",\"255.255.255.255\")) and dns.question.type is not null and dns.question.type != \"PTR\"\r\n| stats COUNT() by source.ip, dns.response_code, destination.domain, dns.question.type \r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { "h": 16, - "i": "2470f545-009a-49f0-8d86-ab7186507ee4", + "i": "5c278bbc-2030-4822-b9fb-ae8649cf696c", "w": 20, "x": 28, - "y": 0 + "y": 6 }, - "panelIndex": "2470f545-009a-49f0-8d86-ab7186507ee4", - "title": "Top 10 Queries by Count [Logs Corelight]", + "panelIndex": "5c278bbc-2030-4822-b9fb-ae8649cf696c", + "title": "Top 10 Queries by Count", "type": "lens" }, { @@ -694,7 +1254,7 @@ } ], "layers": { - "99d2b11e-4dfd-4ae4-aa07-5c1a7c0df652": { + "2484eab0-e946-40b8-8531-4959b5fdbf27": { "columns": [ { "columnId": "Query", @@ -716,7 +1276,7 @@ ], "index": "a38513451b31bef37a02d6388a528d0f89a52d6d0a351159461db643ba67a7f2", "query": { - "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where event.dataset == \"dns\" and observer.hostname is not null and (source.ip not in (\"0.0.0.0\",\"255.255.255.255\") or destination.ip not in (\"0.0.0.0\",\"255.255.255.255\")) and dns.question.type is not null and dns.question.type != \"PTR\" and dns.response_code == \"NXDOMAIN\"\r\n| stats COUNT() by source.ip, dns.response_code, destination.domain, dns.question.type \r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" + "esql": "FROM logs-corelight.dns*\r\n| WHERE observer.vendor==\"Corelight\" \r\n AND event.dataset LIKE \"dns*\"\r\n AND observer.hostname IS NOT NULL\r\n AND NOT (COALESCE(source.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false) OR COALESCE(destination.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false)\r\n)\r\n AND dns.question.type is not null\r\n AND dns.question.type != \"PTR\" \r\n AND dns.response_code == \"NXDOMAIN\"\r\n| stats COUNT() by source.ip, dns.status_code, destination.domain, dns.question.type\r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" }, "timeField": "@timestamp" } @@ -725,7 +1285,7 @@ }, "filters": [], "query": { - "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where event.dataset == \"dns\" and observer.hostname is not null and (source.ip not in (\"0.0.0.0\",\"255.255.255.255\") or destination.ip not in (\"0.0.0.0\",\"255.255.255.255\")) and dns.question.type is not null and dns.question.type != \"PTR\" and dns.response_code == \"NXDOMAIN\"\r\n| stats COUNT() by source.ip, dns.response_code, destination.domain, dns.question.type \r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" + "esql": "FROM logs-corelight.dns*\r\n| WHERE observer.vendor==\"Corelight\" \r\n AND event.dataset LIKE \"dns*\"\r\n AND observer.hostname IS NOT NULL\r\n AND NOT (COALESCE(source.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false) OR COALESCE(destination.ip IN (\"0.0.0.0\",\"255.255.255.255\"), false)\r\n)\r\n AND dns.question.type is not null\r\n AND dns.question.type != \"PTR\" \r\n AND dns.response_code == \"NXDOMAIN\"\r\n| stats COUNT() by source.ip, dns.status_code, destination.domain, dns.question.type\r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" }, "visualization": { "columns": [ @@ -736,36 +1296,274 @@ "columnId": "Count" } ], - "layerId": "99d2b11e-4dfd-4ae4-aa07-5c1a7c0df652", + "layerId": "2484eab0-e946-40b8-8531-4959b5fdbf27", + "layerType": "data" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "bccaa371-d587-4cbf-a223-ba99e34148af", + "w": 18, + "x": 12, + "y": 22 + }, + "panelIndex": "bccaa371-d587-4cbf-a223-ba99e34148af", + "title": "Top 10 Queries by Count to Non-Existent Domains", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c5c7446a-f512-48dd-87cb-5a2958b34dca": { + "columnOrder": [ + "be18c230-e126-49aa-b56e-4a4b08e9be63", + "fa6cad12-4cbe-40a4-a16e-4512dce84450" + ], + "columns": { + "be18c230-e126-49aa-b56e-4a4b08e9be63": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "fa6cad12-4cbe-40a4-a16e-4512dce84450", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "fa6cad12-4cbe-40a4-a16e-4512dce84450": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "index": "639d5e72-0f5a-4052-8893-0a48bcf0b617", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "observer.vendor": "Corelight" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "5887bfdc-c8d6-4c27-94e0-37dab1ba075f", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "NOT is_broadcast: true", + "disabled": false, + "index": "1ffbe57c-2cbd-4bd9-98f5-bbd76b6753eb", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "source.ip", + "index": "logs-*", + "key": "source.ip", + "negate": true, + "params": [ + "0.0.0.0", + "255.255.255.255" + ], + "type": "phrases", + "value": [ + "0.0.0.0", + "255.255.255.255" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "source.ip": "0.0.0.0" + } + }, + { + "match_phrase": { + "source.ip": "255.255.255.255" + } + } + ] + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "destination.ip", + "index": "logs-*", + "key": "destination.ip", + "negate": true, + "params": [ + "0.0.0.0", + "255.255.255.255" + ], + "type": "phrases", + "value": [ + "0.0.0.0", + "255.255.255.255" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "destination.ip": "0.0.0.0" + } + }, + { + "match_phrase": { + "destination.ip": "255.255.255.255" + } + } + ] + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "be18c230-e126-49aa-b56e-4a4b08e9be63" + }, + { + "columnId": "fa6cad12-4cbe-40a4-a16e-4512dce84450" + } + ], + "layerId": "c5c7446a-f512-48dd-87cb-5a2958b34dca", "layerType": "data" } }, - "title": "Bar vertical stacked", + "title": "", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "from logs-corelight.dns*\r\n| limit 10000\r\n| where event.dataset == \"dns\" and observer.hostname is not null and (source.ip not in (\"0.0.0.0\",\"255.255.255.255\") or destination.ip not in (\"0.0.0.0\",\"255.255.255.255\")) and dns.question.type is not null and dns.question.type != \"PTR\" and dns.response_code == \"NXDOMAIN\"\r\n| stats COUNT() by source.ip, dns.response_code, destination.domain, dns.question.type \r\n| stats COUNT() by destination.domain \r\n| rename destination.domain as Query,`COUNT()` as Count\r\n| sort Count desc\r\n| limit 10\r\n| keep Query, Count" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 16, - "i": "721496d0-cd0e-45d7-bde1-4e38df936ade", + "i": "68d83d4a-8c09-41e5-b7ff-2811728654c4", "w": 18, - "x": 12, - "y": 16 + "x": 30, + "y": 22 }, - "panelIndex": "721496d0-cd0e-45d7-bde1-4e38df936ade", - "title": "Top 10 Queries by Count to Non-Existent Domains [Logs Corelight]", + "panelIndex": "68d83d4a-8c09-41e5-b7ff-2811728654c4", + "title": "Top Originators by Count", "type": "lens" }, { @@ -774,7 +1572,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-3f134d5e-ac9c-4b86-b0bf-137369691a82", + "name": "indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", "type": "index-pattern" } ], @@ -784,35 +1582,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "3f134d5e-ac9c-4b86-b0bf-137369691a82": { + "c5c7446a-f512-48dd-87cb-5a2958b34dca": { "columnOrder": [ - "d2d53912-8cf8-4fa2-a38d-532d5eaefe44", - "86d3fbb3-b146-4709-8e6c-0368c08133ba" + "be18c230-e126-49aa-b56e-4a4b08e9be63", + "fa6cad12-4cbe-40a4-a16e-4512dce84450" ], "columns": { - "86d3fbb3-b146-4709-8e6c-0368c08133ba": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "source.ip" - }, - "d2d53912-8cf8-4fa2-a38d-532d5eaefe44": { + "be18c230-e126-49aa-b56e-4a4b08e9be63": { "customLabel": true, - "dataType": "ip", + "dataType": "string", "isBucketed": true, - "label": "Source IP", + "label": "Query", "operationType": "terms", "params": { "exclude": [], @@ -821,7 +1601,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "86d3fbb3-b146-4709-8e6c-0368c08133ba", + "columnId": "fa6cad12-4cbe-40a4-a16e-4512dce84450", "type": "column" }, "orderDirection": "desc", @@ -830,10 +1610,28 @@ "id": "terms" }, "secondaryFields": [], - "size": 10 + "size": 20 }, "scale": "ordinal", - "sourceField": "source.ip" + "sourceField": "dns.question.name" + }, + "fa6cad12-4cbe-40a4-a16e-4512dce84450": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" } }, "ignoreGlobalFilters": false, @@ -851,6 +1649,108 @@ } }, "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "dns.response_code", + "index": "49f7e628-8600-4e66-b577-4915f2d66bbe", + "key": "dns.response_code", + "negate": false, + "params": [ + "NOERROR", + "No Error" + ], + "type": "phrases", + "value": [ + "NOERROR", + "No Error" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "dns.response_code": "NOERROR" + } + }, + { + "match_phrase": { + "dns.response_code": "No Error" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "dns.question.type", + "index": "74b63672-2adb-4cba-94a3-b7be3e60c8ff", + "key": "dns.question.type", + "negate": false, + "params": { + "query": "PTR" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "dns.question.type": "PTR" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "index": "639d5e72-0f5a-4052-8893-0a48bcf0b617", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "observer.vendor": "Corelight" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "5887bfdc-c8d6-4c27-94e0-37dab1ba075f", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, { "$state": { "store": "appState" @@ -858,7 +1758,7 @@ "meta": { "alias": "NOT is_broadcast: true", "disabled": false, - "index": "284c4fe0-79f1-4138-a21f-7012a1e303c1", + "index": "1ffbe57c-2cbd-4bd9-98f5-bbd76b6753eb", "negate": false, "params": [ { @@ -934,51 +1834,10 @@ } } ], - "relation": "OR", + "relation": "AND", "type": "combined" }, "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.type", - "index": "ae4a9a4f-363b-4b35-8da9-b5e6f2ff695c", - "key": "dns.question.type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "dns.question.type" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.name", - "index": "f4802908-31ff-43b2-afe5-41f66abb27c6", - "key": "dns.question.name", - "negate": true, - "params": { - "query": "PTR" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "dns.question.name": "PTR" - } - } } ], "internalReferences": [], @@ -989,177 +1848,35 @@ "visualization": { "columns": [ { - "columnId": "d2d53912-8cf8-4fa2-a38d-532d5eaefe44", - "isMetric": false, - "isTransposed": false + "columnId": "be18c230-e126-49aa-b56e-4a4b08e9be63" }, { - "columnId": "86d3fbb3-b146-4709-8e6c-0368c08133ba", - "isMetric": true, - "isTransposed": false + "columnId": "fa6cad12-4cbe-40a4-a16e-4512dce84450" } ], - "layerId": "3f134d5e-ac9c-4b86-b0bf-137369691a82", - "layerType": "data" + "layerId": "c5c7446a-f512-48dd-87cb-5a2958b34dca", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } } }, "title": "", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "284c4fe0-79f1-4138-a21f-7012a1e303c1", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.type", - "index": "ae4a9a4f-363b-4b35-8da9-b5e6f2ff695c", - "key": "dns.question.type", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "dns.question.type" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.name", - "index": "f4802908-31ff-43b2-afe5-41f66abb27c6", - "key": "dns.question.name", - "negate": true, - "params": { - "query": "PTR" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "dns.question.name": "PTR" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { - "h": 16, - "i": "3e25700f-0903-43b1-96cd-07c24b1df42b", - "w": 18, - "x": 30, - "y": 16 + "h": 18, + "i": "41a2df0a-bb06-4384-8d36-d94e807a51b8", + "w": 24, + "x": 0, + "y": 38 }, - "panelIndex": "3e25700f-0903-43b1-96cd-07c24b1df42b", - "title": "Top Originators by Count [Logs Corelight]", + "panelIndex": "41a2df0a-bb06-4384-8d36-d94e807a51b8", + "title": "Top Successful Reverse Queries by Count", "type": "lens" }, { @@ -1168,7 +1885,22 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-3f134d5e-ac9c-4b86-b0bf-137369691a82", + "name": "indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aae37c61-93e5-473f-a334-6c4ddb2ea4a1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6f86b4bb-9f8b-4565-8760-fd9a29563f98", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c453c6ba-b87c-41d1-9c97-714b91278eca", "type": "index-pattern" } ], @@ -1176,33 +1908,14 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "3f134d5e-ac9c-4b86-b0bf-137369691a82": { + "c5c7446a-f512-48dd-87cb-5a2958b34dca": { "columnOrder": [ - "d2d53912-8cf8-4fa2-a38d-532d5eaefe44", - "86d3fbb3-b146-4709-8e6c-0368c08133ba" + "be18c230-e126-49aa-b56e-4a4b08e9be63", + "fa6cad12-4cbe-40a4-a16e-4512dce84450" ], "columns": { - "86d3fbb3-b146-4709-8e6c-0368c08133ba": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "source.ip" - }, - "d2d53912-8cf8-4fa2-a38d-532d5eaefe44": { + "be18c230-e126-49aa-b56e-4a4b08e9be63": { "customLabel": true, "dataType": "string", "isBucketed": true, @@ -1215,7 +1928,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "86d3fbb3-b146-4709-8e6c-0368c08133ba", + "columnId": "fa6cad12-4cbe-40a4-a16e-4512dce84450", "type": "column" }, "orderDirection": "desc", @@ -1224,15 +1937,32 @@ "id": "terms" }, "secondaryFields": [], - "size": 10 + "size": 20 + }, + "scale": "ordinal", + "sourceField": "dns.question.name" + }, + "fa6cad12-4cbe-40a4-a16e-4512dce84450": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } }, - "scale": "ordinal", - "sourceField": "dns.question.name" + "scale": "ratio", + "sourceField": "___records___" } }, "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } @@ -1252,7 +1982,7 @@ "meta": { "alias": "NOT is_broadcast: true", "disabled": false, - "index": "010d86aa-2f1d-4fde-b3c3-9998ca5c7873", + "index": "aae37c61-93e5-473f-a334-6c4ddb2ea4a1", "negate": false, "params": [ { @@ -1328,7 +2058,7 @@ } } ], - "relation": "OR", + "relation": "AND", "type": "combined" }, "query": {} @@ -1340,18 +2070,18 @@ "meta": { "alias": null, "disabled": false, - "field": "dns.question.type", - "index": "deba2c9a-1a51-45e7-8a51-f1258e7537a0", - "key": "dns.question.type", + "field": "dns.response_code", + "index": "6f86b4bb-9f8b-4565-8760-fd9a29563f98", + "key": "dns.response_code", "negate": false, "params": { - "query": "PTR" + "query": "NXDOMAIN" }, "type": "phrase" }, "query": { "match_phrase": { - "dns.question.type": "PTR" + "dns.response_code": "NXDOMAIN" } } }, @@ -1362,289 +2092,41 @@ "meta": { "alias": null, "disabled": false, - "field": "dns.response_code", - "index": "fe7d2e6a-abff-483c-910f-da812c762118", - "key": "dns.response_code", + "field": "dns.question.type", + "index": "c453c6ba-b87c-41d1-9c97-714b91278eca", + "key": "dns.question.type", "negate": false, - "params": { - "query": "NOERROR" - }, - "type": "phrase" + "type": "exists", + "value": "exists" }, "query": { - "match_phrase": { - "dns.response_code": "NOERROR" + "exists": { + "field": "dns.question.type" } } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "d2d53912-8cf8-4fa2-a38d-532d5eaefe44", - "isMetric": false, - "isTransposed": false + }, + { + "$state": { + "store": "appState" }, - { - "columnId": "86d3fbb3-b146-4709-8e6c-0368c08133ba", - "isMetric": true, - "isTransposed": false - } - ], - "layerId": "3f134d5e-ac9c-4b86-b0bf-137369691a82", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "NOT is_broadcast: true", - "disabled": false, - "index": "010d86aa-2f1d-4fde-b3c3-9998ca5c7873", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "index": "639d5e72-0f5a-4052-8893-0a48bcf0b617", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } + "type": "phrase" }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.type", - "index": "deba2c9a-1a51-45e7-8a51-f1258e7537a0", - "key": "dns.question.type", - "negate": false, - "params": { - "query": "PTR" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "dns.question.type": "PTR" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.response_code", - "index": "fe7d2e6a-abff-483c-910f-da812c762118", - "key": "dns.response_code", - "negate": false, - "params": { - "query": "NOERROR" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "dns.response_code": "NOERROR" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false - }, - "gridData": { - "h": 16, - "i": "c290adec-d4e0-45ae-b345-435c5e533b96", - "w": 24, - "x": 0, - "y": 32 - }, - "panelIndex": "c290adec-d4e0-45ae-b345-435c5e533b96", - "title": "Top Successful Reverse Queries by Count [Logs Corelight]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3f134d5e-ac9c-4b86-b0bf-137369691a82", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "3f134d5e-ac9c-4b86-b0bf-137369691a82": { - "columnOrder": [ - "d2d53912-8cf8-4fa2-a38d-532d5eaefe44", - "86d3fbb3-b146-4709-8e6c-0368c08133ba" - ], - "columns": { - "86d3fbb3-b146-4709-8e6c-0368c08133ba": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "source.ip" - }, - "d2d53912-8cf8-4fa2-a38d-532d5eaefe44": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Query", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "86d3fbb3-b146-4709-8e6c-0368c08133ba", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "dns.question.name" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 + "query": { + "match_phrase": { + "observer.vendor": "Corelight" } } }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} - } - }, - "filters": [ { "$state": { "store": "appState" @@ -1652,18 +2134,15 @@ "meta": { "alias": null, "disabled": false, - "field": "dns.question.type", - "index": "58502378-aee5-46fc-900c-d5f7e3d8b2b1", - "key": "dns.question.type", + "field": "observer.hostname", + "index": "5887bfdc-c8d6-4c27-94e0-37dab1ba075f", + "key": "observer.hostname", "negate": false, - "params": { - "query": "PTR" - }, - "type": "phrase" + "type": "exists" }, "query": { - "match_phrase": { - "dns.question.type": "PTR" + "exists": { + "field": "observer.hostname" } } }, @@ -1674,18 +2153,18 @@ "meta": { "alias": null, "disabled": false, - "field": "dns.response_code", - "index": "da32798d-4816-4197-989d-24fc24721ebc", - "key": "dns.response_code", + "field": "dns.question.type", + "index": "74b63672-2adb-4cba-94a3-b7be3e60c8ff", + "key": "dns.question.type", "negate": false, "params": { - "query": "NXDOMAIN" + "query": "PTR" }, "type": "phrase" }, "query": { "match_phrase": { - "dns.response_code": "NXDOMAIN" + "dns.question.type": "PTR" } } } @@ -1698,101 +2177,44 @@ "visualization": { "columns": [ { - "columnId": "d2d53912-8cf8-4fa2-a38d-532d5eaefe44", - "isMetric": false, - "isTransposed": false + "columnId": "be18c230-e126-49aa-b56e-4a4b08e9be63" }, { - "columnId": "86d3fbb3-b146-4709-8e6c-0368c08133ba", - "isMetric": true, - "isTransposed": false + "columnId": "fa6cad12-4cbe-40a4-a16e-4512dce84450" } ], - "layerId": "3f134d5e-ac9c-4b86-b0bf-137369691a82", - "layerType": "data" + "layerId": "c5c7446a-f512-48dd-87cb-5a2958b34dca", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } } }, "title": "", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.question.type", - "index": "58502378-aee5-46fc-900c-d5f7e3d8b2b1", - "key": "dns.question.type", - "negate": false, - "params": { - "query": "PTR" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "dns.question.type": "PTR" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "dns.response_code", - "index": "da32798d-4816-4197-989d-24fc24721ebc", - "key": "dns.response_code", - "negate": false, - "params": { - "query": "NXDOMAIN" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "dns.response_code": "NXDOMAIN" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { - "h": 16, - "i": "ca0e5213-8767-40d1-8757-da72ba1b4bf6", + "h": 18, + "i": "8e482549-6c69-4f90-ae3e-cfe57463b4df", "w": 24, "x": 24, - "y": 32 + "y": 38 }, - "panelIndex": "ca0e5213-8767-40d1-8757-da72ba1b4bf6", - "title": "Top Reverse Queries by Count to Non-Existent Domains [Logs Corelight]", + "panelIndex": "8e482549-6c69-4f90-ae3e-cfe57463b4df", + "title": "Top Reverse Queries by Count to Non-Existent Domains", "type": "lens" } ], "timeRestore": false, "title": "[Logs Corelight] DNS", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-07-15T13:35:20.020Z", "id": "corelight-58885f47-95e1-4242-a1ee-783de69ace17", "references": [ { @@ -1812,55 +2234,76 @@ }, { "id": "logs-*", - "name": "198a30fc-31cb-416d-a087-42d3d1905705:indexpattern-datasource-layer-8d61793d-b09e-4753-9178-efc0b6f492ae", + "name": "88d8cfed-e967-45ea-96aa-ab87c43d6e8b:indexpattern-datasource-layer-4beab937-e3c5-44db-90b8-d899847a1f9b", "type": "index-pattern" }, { "id": "logs-*", - "name": "3e25700f-0903-43b1-96cd-07c24b1df42b:indexpattern-datasource-layer-3f134d5e-ac9c-4b86-b0bf-137369691a82", + "name": "777810ab-fa79-438c-81d5-429b97465e43:indexpattern-datasource-layer-4beab937-e3c5-44db-90b8-d899847a1f9b", "type": "index-pattern" }, { "id": "logs-*", - "name": "c290adec-d4e0-45ae-b345-435c5e533b96:indexpattern-datasource-layer-3f134d5e-ac9c-4b86-b0bf-137369691a82", + "name": "777810ab-fa79-438c-81d5-429b97465e43:fd3486d4-28fc-469a-9b91-1b1fcc10d9ef", "type": "index-pattern" }, { "id": "logs-*", - "name": "ca0e5213-8767-40d1-8757-da72ba1b4bf6:indexpattern-datasource-layer-3f134d5e-ac9c-4b86-b0bf-137369691a82", + "name": "777810ab-fa79-438c-81d5-429b97465e43:ad01b2e0-7bcd-4e88-9309-0cee883b6710", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_d6ddd074-8637-4e45-850b-1af34924737f:optionsListDataView", + "name": "df9bfc1a-b21d-4ff3-8a77-201a75a364e8:indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_716b7efb-887b-41b6-9e26-3211630e5305:optionsListDataView", + "name": "68d83d4a-8c09-41e5-b7ff-2811728654c4:indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_f30e42d8-e9d4-44b1-bb10-9ca6c649c763:optionsListDataView", + "name": "41a2df0a-bb06-4384-8d36-d94e807a51b8:indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "8e482549-6c69-4f90-ae3e-cfe57463b4df:indexpattern-datasource-layer-c5c7446a-f512-48dd-87cb-5a2958b34dca", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "8e482549-6c69-4f90-ae3e-cfe57463b4df:aae37c61-93e5-473f-a334-6c4ddb2ea4a1", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "name": "8e482549-6c69-4f90-ae3e-cfe57463b4df:6f86b4bb-9f8b-4565-8760-fd9a29563f98", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8e482549-6c69-4f90-ae3e-cfe57463b4df:c453c6ba-b87c-41d1-9c97-714b91278eca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_d6ddd074-8637-4e45-850b-1af34924737f:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_716b7efb-887b-41b6-9e26-3211630e5305:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_f30e42d8-e9d4-44b1-bb10-9ca6c649c763:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4.json b/packages/corelight/kibana/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4.json new file mode 100644 index 00000000000..956095f8622 --- /dev/null +++ b/packages/corelight/kibana/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4.json @@ -0,0 +1,1984 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": { + "3773b2cc-155b-4cef-9453-79197faf59f3": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "host.ip", + "id": "3773b2cc-155b-4cef-9453-79197faf59f3", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Host IP" + }, + "grow": true, + "order": 0, + "type": "optionsListControl", + "width": "medium" + }, + "7f63d923-db47-4a0c-8a12-963bcdcb8bb0": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "corelight.asset_classification.type_group", + "id": "7f63d923-db47-4a0c-8a12-963bcdcb8bb0", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Type Group" + }, + "grow": true, + "order": 3, + "type": "optionsListControl", + "width": "medium" + }, + "9d3029ad-b040-4782-a9e5-a99043453282": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "corelight.asset_classification.type_name", + "id": "9d3029ad-b040-4782-a9e5-a99043453282", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Type Name" + }, + "grow": true, + "order": 2, + "type": "optionsListControl", + "width": "medium" + }, + "d62f7d06-fcb8-4980-8801-fa8f236e6727": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "host.os.name", + "id": "d62f7d06-fcb8-4980-8801-fa8f236e6727", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Host OS" + }, + "grow": true, + "order": 1, + "type": "optionsListControl", + "width": "medium" + } + }, + "showApplySelections": false + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "observer.vendor": "Corelight" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "event.dataset", + "negate": false, + "params": { + "query": "asset_classification" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "asset_classification" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - **Asset Classification**\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 31, + "i": "50a58f59-7052-4c21-83d3-b3aeb76ae708", + "w": 11, + "x": 0, + "y": 0 + }, + "panelIndex": "50a58f59-7052-4c21-83d3-b3aeb76ae708", + "title": "Table of Contents", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "fcc44b05-918c-4543-8a68-744c1789b38e": { + "columns": [ + { + "columnId": "unique_devices", + "fieldName": "unique_devices", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "host.manufacturer", + "fieldName": "host.manufacturer", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL host.manufacturer = COALESCE(host.manufacturer, \"unknown\")\r\n| EVAL host.mac = COALESCE(host.mac, \"unknown\")\r\n| STATS unique_devices = COUNT_DISTINCT(host.mac) BY host.manufacturer \r\n| SORT unique_devices DESC\r\n| LIMIT 15" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL host.manufacturer = COALESCE(host.manufacturer, \"unknown\")\r\n| EVAL host.mac = COALESCE(host.mac, \"unknown\")\r\n| STATS unique_devices = COUNT_DISTINCT(host.mac) BY host.manufacturer \r\n| SORT unique_devices DESC\r\n| LIMIT 15" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0.54, + "layerId": "fcc44b05-918c-4543-8a68-744c1789b38e", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "unique_devices" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "host.manufacturer" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "description": "By Unique MAC Addresses", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "8e600d46-c7b5-4716-a48e-e397c41f9343", + "w": 18, + "x": 11, + "y": 0 + }, + "panelIndex": "8e600d46-c7b5-4716-a48e-e397c41f9343", + "title": "Brand Breakdown", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "a43f80ee-ebc1-4566-818c-c60ff77a38f1": { + "columns": [ + { + "columnId": "unique_devices", + "fieldName": "unique_devices", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "type_name", + "fieldName": "type_name", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL type_name = COALESCE(corelight.asset_classification.type_name, \"unknown\")\r\n| EVAL host.mac = COALESCE(host.mac, \"unknown\")\r\n| STATS unique_devices = COUNT_DISTINCT(host.mac) BY type_name\r\n| SORT unique_devices DESC\r\n| LIMIT 10" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL type_name = COALESCE(corelight.asset_classification.type_name, \"unknown\")\r\n| EVAL host.mac = COALESCE(host.mac, \"unknown\")\r\n| STATS unique_devices = COUNT_DISTINCT(host.mac) BY type_name\r\n| SORT unique_devices DESC\r\n| LIMIT 10" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0.54, + "layerId": "a43f80ee-ebc1-4566-818c-c60ff77a38f1", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "unique_devices" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "type_name" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "description": "By Unique MAC Addresses", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "b2c211d0-4504-49a0-96cd-49e7e14b756c", + "w": 19, + "x": 29, + "y": 0 + }, + "panelIndex": "b2c211d0-4504-49a0-96cd-49e7e14b756c", + "title": "Device Type Breakdown", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "7054eb66-d225-4f06-8bfe-1e69bee0234c": { + "columns": [ + { + "columnId": "Devices", + "fieldName": "Devices", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "corelight.asset_classification.sources", + "fieldName": "corelight.asset_classification.sources", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL corelight.asset_classification.sources =\r\n CASE(\r\n corelight.asset_classification.sources == \"http\"\r\n AND corelight.asset_classification.sources == \"dhcp\",\r\n MV_APPEND(corelight.asset_classification.sources, \"both\"),\r\n corelight.asset_classification.sources\r\n )\r\n| MV_EXPAND corelight.asset_classification.sources\r\n| STATS Devices = COUNT_DISTINCT(host.ip)\r\n BY corelight.asset_classification.sources\r\n| SORT Devices DESC\r\n| LIMIT 10" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL corelight.asset_classification.sources =\r\n CASE(\r\n corelight.asset_classification.sources == \"http\"\r\n AND corelight.asset_classification.sources == \"dhcp\",\r\n MV_APPEND(corelight.asset_classification.sources, \"both\"),\r\n corelight.asset_classification.sources\r\n )\r\n| MV_EXPAND corelight.asset_classification.sources\r\n| STATS Devices = COUNT_DISTINCT(host.ip)\r\n BY corelight.asset_classification.sources\r\n| SORT Devices DESC\r\n| LIMIT 10" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0.54, + "layerId": "7054eb66-d225-4f06-8bfe-1e69bee0234c", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "Devices" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "corelight.asset_classification.sources" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "description": "By Unique IP Addresses", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "33a77efa-0b39-4830-9ea1-6c2a6e1b3ece", + "w": 11, + "x": 11, + "y": 15 + }, + "panelIndex": "33a77efa-0b39-4830-9ea1-6c2a6e1b3ece", + "title": "Discovery Source", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "b5868438-bc25-4326-95da-340e4a75e2e9": { + "columns": [ + { + "columnId": "Unique Devices", + "fieldName": "Unique Devices", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "os_full", + "fieldName": "os_full", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL host.os.version = COALESCE(host.os.version, \"Unknown\")\r\n| EVAL host.os.name = COALESCE(host.os.name, \"Unknown\")\r\n| EVAL os_full =\r\n CASE(\r\n host.os.version != \"Unknown\",\r\n CONCAT(host.os.name, \" \", host.os.version),\r\n host.os.name\r\n )\r\n| STATS `Unique Devices` = COUNT_DISTINCT(host.mac) BY os_full\r\n| SORT `Unique Devices` DESC\r\n| LIMIT 10" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n| EVAL host.os.version = COALESCE(host.os.version, \"Unknown\")\r\n| EVAL host.os.name = COALESCE(host.os.name, \"Unknown\")\r\n| EVAL os_full =\r\n CASE(\r\n host.os.version != \"Unknown\",\r\n CONCAT(host.os.name, \" \", host.os.version),\r\n host.os.name\r\n )\r\n| STATS `Unique Devices` = COUNT_DISTINCT(host.mac) BY os_full\r\n| SORT `Unique Devices` DESC\r\n| LIMIT 10" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0.54, + "layerId": "b5868438-bc25-4326-95da-340e4a75e2e9", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "Unique Devices" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "os_full" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "description": "By Unique MAC Addresses", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "0a73a12f-15e0-4aae-94db-845c104659e6", + "w": 13, + "x": 22, + "y": 15 + }, + "panelIndex": "0a73a12f-15e0-4aae-94db-845c104659e6", + "title": "Operating System Versions", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "a35b6542-2b73-47db-a974-270a15e04127": { + "columns": [ + { + "columnId": "Unique Devices", + "fieldName": "Unique Devices", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "Type Group", + "fieldName": "Type Group", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\" \r\nAND event.dataset == \"asset_classification\" \r\n| EVAL `Type Group` = COALESCE(corelight.asset_classification.type_group, \"Unknown\")\r\n| STATS `Unique Devices` = COUNT_DISTINCT(host.ip) BY `Type Group`\r\n| SORT `Unique Devices` DESC\r\n| LIMIT 10" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\" \r\nAND event.dataset == \"asset_classification\" \r\n| EVAL `Type Group` = COALESCE(corelight.asset_classification.type_group, \"Unknown\")\r\n| STATS `Unique Devices` = COUNT_DISTINCT(host.ip) BY `Type Group`\r\n| SORT `Unique Devices` DESC\r\n| LIMIT 10" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "emptySizeRatio": 0.54, + "layerId": "a35b6542-2b73-47db-a974-270a15e04127", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "Unique Devices" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "Type Group" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "description": "By Unique IP Addresses", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "ecd06328-6078-4b2e-b3f5-76924aca5ae8", + "w": 13, + "x": 35, + "y": 15 + }, + "panelIndex": "ecd06328-6078-4b2e-b3f5-76924aca5ae8", + "title": "Device Groupings", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "By Unique IP Addresses", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b2a1546-5c0a-4b62-8a51-d1856c6b810b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2b2a1546-5c0a-4b62-8a51-d1856c6b810b": { + "columnOrder": [ + "f066e4eb-3772-4914-bf18-47cb86e0cf06", + "31f80b5f-06a8-4e19-b610-fbf38d4dd807", + "92de64f3-c181-4c27-8b26-0bded7bfd19a" + ], + "columns": { + "31f80b5f-06a8-4e19-b610-fbf38d4dd807": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "92de64f3-c181-4c27-8b26-0bded7bfd19a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Active Assets", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "host.ip" + }, + "f066e4eb-3772-4914-bf18-47cb86e0cf06": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host Model", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "92de64f3-c181-4c27-8b26-0bded7bfd19a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.model" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "16d3b32e-b867-4e4d-a79c-557f44a0035c", + "key": "event.dataset", + "negate": false, + "params": { + "query": "asset_classification" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "asset_classification" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "92de64f3-c181-4c27-8b26-0bded7bfd19a" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "2b2a1546-5c0a-4b62-8a51-d1856c6b810b", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "f066e4eb-3772-4914-bf18-47cb86e0cf06", + "xAccessor": "31f80b5f-06a8-4e19-b610-fbf38d4dd807" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "By Unique IP Addresses", + "enhancements": {} + }, + "gridData": { + "h": 14, + "i": "61116bed-5252-4cbb-98e5-a43b8bed291b", + "w": 26, + "x": 0, + "y": 31 + }, + "panelIndex": "61116bed-5252-4cbb-98e5-a43b8bed291b", + "title": "Top Models over Time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "description": "By Unique IP Addresses", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b2a1546-5c0a-4b62-8a51-d1856c6b810b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b1a32e7b-065a-457d-a0f3-76f3dea81456", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2b2a1546-5c0a-4b62-8a51-d1856c6b810b": { + "columnOrder": [ + "f066e4eb-3772-4914-bf18-47cb86e0cf06", + "31f80b5f-06a8-4e19-b610-fbf38d4dd807", + "92de64f3-c181-4c27-8b26-0bded7bfd19a" + ], + "columns": { + "31f80b5f-06a8-4e19-b610-fbf38d4dd807": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "92de64f3-c181-4c27-8b26-0bded7bfd19a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Active Assets", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "host.mac" + }, + "f066e4eb-3772-4914-bf18-47cb86e0cf06": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Type Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "92de64f3-c181-4c27-8b26-0bded7bfd19a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "corelight.asset_classification.type_name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "corelight.asset_classification.type_name", + "index": "b1a32e7b-065a-457d-a0f3-76f3dea81456", + "key": "corelight.asset_classification.type_name", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "corelight.asset_classification.type_name" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "16d3b32e-b867-4e4d-a79c-557f44a0035c", + "key": "event.dataset", + "negate": false, + "params": { + "query": "asset_classification" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "asset_classification" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "92de64f3-c181-4c27-8b26-0bded7bfd19a" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "2b2a1546-5c0a-4b62-8a51-d1856c6b810b", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "f066e4eb-3772-4914-bf18-47cb86e0cf06", + "xAccessor": "31f80b5f-06a8-4e19-b610-fbf38d4dd807" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "By Unique MAC Addresses", + "enhancements": {} + }, + "gridData": { + "h": 14, + "i": "e2ee76c1-33d3-4a49-9757-7e243c63f8e4", + "w": 22, + "x": 26, + "y": 31 + }, + "panelIndex": "e2ee76c1-33d3-4a49-9757-7e243c63f8e4", + "title": "Device Types over Time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "cf7c0562-7e72-4eef-9cf0-47c8d6be62be": { + "allColumns": [ + { + "columnId": "Type Group", + "fieldName": "Type Group", + "inMetricDimension": true, + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "f40eacba-ec14-4878-aa68-7954f544802e", + "fieldName": "Host IP", + "meta": { + "esType": "ip", + "type": "ip" + } + }, + { + "columnId": "7ec1b25d-60ba-433f-aaf9-074dbc8a3bb0", + "fieldName": "OS Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "392c06ea-3617-4e77-99da-57562bd0efb7", + "fieldName": "Type Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "OS Name", + "fieldName": "OS Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "Type Name", + "fieldName": "Type Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "Host IP", + "fieldName": "Host IP", + "meta": { + "esType": "ip", + "type": "ip" + } + } + ], + "columns": [ + { + "columnId": "f40eacba-ec14-4878-aa68-7954f544802e", + "fieldName": "Host IP", + "meta": { + "esType": "ip", + "type": "ip" + } + }, + { + "columnId": "7ec1b25d-60ba-433f-aaf9-074dbc8a3bb0", + "fieldName": "OS Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "392c06ea-3617-4e77-99da-57562bd0efb7", + "fieldName": "Type Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "135967d1-a1dd-4bb5-8592-a405d3f26cbd", + "fieldName": "Type Group", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n AND observer.hostname IS NOT NULL\r\n AND host.os.name IS NOT NULL\r\n AND corelight.asset_classification.type_group IS NOT NULL\r\n AND corelight.asset_classification.type_name IS NOT NULL\r\n AND host.ip IS NOT NULL\r\n| EVAL host.os.name =\r\n CASE(\r\n host.os.name IS NULL OR host.os.name == \"\",\r\n \"Unknown\",\r\n host.os.name\r\n )\r\n| EVAL corelight.asset_classification.type_name =\r\n CASE(\r\n corelight.asset_classification.type_name IS NULL\r\n OR corelight.asset_classification.type_name == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_name\r\n )\r\n| EVAL corelight.asset_classification.type_group =\r\n CASE(\r\n corelight.asset_classification.type_group IS NULL\r\n OR corelight.asset_classification.type_group == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_group\r\n )\r\n| STATS\r\n `OS Name` = VALUES(host.os.name),\r\n `Type Name` = VALUES(corelight.asset_classification.type_name),\r\n `Type Group` = VALUES(corelight.asset_classification.type_group)\r\n BY host.ip\r\n| SORT host.ip ASC\r\n| RENAME host.ip AS `Host IP`\r\n| LIMIT 100" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n AND observer.hostname IS NOT NULL\r\n AND host.os.name IS NOT NULL\r\n AND corelight.asset_classification.type_group IS NOT NULL\r\n AND corelight.asset_classification.type_name IS NOT NULL\r\n AND host.ip IS NOT NULL\r\n| EVAL host.os.name =\r\n CASE(\r\n host.os.name IS NULL OR host.os.name == \"\",\r\n \"Unknown\",\r\n host.os.name\r\n )\r\n| EVAL corelight.asset_classification.type_name =\r\n CASE(\r\n corelight.asset_classification.type_name IS NULL\r\n OR corelight.asset_classification.type_name == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_name\r\n )\r\n| EVAL corelight.asset_classification.type_group =\r\n CASE(\r\n corelight.asset_classification.type_group IS NULL\r\n OR corelight.asset_classification.type_group == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_group\r\n )\r\n| STATS\r\n `OS Name` = VALUES(host.os.name),\r\n `Type Name` = VALUES(corelight.asset_classification.type_name),\r\n `Type Group` = VALUES(corelight.asset_classification.type_group)\r\n BY host.ip\r\n| SORT host.ip ASC\r\n| RENAME host.ip AS `Host IP`\r\n| LIMIT 100" + }, + "visualization": { + "columns": [ + { + "columnId": "f40eacba-ec14-4878-aa68-7954f544802e", + "isMetric": false, + "isTransposed": false, + "oneClickFilter": true + }, + { + "columnId": "7ec1b25d-60ba-433f-aaf9-074dbc8a3bb0", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "392c06ea-3617-4e77-99da-57562bd0efb7", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "135967d1-a1dd-4bb5-8592-a405d3f26cbd", + "isMetric": false, + "isTransposed": false + } + ], + "layerId": "cf7c0562-7e72-4eef-9cf0-47c8d6be62be", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "Table OS Name \u0026 Type Name \u0026 Type Group \u0026 Host IP", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 18, + "i": "364819ac-2984-40e2-8cf9-f3a6a19078e2", + "w": 17, + "x": 0, + "y": 45 + }, + "panelIndex": "364819ac-2984-40e2-8cf9-f3a6a19078e2", + "title": "Classification Details per Host", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "06ec213b-cfaa-43e5-b5ac-0996c8d695ff": { + "columns": [ + { + "columnId": "Type Name", + "fieldName": "Type Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "Brand", + "fieldName": "Brand", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "Model", + "fieldName": "Model", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "1c85f1fb-5606-46bd-942f-b80e8de1c0a4", + "fieldName": "Count", + "meta": { + "esType": "long", + "type": "number" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\"\r\n| EVAL `Type Name` =\r\n CASE(\r\n corelight.asset_classification.device_type IS NULL\r\n OR corelight.asset_classification.device_type == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.device_type\r\n )\r\n| EVAL Brand =\r\n CASE(\r\n host.manufacturer IS NULL\r\n OR host.manufacturer == \"\",\r\n \"Unknown\",\r\n host.manufacturer\r\n )\r\n| EVAL Model =\r\n CASE(\r\n host.model IS NULL\r\n OR host.model == \"\",\r\n \"Unknown\",\r\n host.model\r\n )\r\n| EVAL type_group =\r\n CASE(\r\n corelight.asset_classification.type_group IS NULL\r\n OR corelight.asset_classification.type_group == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_group\r\n )\r\n| WHERE corelight.asset_classification.type_group IN (\"Audio \u0026 Video\", \"Smart Home\")\r\n OR corelight.asset_classification.device_type == \"GAME_CONSOLE\"\r\n| STATS Count = COUNT_DISTINCT(host.ip)\r\n BY `Type Name`,\r\n Brand ,\r\n Model \r\n| SORT Count DESC\r\n| LIMIT 100" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\"\r\n| EVAL `Type Name` =\r\n CASE(\r\n corelight.asset_classification.device_type IS NULL\r\n OR corelight.asset_classification.device_type == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.device_type\r\n )\r\n| EVAL Brand =\r\n CASE(\r\n host.manufacturer IS NULL\r\n OR host.manufacturer == \"\",\r\n \"Unknown\",\r\n host.manufacturer\r\n )\r\n| EVAL Model =\r\n CASE(\r\n host.model IS NULL\r\n OR host.model == \"\",\r\n \"Unknown\",\r\n host.model\r\n )\r\n| EVAL type_group =\r\n CASE(\r\n corelight.asset_classification.type_group IS NULL\r\n OR corelight.asset_classification.type_group == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_group\r\n )\r\n| WHERE corelight.asset_classification.type_group IN (\"Audio \u0026 Video\", \"Smart Home\")\r\n OR corelight.asset_classification.device_type == \"GAME_CONSOLE\"\r\n| STATS Count = COUNT_DISTINCT(host.ip)\r\n BY `Type Name`,\r\n Brand ,\r\n Model \r\n| SORT Count DESC\r\n| LIMIT 100" + }, + "visualization": { + "columns": [ + { + "columnId": "Type Name" + }, + { + "columnId": "Brand" + }, + { + "columnId": "Model" + }, + { + "columnId": "1c85f1fb-5606-46bd-942f-b80e8de1c0a4", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "06ec213b-cfaa-43e5-b5ac-0996c8d695ff", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "Pie", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 18, + "i": "9f0518a8-1bf0-43ec-96fc-2e644d64e17c", + "w": 16, + "x": 17, + "y": 45 + }, + "panelIndex": "9f0518a8-1bf0-43ec-96fc-2e644d64e17c", + "title": "Detected IoT (Audio, Video, Gaming)", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "d8a0b14a-1378-4f1f-97a7-dc4239b475c6": { + "allColumns": [ + { + "columnId": "Unique Devices", + "fieldName": "Unique Devices", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "Host OS", + "fieldName": "Host OS", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "columns": [ + { + "columnId": "Host OS", + "fieldName": "Host OS", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "4bdae950-6c91-4a2d-8528-eb8a3163b8fb", + "fieldName": "Unique Devices", + "meta": { + "esType": "long", + "type": "number" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\" \r\nAND event.dataset == \"asset_classification\" \r\n| EVAL `Host OS` =\r\n CASE(\r\n host.os.name IS NULL\r\n OR host.os.name == \"\",\r\n \"Unknown\",\r\n host.os.name\r\n )\r\n| STATS `Unique Devices` = COUNT_DISTINCT(host.mac) BY `Host OS`\r\n| SORT `Unique Devices` DESC\r\n| LIMIT 10" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\" \r\nAND event.dataset == \"asset_classification\" \r\n| EVAL `Host OS` =\r\n CASE(\r\n host.os.name IS NULL\r\n OR host.os.name == \"\",\r\n \"Unknown\",\r\n host.os.name\r\n )\r\n| STATS `Unique Devices` = COUNT_DISTINCT(host.mac) BY `Host OS`\r\n| SORT `Unique Devices` DESC\r\n| LIMIT 10" + }, + "visualization": { + "columns": [ + { + "columnId": "Host OS" + }, + { + "columnId": "4bdae950-6c91-4a2d-8528-eb8a3163b8fb", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "d8a0b14a-1378-4f1f-97a7-dc4239b475c6", + "layerType": "data" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "description": "By Unique MAC Addresses", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 18, + "i": "2bd1ddaa-4ecc-4d65-b67d-c17a1d6c845f", + "w": 15, + "x": 33, + "y": 45 + }, + "panelIndex": "2bd1ddaa-4ecc-4d65-b67d-c17a1d6c845f", + "title": "Total Operating Systems", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "name": "logs-corelight.various-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.various-*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "timeField": "@timestamp", + "title": "logs-corelight.various-*" + } + ], + "layers": { + "09446ea1-f951-4dfe-a22f-b41852c902dd": { + "allColumns": [ + { + "columnId": "OS Version", + "fieldName": "OS Version", + "inMetricDimension": true, + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "cd981a43-111d-4bc0-a754-04d39d692dd1", + "fieldName": "@timestamp", + "meta": { + "esType": "date", + "type": "date" + } + }, + { + "columnId": "e5d56dec-99f8-44e6-874b-f58a1e08b373", + "fieldName": "Host IP", + "meta": { + "esType": "ip", + "type": "ip" + } + }, + { + "columnId": "1b300581-7e35-4a85-b505-0946b7acb795", + "fieldName": "MAC", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "4685148e-3548-4eb0-b859-ea88fac7b844", + "fieldName": "OS Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "@timestamp", + "fieldName": "@timestamp", + "meta": { + "esType": "date", + "type": "date" + } + }, + { + "columnId": "Host IP", + "fieldName": "Host IP", + "meta": { + "esType": "ip", + "type": "ip" + } + }, + { + "columnId": "MAC", + "fieldName": "MAC", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "OS Name", + "fieldName": "OS Name", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "columns": [ + { + "columnId": "cd981a43-111d-4bc0-a754-04d39d692dd1", + "fieldName": "@timestamp", + "meta": { + "esType": "date", + "type": "date" + } + }, + { + "columnId": "e5d56dec-99f8-44e6-874b-f58a1e08b373", + "fieldName": "Host IP", + "meta": { + "esType": "ip", + "type": "ip" + } + }, + { + "columnId": "1b300581-7e35-4a85-b505-0946b7acb795", + "fieldName": "MAC", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "4685148e-3548-4eb0-b859-ea88fac7b844", + "fieldName": "OS Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "d88f7bbe-8810-4759-94ca-a192e4454e6a", + "fieldName": "OS Version", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "6b4410f0-09cb-4a7b-a460-7e8ca92e5d64", + "fieldName": "Type Name", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "ef897360-b4e1-4282-b263-5522498b6277", + "fieldName": "Type Group", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "98ee08a8-a3f7-4bf0-811c-1343be90dcb4", + "fieldName": "Brand", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "0e39c0da-dd82-4ff5-be6d-cd3d19cc11d5", + "fieldName": "Model", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "334a1c4d-5a7b-4238-abf0-bd4a7e009a6f", + "fieldName": "Confidence", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "c54f71ae-426b-4e5f-9f89-cc74f804b4e4", + "fieldName": "Sources", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "b2bcbb11fd7b30e2a9f2ee93a6a5ffd1f700ee82fff0bfc92dd439c707a35ebb", + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n\r\n| EVAL host.os.name =\r\n CASE(\r\n host.os.name IS NULL OR host.os.name == \"\",\r\n \"Unknown\",\r\n host.os.name\r\n )\r\n\r\n| EVAL host.mac =\r\n CASE(\r\n host.mac IS NULL OR host.mac == \"\",\r\n \"Unknown\",\r\n host.mac\r\n )\r\n\r\n| EVAL host.os.version =\r\n CASE(\r\n host.os.version IS NULL OR host.os.version == \"\",\r\n \"Unknown\",\r\n host.os.version\r\n )\r\n\r\n| EVAL type_name =\r\n CASE(\r\n corelight.asset_classification.type_name IS NULL\r\n OR corelight.asset_classification.type_name == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_name\r\n )\r\n\r\n| EVAL type_group =\r\n CASE(\r\n corelight.asset_classification.type_group IS NULL\r\n OR corelight.asset_classification.type_group == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_group\r\n )\r\n\r\n| EVAL host.manufacturer =\r\n CASE(\r\n host.manufacturer IS NULL OR host.manufacturer == \"\",\r\n \"Unknown\",\r\n host.manufacturer\r\n )\r\n\r\n| EVAL host.model =\r\n CASE(\r\n host.model IS NULL OR host.model == \"\",\r\n \"Unknown\",\r\n host.model\r\n )\r\n\r\n| EVAL Confidence =\r\n CASE(\r\n corelight.asset_classification.confidence \u003e= 40, \"High\",\r\n corelight.asset_classification.confidence \u003e= 20\r\n AND corelight.asset_classification.confidence \u003c= 39, \"Medium\",\r\n corelight.asset_classification.confidence \u003e= 1\r\n AND corelight.asset_classification.confidence \u003c= 19, \"Low\",\r\n \"Unknown\"\r\n )\r\n\r\n| STATS\r\n MAC = VALUES(host.mac),\r\n `OS Name` = VALUES(host.os.name),\r\n `OS Version` = VALUES(host.os.version),\r\n `Type Name` = VALUES(type_name),\r\n `Type Group` = VALUES(type_group),\r\n Brand = VALUES(host.manufacturer),\r\n Model = VALUES(host.model),\r\n Sources = VALUES(corelight.asset_classification.sources)\r\n BY @timestamp, host.ip, Confidence\r\n| RENAME host.ip AS `Host IP`\r\n| KEEP\r\n @timestamp,\r\n `Host IP`,\r\n MAC,\r\n `OS Name`,\r\n `OS Version`,\r\n `Type Name`,\r\n `Type Group`,\r\n Brand,\r\n Model,\r\n Confidence,\r\n Sources\r\n| LIMIT 100" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.various-*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND event.dataset == \"asset_classification\" \r\n\r\n| EVAL host.os.name =\r\n CASE(\r\n host.os.name IS NULL OR host.os.name == \"\",\r\n \"Unknown\",\r\n host.os.name\r\n )\r\n\r\n| EVAL host.mac =\r\n CASE(\r\n host.mac IS NULL OR host.mac == \"\",\r\n \"Unknown\",\r\n host.mac\r\n )\r\n\r\n| EVAL host.os.version =\r\n CASE(\r\n host.os.version IS NULL OR host.os.version == \"\",\r\n \"Unknown\",\r\n host.os.version\r\n )\r\n\r\n| EVAL type_name =\r\n CASE(\r\n corelight.asset_classification.type_name IS NULL\r\n OR corelight.asset_classification.type_name == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_name\r\n )\r\n\r\n| EVAL type_group =\r\n CASE(\r\n corelight.asset_classification.type_group IS NULL\r\n OR corelight.asset_classification.type_group == \"\",\r\n \"Unknown\",\r\n corelight.asset_classification.type_group\r\n )\r\n\r\n| EVAL host.manufacturer =\r\n CASE(\r\n host.manufacturer IS NULL OR host.manufacturer == \"\",\r\n \"Unknown\",\r\n host.manufacturer\r\n )\r\n\r\n| EVAL host.model =\r\n CASE(\r\n host.model IS NULL OR host.model == \"\",\r\n \"Unknown\",\r\n host.model\r\n )\r\n\r\n| EVAL Confidence =\r\n CASE(\r\n corelight.asset_classification.confidence \u003e= 40, \"High\",\r\n corelight.asset_classification.confidence \u003e= 20\r\n AND corelight.asset_classification.confidence \u003c= 39, \"Medium\",\r\n corelight.asset_classification.confidence \u003e= 1\r\n AND corelight.asset_classification.confidence \u003c= 19, \"Low\",\r\n \"Unknown\"\r\n )\r\n\r\n| STATS\r\n MAC = VALUES(host.mac),\r\n `OS Name` = VALUES(host.os.name),\r\n `OS Version` = VALUES(host.os.version),\r\n `Type Name` = VALUES(type_name),\r\n `Type Group` = VALUES(type_group),\r\n Brand = VALUES(host.manufacturer),\r\n Model = VALUES(host.model),\r\n Sources = VALUES(corelight.asset_classification.sources)\r\n BY @timestamp, host.ip, Confidence\r\n| RENAME host.ip AS `Host IP`\r\n| KEEP\r\n @timestamp,\r\n `Host IP`,\r\n MAC,\r\n `OS Name`,\r\n `OS Version`,\r\n `Type Name`,\r\n `Type Group`,\r\n Brand,\r\n Model,\r\n Confidence,\r\n Sources\r\n| LIMIT 100" + }, + "visualization": { + "columns": [ + { + "columnId": "cd981a43-111d-4bc0-a754-04d39d692dd1", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "e5d56dec-99f8-44e6-874b-f58a1e08b373", + "isMetric": false, + "isTransposed": false, + "oneClickFilter": true + }, + { + "columnId": "1b300581-7e35-4a85-b505-0946b7acb795", + "isMetric": false, + "isTransposed": false, + "oneClickFilter": true + }, + { + "columnId": "4685148e-3548-4eb0-b859-ea88fac7b844", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "d88f7bbe-8810-4759-94ca-a192e4454e6a", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "6b4410f0-09cb-4a7b-a460-7e8ca92e5d64", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "ef897360-b4e1-4282-b263-5522498b6277", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "98ee08a8-a3f7-4bf0-811c-1343be90dcb4", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "0e39c0da-dd82-4ff5-be6d-cd3d19cc11d5", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "334a1c4d-5a7b-4238-abf0-bd4a7e009a6f", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "c54f71ae-426b-4e5f-9f89-cc74f804b4e4", + "isMetric": false, + "isTransposed": false + } + ], + "layerId": "09446ea1-f951-4dfe-a22f-b41852c902dd", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "Table @timestamp \u0026 Host IP \u0026 MAC \u0026 OS Name \u0026 OS Version", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 18, + "i": "96fc7b53-f3e8-45d7-87a0-458ab5ed61f1", + "w": 48, + "x": 0, + "y": 63 + }, + "panelIndex": "96fc7b53-f3e8-45d7-87a0-458ab5ed61f1", + "title": "Device Inventory with Classifications", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Logs Corelight] Asset Classification", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-05-11T11:54:55.804Z", + "id": "corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4", + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "61116bed-5252-4cbb-98e5-a43b8bed291b:indexpattern-datasource-layer-2b2a1546-5c0a-4b62-8a51-d1856c6b810b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e2ee76c1-33d3-4a49-9757-7e243c63f8e4:indexpattern-datasource-layer-2b2a1546-5c0a-4b62-8a51-d1856c6b810b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e2ee76c1-33d3-4a49-9757-7e243c63f8e4:b1a32e7b-065a-457d-a0f3-76f3dea81456", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_3773b2cc-155b-4cef-9453-79197faf59f3:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_d62f7d06-fcb8-4980-8801-fa8f236e6727:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_9d3029ad-b040-4782-a9e5-a99043453282:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_7f63d923-db47-4a0c-8a12-963bcdcb8bb0:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08.json b/packages/corelight/kibana/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08.json index 03547d89e2e..ce690c26e73 100644 --- a/packages/corelight/kibana/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08.json +++ b/packages/corelight/kibana/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "ssh.inferences", + "id": "bb39b552-4c2b-4b68-8795-2491eaf35b1a", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -135,7 +136,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - **SSH Inferences Overview**\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - **SSH Inferences Overview**\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -600,6 +601,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -725,6 +729,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -869,6 +876,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -896,11 +906,7 @@ { "embeddableConfig": { "description": "SSH Inference Log Data", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 10 }, "gridData": { @@ -918,10 +924,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] SSH Inferences Overview", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:01.145Z", "id": "corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08", "references": [ { @@ -939,11 +945,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", "type": "index-pattern" }, - { - "id": "corelight-a44be701-0e99-4b53-9073-b7720df40481", - "name": "77fd043f-23b8-4de2-a228-0b21d2b56682:panel_77fd043f-23b8-4de2-a228-0b21d2b56682", - "type": "search" - }, { "id": "logs-*", "name": "e16758c8-c2c5-47e8-bb55-5f77a378a5df:indexpattern-datasource-layer-718febea-e26f-4dce-9db6-fa22a037f563", @@ -955,26 +956,17 @@ "type": "index-pattern" }, { - "id": "logs-*", - "name": "controlGroup_bb39b552-4c2b-4b68-8795-2491eaf35b1a:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" + "id": "corelight-a44be701-0e99-4b53-9073-b7720df40481", + "name": "77fd043f-23b8-4de2-a228-0b21d2b56682:panel_77fd043f-23b8-4de2-a228-0b21d2b56682", + "type": "search" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "name": "controlGroup_bb39b552-4c2b-4b68-8795-2491eaf35b1a:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b.json b/packages/corelight/kibana/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b.json index b365d45bbda..5420aea2cba 100644 --- a/packages/corelight/kibana/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b.json +++ b/packages/corelight/kibana/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "42578746-ab6b-48bc-b4b7-4453f4bbf187", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -112,7 +113,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- **Security Posture**\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- **Security Posture**\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -3792,6 +3793,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -4239,6 +4243,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -8686,6 +8693,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -10171,6 +10181,9 @@ "type": "lens", "visualizationType": "lnsXY" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -10204,10 +10217,10 @@ "timeRestore": true, "timeTo": "now", "title": "[Logs Corelight] Security Posture", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:27:36.797Z", "id": "corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b", "references": [ { @@ -10445,11 +10458,6 @@ "name": "26a1ac69-2b1b-4bb0-af16-ae78e8ba244a:b8977309-8b15-43e2-a989-d584a507e76c", "type": "index-pattern" }, - { - "id": "logs-*", - "name": "89bdbbdd-970b-48f0-b467-454690ac31ba:layer_1_join_0_index_pattern", - "type": "index-pattern" - }, { "id": "logs-*", "name": "6e2b3328-d18a-4d8c-995f-975ce87f7b7d:indexpattern-datasource-layer-26f1e5e7-9541-4f11-82c6-fd14f199c8a9", @@ -10467,20 +10475,16 @@ }, { "id": "logs-*", - "name": "controlGroup_42578746-ab6b-48bc-b4b7-4453f4bbf187:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "89bdbbdd-970b-48f0-b467-454690ac31ba:layer_1_join_0_index_pattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "controlGroup_42578746-ab6b-48bc-b4b7-4453f4bbf187:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e.json b/packages/corelight/kibana/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e.json index 12398bb2212..81606f6bf33 100644 --- a/packages/corelight/kibana/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e.json +++ b/packages/corelight/kibana/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "597c5dc5-3e91-4307-8a43-32592d3367d0", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -71,7 +72,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- **Data Insights**\n - **Name Resolution Insights**\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- **Data Insights**\n - **Name Resolution Insights**\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -197,6 +198,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -384,6 +388,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -472,6 +479,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1105,6 +1115,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -2086,6 +2099,9 @@ "type": "lens", "visualizationType": "lnsMetric" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -2731,6 +2747,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -3394,10 +3413,10 @@ "timeRestore": true, "timeTo": "now", "title": "[Logs Corelight] Name Resolution Insights", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:04.176Z", "id": "corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e", "references": [ { @@ -3447,5 +3466,6 @@ } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa.json b/packages/corelight/kibana/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa.json index d1aaeec4442..a495a0980ad 100644 --- a/packages/corelight/kibana/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa.json +++ b/packages/corelight/kibana/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "http.response.status_code", + "id": "35a99a9f-d770-4824-b6fa-b15185d700df", "searchTechnique": "exact", "selectedOptions": [], "sort": { @@ -31,6 +32,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "user_agent.original", + "id": "524af843-c613-493b-a129-aa52c6c05d43", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -48,6 +50,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "http.request.method", + "id": "7fb8732f-b009-425b-8552-7c0008ec41d1", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -65,6 +68,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "afc48b88-9962-439c-9835-de744be7ade5", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -106,6 +110,46 @@ "observer.vendor": "Corelight" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "event.dataset: http*", + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "query", + "negate": false, + "type": "custom" + }, + "query": { + "wildcard": { + "event.dataset": "http*" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Aggregation", + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "event.dataset", + "negate": true, + "params": { + "query": "http_agg" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "http_agg" + } + } } ], "query": { @@ -145,7 +189,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - **HTTP**\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - **HTTP**\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -156,7 +200,7 @@ "gridData": { "h": 35, "i": "2615fb52-0443-486a-a98b-6664685868f3", - "w": 12, + "w": 11, "x": 0, "y": 0 }, @@ -170,17 +214,22 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-905d13e6-21a4-4779-9c73-28a4deb568e5", + "name": "indexpattern-datasource-layer-a855e866-c8d4-4020-bc24-7b45a0f5feff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23df9023-008b-4984-949a-1c0b609f0683", "type": "index-pattern" }, { "id": "logs-*", - "name": "def3a9ea-34bf-49ce-aa98-69a815ff7186", + "name": "4c5d01bb-6669-4db9-a96a-61809b99e4b5", "type": "index-pattern" }, { "id": "logs-*", - "name": "bf973b64-4cf4-469a-a480-b122f3696781", + "name": "702283a1-b201-4a81-9020-0f5a41360be1", "type": "index-pattern" } ], @@ -189,12 +238,12 @@ "datasourceStates": { "formBased": { "layers": { - "905d13e6-21a4-4779-9c73-28a4deb568e5": { + "a855e866-c8d4-4020-bc24-7b45a0f5feff": { "columnOrder": [ - "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb" + "680b84ab-8a93-4e8e-b5f8-6306354e90d5" ], "columns": { - "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb": { + "680b84ab-8a93-4e8e-b5f8-6306354e90d5": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -227,6 +276,25 @@ } }, "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "event.dataset: http*", + "disabled": false, + "index": "23df9023-008b-4984-949a-1c0b609f0683", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"wildcard\":{\"event.dataset\":\"http*\"}}" + }, + "query": { + "wildcard": { + "event.dataset": "http*" + } + } + }, { "$state": { "store": "appState" @@ -235,7 +303,7 @@ "alias": null, "disabled": false, "field": "user_agent.original", - "index": "def3a9ea-34bf-49ce-aa98-69a815ff7186", + "index": "4c5d01bb-6669-4db9-a96a-61809b99e4b5", "key": "user_agent.original", "negate": false, "type": "exists", @@ -254,18 +322,16 @@ "meta": { "alias": null, "disabled": false, - "field": "event.dataset", - "index": "bf973b64-4cf4-469a-a480-b122f3696781", - "key": "event.dataset", + "field": "observer.hostname", + "index": "702283a1-b201-4a81-9020-0f5a41360be1", + "key": "observer.hostname", "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" + "type": "exists", + "value": "exists" }, "query": { - "match_phrase": { - "event.dataset": "http" + "exists": { + "field": "observer.hostname" } } } @@ -276,82 +342,27 @@ "query": "" }, "visualization": { - "layerId": "905d13e6-21a4-4779-9c73-28a4deb568e5", + "layerId": "a855e866-c8d4-4020-bc24-7b45a0f5feff", "layerType": "data", - "metricAccessor": "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb" + "metricAccessor": "680b84ab-8a93-4e8e-b5f8-6306354e90d5" } }, "title": "", "type": "lens", "visualizationType": "lnsMetric" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "user_agent.original", - "index": "logs-*", - "key": "user_agent.original", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "user_agent.original" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "logs-*", - "key": "event.dataset", - "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "http" - } - } - } - ], - "hidePanelTitles": true, - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 10, - "i": "c10a2818-5123-4659-b8ea-b2d10bd30584", - "w": 9, - "x": 12, + "h": 8, + "i": "94a222a3-12d8-465f-9b6a-6bc9912e7203", + "w": 7, + "x": 11, "y": 0 }, - "panelIndex": "c10a2818-5123-4659-b8ea-b2d10bd30584", - "title": "Distinct Referrers [Logs Corelight]", + "panelIndex": "94a222a3-12d8-465f-9b6a-6bc9912e7203", + "title": "Distinct Referrers", "type": "lens" }, { @@ -360,12 +371,17 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-905d13e6-21a4-4779-9c73-28a4deb568e5", + "name": "indexpattern-datasource-layer-a855e866-c8d4-4020-bc24-7b45a0f5feff", "type": "index-pattern" }, { "id": "logs-*", - "name": "05767edc-f58d-4d6f-8616-edbc12bc2571", + "name": "9f853943-931c-4f72-ac37-e23f42fd318e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eabfc1fb-c92b-4a3f-bbe6-3809ed8f0ce8", "type": "index-pattern" } ], @@ -374,12 +390,12 @@ "datasourceStates": { "formBased": { "layers": { - "905d13e6-21a4-4779-9c73-28a4deb568e5": { + "a855e866-c8d4-4020-bc24-7b45a0f5feff": { "columnOrder": [ - "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb" + "680b84ab-8a93-4e8e-b5f8-6306354e90d5" ], "columns": { - "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb": { + "680b84ab-8a93-4e8e-b5f8-6306354e90d5": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -412,6 +428,25 @@ } }, "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "event.dataset: http*", + "disabled": false, + "index": "9f853943-931c-4f72-ac37-e23f42fd318e", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"wildcard\":{\"event.dataset\":\"http*\"}}" + }, + "query": { + "wildcard": { + "event.dataset": "http*" + } + } + }, { "$state": { "store": "appState" @@ -419,18 +454,16 @@ "meta": { "alias": null, "disabled": false, - "field": "event.dataset", - "index": "05767edc-f58d-4d6f-8616-edbc12bc2571", - "key": "event.dataset", + "field": "observer.hostname", + "index": "eabfc1fb-c92b-4a3f-bbe6-3809ed8f0ce8", + "key": "observer.hostname", "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" + "type": "exists", + "value": "exists" }, "query": { - "match_phrase": { - "event.dataset": "http" + "exists": { + "field": "observer.hostname" } } }, @@ -442,7 +475,7 @@ "alias": null, "disabled": false, "field": "user_agent.original", - "index": "1bf002e2-a9b9-4f59-8929-90ece408cffa", + "index": "6d11795e-c404-46ca-8185-9f476885424f", "key": "user_agent.original", "negate": false, "type": "exists" @@ -460,81 +493,178 @@ "query": "" }, "visualization": { - "layerId": "905d13e6-21a4-4779-9c73-28a4deb568e5", + "layerId": "a855e866-c8d4-4020-bc24-7b45a0f5feff", "layerType": "data", - "metricAccessor": "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb" + "metricAccessor": "680b84ab-8a93-4e8e-b5f8-6306354e90d5" } }, "title": "", "type": "lens", "visualizationType": "lnsMetric" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 8, + "i": "cd300038-00d3-45cd-a6aa-5786aa48a325", + "w": 7, + "x": 18, + "y": 0 + }, + "panelIndex": "cd300038-00d3-45cd-a6aa-5786aa48a325", + "title": "Distinct User Agents", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a855e866-c8d4-4020-bc24-7b45a0f5feff", + "type": "index-pattern" }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "logs-*", - "key": "event.dataset", - "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" + { + "id": "logs-*", + "name": "fb7fcabf-dadf-4eb3-a2a7-45ed610ba78e", + "type": "index-pattern" }, - "query": { - "match_phrase": { - "event.dataset": "http" - } + { + "id": "logs-*", + "name": "5948699a-a78d-4431-abba-e38c09b707ca", + "type": "index-pattern" } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "user_agent.original", - "index": "1bf002e2-a9b9-4f59-8929-90ece408cffa", - "key": "user_agent.original", - "negate": false, - "type": "exists" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a855e866-c8d4-4020-bc24-7b45a0f5feff": { + "columnOrder": [ + "680b84ab-8a93-4e8e-b5f8-6306354e90d5" + ], + "columns": { + "680b84ab-8a93-4e8e-b5f8-6306354e90d5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Distinct Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "dest_host" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } }, - "query": { - "exists": { - "field": "user_agent.original" + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "event.dataset: http*", + "disabled": false, + "index": "fb7fcabf-dadf-4eb3-a2a7-45ed610ba78e", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"wildcard\":{\"event.dataset\":\"http*\"}}" + }, + "query": { + "wildcard": { + "event.dataset": "http*" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "index": "5948699a-a78d-4431-abba-e38c09b707ca", + "key": "observer.hostname", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "user_agent.original", + "index": "6d11795e-c404-46ca-8185-9f476885424f", + "key": "user_agent.original", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "user_agent.original" + } + } } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "a855e866-c8d4-4020-bc24-7b45a0f5feff", + "layerType": "data", + "metricAccessor": "680b84ab-8a93-4e8e-b5f8-6306354e90d5" } - } - ], - "hidePanelTitles": true, - "query": { - "language": "kuery", - "query": "" + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 10, - "i": "83f18fd5-7218-4311-959a-a4432445b483", - "w": 9, - "x": 21, + "h": 8, + "i": "4c86dae5-df4f-4af8-9475-e1b18f629ee1", + "w": 7, + "x": 25, "y": 0 }, - "panelIndex": "83f18fd5-7218-4311-959a-a4432445b483", - "title": "Distinct User Agents [Logs Corelight]", + "panelIndex": "4c86dae5-df4f-4af8-9475-e1b18f629ee1", + "title": "Distinct Hosts", "type": "lens" }, { @@ -543,16 +673,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -560,13 +690,13 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "e428ae8c-fcfc-4f9a-991e-1812f8c5f5bf": { + "010ae7b1-9620-4caa-8fe5-512654504ab0": { "columns": [ { "columnId": "Distinct Connections", @@ -578,9 +708,9 @@ } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS COUNT_DISTINCT(event.id)\r\n| RENAME `COUNT_DISTINCT(event.id)` AS `Distinct Connections`\r\n| KEEP `Distinct Connections`" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND user_agent.original is not null AND observer.hostname IS NOT NULL\r\n| LIMIT 10000\r\n| STATS COUNT_DISTINCT(event.id)\r\n| RENAME `COUNT_DISTINCT(event.id)` AS `Distinct Connections`\r\n| KEEP `Distinct Connections`\r\n" }, "timeField": "@timestamp" } @@ -589,10 +719,10 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS COUNT_DISTINCT(event.id)\r\n| RENAME `COUNT_DISTINCT(event.id)` AS `Distinct Connections`\r\n| KEEP `Distinct Connections`" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND user_agent.original is not null AND observer.hostname IS NOT NULL\r\n| LIMIT 10000\r\n| STATS COUNT_DISTINCT(event.id)\r\n| RENAME `COUNT_DISTINCT(event.id)` AS `Distinct Connections`\r\n| KEEP `Distinct Connections`\r\n" }, "visualization": { - "layerId": "e428ae8c-fcfc-4f9a-991e-1812f8c5f5bf", + "layerId": "010ae7b1-9620-4caa-8fe5-512654504ab0", "layerType": "data", "metricAccessor": "Distinct Connections" } @@ -601,29 +731,21 @@ "type": "lens", "visualizationType": "lnsMetric" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "hidePanelTitles": true, - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS COUNT_DISTINCT(event.id)\r\n| RENAME `COUNT_DISTINCT(event.id)` AS `Distinct Connections`\r\n| KEEP `Distinct Connections`" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 10, - "i": "8cf98331-9205-4a52-bb81-925b5a9ac9d4", - "w": 9, - "x": 39, + "h": 8, + "i": "022150a3-2fa9-4364-b802-857520745574", + "w": 7, + "x": 32, "y": 0 }, - "panelIndex": "8cf98331-9205-4a52-bb81-925b5a9ac9d4", - "title": "Distinct Connections [Logs Corelight]", + "panelIndex": "022150a3-2fa9-4364-b802-857520745574", + "title": "Distinct Connections", "type": "lens" }, { @@ -632,16 +754,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -649,27 +771,26 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "40b70cf6-3415-412d-a5e4-1387e84cd848": { + "685de16a-e51f-4911-ad81-d5330c92e966": { "columns": [ { - "columnId": "Average Body Length", - "fieldName": "Average Body Length", - "inMetricDimension": true, + "columnId": "d1311566-0a6c-4ef5-a4aa-d1059da4d4cd", + "fieldName": "HTTP Aggregation", "meta": { - "esType": "double", - "type": "number" + "esType": "keyword", + "type": "string" } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.body.bytes) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(http.response.body.bytes)`)\r\n| EVAL `Average Body Length` = ROUND(`AVG(``VALUES(http.response.body.bytes)``)`)\r\n| KEEP `Average Body Length`" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset == \"http_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `HTTP Aggregation` = CASE(count \u003e 0, \"HTTP Agg Logs Available\", \"No HTTP Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `HTTP Aggregation`, status" }, "timeField": "@timestamp" } @@ -678,41 +799,37 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.body.bytes) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(http.response.body.bytes)`)\r\n| EVAL `Average Body Length` = ROUND(`AVG(``VALUES(http.response.body.bytes)``)`)\r\n| KEEP `Average Body Length`" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset == \"http_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `HTTP Aggregation` = CASE(count \u003e 0, \"HTTP Agg Logs Available\", \"No HTTP Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `HTTP Aggregation`, status" }, "visualization": { - "layerId": "40b70cf6-3415-412d-a5e4-1387e84cd848", - "layerType": "data", - "metricAccessor": "Average Body Length" + "columns": [ + { + "columnId": "d1311566-0a6c-4ef5-a4aa-d1059da4d4cd" + } + ], + "layerId": "685de16a-e51f-4911-ad81-d5330c92e966", + "layerType": "data" } }, - "title": "Metric", + "title": "Bar vertical stacked", "type": "lens", - "visualizationType": "lnsMetric" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "hidePanelTitles": true, - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.body.bytes) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(http.response.body.bytes)`)\r\n| EVAL `Average Body Length` = ROUND(`AVG(``VALUES(http.response.body.bytes)``)`)\r\n| KEEP `Average Body Length`" + "visualizationType": "lnsDatatable" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 9, - "i": "be83539d-71d9-44f4-8c27-f4f43f69db48", - "w": 18, - "x": 12, - "y": 10 + "h": 8, + "i": "54ccb8cd-1a4e-4c5d-a6fa-89b2d71c415d", + "w": 9, + "x": 39, + "y": 0 }, - "panelIndex": "be83539d-71d9-44f4-8c27-f4f43f69db48", - "title": "Average Body Length [Logs Corelight]", + "panelIndex": "54ccb8cd-1a4e-4c5d-a6fa-89b2d71c415d", + "title": "DNS Aggregation", "type": "lens" }, { @@ -721,16 +838,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -738,17 +855,17 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "f74d0df3-162f-4106-b254-a05e07794576": { + "375b539e-d314-4a1b-8701-ba731d777b92": { "columns": [ { - "columnId": "Average User Agent Length", - "fieldName": "Average User Agent Length", + "columnId": "Average Body Length", + "fieldName": "Average Body Length", "inMetricDimension": true, "meta": { "esType": "double", @@ -756,9 +873,9 @@ } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original_length) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(user_agent.original_length)`)\r\n| EVAL `Average User Agent Length` = ROUND(`AVG(``VALUES(user_agent.original_length)``)`) \r\n| KEEP `Average User Agent Length`" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.body.bytes) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(http.response.body.bytes)`)\r\n| EVAL `Average Body Length` = ROUND(`AVG(``VALUES(http.response.body.bytes)``)`)\r\n| KEEP `Average Body Length`" }, "timeField": "@timestamp" } @@ -767,221 +884,114 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original_length) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(user_agent.original_length)`)\r\n| EVAL `Average User Agent Length` = ROUND(`AVG(``VALUES(user_agent.original_length)``)`) \r\n| KEEP `Average User Agent Length`" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.body.bytes) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(http.response.body.bytes)`)\r\n| EVAL `Average Body Length` = ROUND(`AVG(``VALUES(http.response.body.bytes)``)`)\r\n| KEEP `Average Body Length`" }, "visualization": { - "layerId": "f74d0df3-162f-4106-b254-a05e07794576", + "layerId": "375b539e-d314-4a1b-8701-ba731d777b92", "layerType": "data", - "metricAccessor": "Average User Agent Length" + "metricAccessor": "Average Body Length" } }, "title": "Metric", "type": "lens", "visualizationType": "lnsMetric" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "hidePanelTitles": true, - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original_length) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(user_agent.original_length)`)\r\n| EVAL `Average User Agent Length` = ROUND(`AVG(``VALUES(user_agent.original_length)``)`) \r\n| KEEP `Average User Agent Length`" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, - "i": "d6b11a6d-561f-4ba6-b686-b3485e652c62", - "w": 18, - "x": 30, - "y": 10 + "i": "0c10245a-e6d0-4292-8240-7f80a91bc918", + "w": 20, + "x": 11, + "y": 8 }, - "panelIndex": "d6b11a6d-561f-4ba6-b686-b3485e652c62", - "title": "Average User Agent Length [Logs Corelight]", + "panelIndex": "0c10245a-e6d0-4292-8240-7f80a91bc918", + "title": "Average Body Length", "type": "lens" }, { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-905d13e6-21a4-4779-9c73-28a4deb568e5", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "name": "logs-corelight.http*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.http*", + "type": "esql" + } + }, "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", + "textBased": { + "indexPatternRefs": [ + { + "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "timeField": "@timestamp", + "title": "logs-corelight.http*" + } + ], "layers": { - "905d13e6-21a4-4779-9c73-28a4deb568e5": { - "columnOrder": [ - "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb" - ], - "columns": { - "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Distinct Hosts", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "dest_host" + "2ec20444-9f37-40f4-9688-4b56092cdd52": { + "columns": [ + { + "columnId": "Average User Agent Length", + "fieldName": "Average User Agent Length", + "inMetricDimension": true, + "meta": { + "esType": "double", + "type": "number" + } } + ], + "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "query": { + "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset LIKE \"http*\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original_length) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(user_agent.original_length)`)\r\n| EVAL `Average User Agent Length` = ROUND(`AVG(``VALUES(user_agent.original_length)``)`) \r\n| KEEP `Average User Agent Length`\r\n" }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 + "timeField": "@timestamp" } } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} } }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "2e4dc4e5-8216-456a-be40-e61353ffa6ae", - "key": "event.dataset", - "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "http" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "user_agent.original", - "index": "1bf002e2-a9b9-4f59-8929-90ece408cffa", - "key": "user_agent.original", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "user_agent.original" - } - } - } - ], - "internalReferences": [], + "filters": [], "query": { - "language": "kuery", - "query": "" + "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset LIKE \"http*\" AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original_length) by source.ip, destination.ip, event.id\r\n| STATS AVG(`VALUES(user_agent.original_length)`)\r\n| EVAL `Average User Agent Length` = ROUND(`AVG(``VALUES(user_agent.original_length)``)`) \r\n| KEEP `Average User Agent Length`\r\n" }, "visualization": { - "layerId": "905d13e6-21a4-4779-9c73-28a4deb568e5", + "layerId": "2ec20444-9f37-40f4-9688-4b56092cdd52", "layerType": "data", - "metricAccessor": "bc803bc9-23d8-41cb-bf6a-c61c45e6a2cb" + "metricAccessor": "Average User Agent Length" } }, - "title": "", + "title": "Metric", "type": "lens", "visualizationType": "lnsMetric" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "2e4dc4e5-8216-456a-be40-e61353ffa6ae", - "key": "event.dataset", - "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "http" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "user_agent.original", - "index": "1bf002e2-a9b9-4f59-8929-90ece408cffa", - "key": "user_agent.original", - "negate": false, - "type": "exists" - }, - "query": { - "exists": { - "field": "user_agent.original" - } - } - } + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" ], - "hidePanelTitles": true, - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 10, - "i": "6a6df5ca-b787-4131-84da-762da0d6755f", - "w": 9, - "x": 30, - "y": 0 + "h": 9, + "i": "b3a26f79-3d22-45a8-a728-17020392454f", + "w": 17, + "x": 31, + "y": 8 }, - "panelIndex": "6a6df5ca-b787-4131-84da-762da0d6755f", - "title": "Distinct Hosts [Logs Corelight]", + "panelIndex": "b3a26f79-3d22-45a8-a728-17020392454f", + "title": "Average User Agent Length", "type": "lens" }, { @@ -990,16 +1000,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -1007,17 +1017,17 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "902ee2fb-db9b-4c23-a531-3ac9c8adf04d": { + "5516f319-6591-42bb-9209-836d8f218727": { "columns": [ { - "columnId": "Status Message", - "fieldName": "Status Message", + "columnId": "URL Domain", + "fieldName": "URL Domain", "meta": { "esType": "keyword", "type": "string" @@ -1033,9 +1043,9 @@ } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null AND http.response.status_name IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(http.response.status_name)` as `Status Message`, `COUNT()` as Count\r\n| SORT Count DESC\r\n| LIMIT 10 \r\n| KEEP `Status Message`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND dest_host is not null AND user_agent.original IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `URL Domain`, `COUNT()` as Count\r\n| SORT Count desc\r\n| LIMIT 20\r\n| KEEP `URL Domain`, Count" }, "timeField": "@timestamp" } @@ -1044,73 +1054,43 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null AND http.response.status_name IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(http.response.status_name)` as `Status Message`, `COUNT()` as Count\r\n| SORT Count DESC\r\n| LIMIT 10 \r\n| KEEP `Status Message`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND dest_host is not null AND user_agent.original IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `URL Domain`, `COUNT()` as Count\r\n| SORT Count desc\r\n| LIMIT 20\r\n| KEEP `URL Domain`, Count" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "902ee2fb-db9b-4c23-a531-3ac9c8adf04d", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "Count" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "Status Message" - ], - "truncateLegend": false + "columnId": "URL Domain" + }, + { + "columnId": "Count" } ], - "shape": "pie" + "layerId": "5516f319-6591-42bb-9209-836d8f218727", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } } }, "title": "Bar vertical stacked", "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND user_agent.original is not null AND http.response.status_name IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(http.response.status_name)` as `Status Message`, `COUNT()` as Count\r\n| SORT Count DESC\r\n| LIMIT 10 \r\n| KEEP `Status Message`, Count" + "visualizationType": "lnsDatatable" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { - "h": 16, - "i": "8dfb746c-2b64-4ea9-9cfd-464121547567", - "w": 16, - "x": 32, - "y": 19 + "h": 18, + "i": "7860bc0e-8575-4e3b-a79d-2472fd70eeee", + "w": 20, + "x": 11, + "y": 17 }, - "panelIndex": "8dfb746c-2b64-4ea9-9cfd-464121547567", - "title": "HTTP Status Code Breakdown [Logs Corelight]", + "panelIndex": "7860bc0e-8575-4e3b-a79d-2472fd70eeee", + "title": "Top Host Headers by Count", "type": "lens" }, { @@ -1119,16 +1099,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -1136,17 +1116,17 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "0da8bfd3-487f-4ace-b49a-03c28e1a2b26": { + "3c488450-9869-4112-9544-17ef08cd1013": { "columns": [ { - "columnId": "Host Header", - "fieldName": "Host Header", + "columnId": "Vendor Action", + "fieldName": "Vendor Action", "meta": { "esType": "keyword", "type": "string" @@ -1162,9 +1142,9 @@ } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count desc\r\n| LIMIT 10\r\n| KEEP `Host Header`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND user_agent.original is not null AND http.response.status_name IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(http.response.status_name)` as `Vendor Action`, `COUNT()` as Count\r\n| SORT Count DESC\r\n| LIMIT 10 \r\n| KEEP `Vendor Action`, Count" }, "timeField": "@timestamp" } @@ -1173,47 +1153,65 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count desc\r\n| LIMIT 10\r\n| KEEP `Host Header`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND user_agent.original is not null AND http.response.status_name IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(http.response.status_name)` as `Vendor Action`, `COUNT()` as Count\r\n| SORT Count DESC\r\n| LIMIT 10 \r\n| KEEP `Vendor Action`, Count" }, "visualization": { - "columns": [ - { - "columnId": "Host Header" - }, + "layers": [ { - "columnId": "Count" + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "3c488450-9869-4112-9544-17ef08cd1013", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "Count" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "Vendor Action" + ], + "truncateLegend": false } ], - "layerId": "0da8bfd3-487f-4ace-b49a-03c28e1a2b26", - "layerType": "data" + "shape": "pie" } }, "title": "Bar vertical stacked", "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count desc\r\n| LIMIT 10\r\n| KEEP `Host Header`, Count" + "visualizationType": "lnsPie" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { - "h": 16, - "i": "e712537e-7d6a-43aa-8375-d8e14b932728", - "w": 20, - "x": 12, - "y": 19 + "h": 18, + "i": "5d774c85-b1b3-4d3e-a01b-39047d2df634", + "w": 17, + "x": 31, + "y": 17 }, - "panelIndex": "e712537e-7d6a-43aa-8375-d8e14b932728", - "title": "Top Host Headers by Count [Logs Corelight]", + "panelIndex": "5d774c85-b1b3-4d3e-a01b-39047d2df634", + "title": "HTTP Status Code Breakdown", "type": "lens" }, { @@ -1222,7 +1220,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-7ce1f462-bdd2-4cea-99ba-afa9526a29b6", + "name": "indexpattern-datasource-layer-7ad92b47-6e92-40d3-8a7c-23de142ed6fe", "type": "index-pattern" } ], @@ -1232,13 +1230,31 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "7ce1f462-bdd2-4cea-99ba-afa9526a29b6": { + "7ad92b47-6e92-40d3-8a7c-23de142ed6fe": { "columnOrder": [ - "86c229ab-72ca-4795-a701-80cc9b13465e", - "f4a1aac5-558c-4ca9-97c2-cc73d32c54ee" + "becfabbb-3ded-4c06-a685-b73a896462d4", + "5c608125-585b-4c18-9568-2cccf2e03dee" ], "columns": { - "86c229ab-72ca-4795-a701-80cc9b13465e": { + "5c608125-585b-4c18-9568-2cccf2e03dee": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "becfabbb-3ded-4c06-a685-b73a896462d4": { "customLabel": true, "dataType": "ip", "isBucketed": true, @@ -1251,7 +1267,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "f4a1aac5-558c-4ca9-97c2-cc73d32c54ee", + "columnId": "5c608125-585b-4c18-9568-2cccf2e03dee", "type": "column" }, "orderDirection": "desc", @@ -1263,24 +1279,6 @@ }, "scale": "ordinal", "sourceField": "source.ip" - }, - "f4a1aac5-558c-4ca9-97c2-cc73d32c54ee": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" } }, "ignoreGlobalFilters": false, @@ -1305,40 +1303,16 @@ "meta": { "alias": null, "disabled": false, - "field": "event.dataset", - "index": "37eb0903-905a-4719-bf92-4492fd7e7004", - "key": "event.dataset", - "negate": false, - "params": { - "query": "conn" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "conn" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "network.protocol", - "index": "bec317a1-7ba3-4793-966a-c0fe68cde81a", - "key": "network.protocol", + "field": "observer.hostname", + "index": "c3efe29e-efc4-4bd6-91b6-dd89220cbd1a", + "key": "observer.hostname", "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" + "type": "exists", + "value": "exists" }, "query": { - "match_phrase": { - "network.protocol": "http" + "exists": { + "field": "observer.hostname" } } }, @@ -1347,18 +1321,17 @@ "store": "appState" }, "meta": { - "alias": null, + "alias": "event.dataset: http*", "disabled": false, - "field": "observer.hostname", - "index": "73926b28-ff01-45b5-9e43-9aaee729ff38", - "key": "observer.hostname", + "index": "218c8758-bd89-41b6-b5b8-1af4af79e18f", + "key": "query", "negate": false, - "type": "exists", - "value": "exists" + "type": "custom", + "value": "{\"wildcard\":{\"event.dataset\":\"http*\"}}" }, "query": { - "exists": { - "field": "observer.hostname" + "wildcard": { + "event.dataset": "http*" } } } @@ -1371,17 +1344,17 @@ "visualization": { "columns": [ { - "columnId": "86c229ab-72ca-4795-a701-80cc9b13465e", + "columnId": "becfabbb-3ded-4c06-a685-b73a896462d4", "isMetric": false, "isTransposed": false }, { - "columnId": "f4a1aac5-558c-4ca9-97c2-cc73d32c54ee", + "columnId": "5c608125-585b-4c18-9568-2cccf2e03dee", "isMetric": true, "isTransposed": false } ], - "layerId": "7ce1f462-bdd2-4cea-99ba-afa9526a29b6", + "layerId": "7ad92b47-6e92-40d3-8a7c-23de142ed6fe", "layerType": "data" } }, @@ -1389,94 +1362,17 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "37eb0903-905a-4719-bf92-4492fd7e7004", - "key": "event.dataset", - "negate": false, - "params": { - "query": "conn" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "conn" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "network.protocol", - "index": "bec317a1-7ba3-4793-966a-c0fe68cde81a", - "key": "network.protocol", - "negate": false, - "params": { - "query": "http" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "network.protocol": "http" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "73926b28-ff01-45b5-9e43-9aaee729ff38", - "key": "observer.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { - "h": 16, - "i": "5e4a9ee0-ce63-4797-a871-f1a5e9fa7452", + "h": 18, + "i": "8e3f2d90-8a81-45a6-904a-a1cecca8fe05", "w": 16, "x": 0, "y": 35 }, - "panelIndex": "5e4a9ee0-ce63-4797-a871-f1a5e9fa7452", - "title": "Top Originators [Logs Corelight]", + "panelIndex": "8e3f2d90-8a81-45a6-904a-a1cecca8fe05", + "title": "Top Originators", "type": "lens" }, { @@ -1485,16 +1381,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -1502,17 +1398,17 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "d2b259c5-b1f3-4e34-9639-cb842141a710": { + "bd098722-f1ca-41fb-b23e-e2b0fde06eee": { "columns": [ { - "columnId": "Host Header", - "fieldName": "Host Header", + "columnId": "URL Domain", + "fieldName": "URL Domain", "meta": { "esType": "keyword", "type": "string" @@ -1528,9 +1424,9 @@ } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `Host Header`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND dest_host is not null AND user_agent.original IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `URL Domain`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 20\r\n| KEEP `URL Domain`, Count\r\n" }, "timeField": "@timestamp" } @@ -1539,47 +1435,43 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `Host Header`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND dest_host is not null AND user_agent.original IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `URL Domain`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 20\r\n| KEEP `URL Domain`, Count\r\n" }, "visualization": { "columns": [ { - "columnId": "Host Header" + "columnId": "URL Domain" }, { "columnId": "Count" } ], - "layerId": "d2b259c5-b1f3-4e34-9639-cb842141a710", - "layerType": "data" + "layerId": "bd098722-f1ca-41fb-b23e-e2b0fde06eee", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } } }, "title": "Bar vertical stacked", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `Host Header`, Count" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { - "h": 16, - "i": "3e9d1b37-71ea-46a8-b99e-1ab9069c0b5b", + "h": 18, + "i": "50230a02-f5d6-4a47-be02-cb068dbaa0c5", "w": 32, "x": 16, "y": 35 }, - "panelIndex": "3e9d1b37-71ea-46a8-b99e-1ab9069c0b5b", - "title": "Rare Host Headers [Logs Corelight]", + "panelIndex": "50230a02-f5d6-4a47-be02-cb068dbaa0c5", + "title": "Rare Host Headers", "type": "lens" }, { @@ -1588,16 +1480,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -1605,16 +1497,16 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "0b8b0226-11f9-4dd6-9993-aaab369fd656": { + "e7d46545-dc57-4008-868a-772e9f047150": { "columns": [ { - "columnId": "Http User Agent", + "columnId": "f534b0be-2ac7-40a6-8d05-e66d1a88c742", "fieldName": "Http User Agent", "meta": { "esType": "keyword", @@ -1622,18 +1514,17 @@ } }, { - "columnId": "Count", + "columnId": "579bdd94-54bc-4389-9a33-94027c4e2321", "fieldName": "Count", - "inMetricDimension": true, "meta": { "esType": "long", "type": "number" } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original) by source.ip, destination.ip, event.id\r\n| STATS COUNT() by `VALUES(user_agent.original)`\r\n| RENAME `VALUES(user_agent.original)` as `Http User Agent`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `Http User Agent`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND dest_host is not null AND user_agent.original IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original) by source.ip, destination.ip, event.id\r\n| STATS COUNT() by `VALUES(user_agent.original)`\r\n| RENAME `VALUES(user_agent.original)` as `Http User Agent`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 20\r\n| KEEP `Http User Agent`, Count\r\n" }, "timeField": "@timestamp" } @@ -1642,47 +1533,47 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original) by source.ip, destination.ip, event.id\r\n| STATS COUNT() by `VALUES(user_agent.original)`\r\n| RENAME `VALUES(user_agent.original)` as `Http User Agent`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `Http User Agent`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND observer.hostname IS NOT NULL AND dest_host is not null AND user_agent.original IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original) by source.ip, destination.ip, event.id\r\n| STATS COUNT() by `VALUES(user_agent.original)`\r\n| RENAME `VALUES(user_agent.original)` as `Http User Agent`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 20\r\n| KEEP `Http User Agent`, Count\r\n" }, "visualization": { "columns": [ { - "columnId": "Http User Agent" + "columnId": "f534b0be-2ac7-40a6-8d05-e66d1a88c742", + "isMetric": false, + "isTransposed": false }, { - "columnId": "Count" + "columnId": "579bdd94-54bc-4389-9a33-94027c4e2321", + "isMetric": true, + "isTransposed": false } ], - "layerId": "0b8b0226-11f9-4dd6-9993-aaab369fd656", - "layerType": "data" + "layerId": "e7d46545-dc57-4008-868a-772e9f047150", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } } }, - "title": "Bar vertical stacked", + "title": "Table ", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(user_agent.original) by source.ip, destination.ip, event.id\r\n| STATS COUNT() by `VALUES(user_agent.original)`\r\n| RENAME `VALUES(user_agent.original)` as `Http User Agent`, `COUNT()` as Count\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `Http User Agent`, Count" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { - "h": 16, - "i": "6e459c23-448b-4de9-bc11-8bd6fe8b4a28", + "h": 18, + "i": "591c9244-8758-48ce-a984-8d8d14a0c2bf", "w": 48, "x": 0, - "y": 51 + "y": 53 }, - "panelIndex": "6e459c23-448b-4de9-bc11-8bd6fe8b4a28", - "title": "Rare User Agents [Logs Corelight]", + "panelIndex": "591c9244-8758-48ce-a984-8d8d14a0c2bf", + "title": "Rare User Agents", "type": "lens" }, { @@ -1722,7 +1613,7 @@ "i": "9b501e59-33f0-4655-81b3-02c955d7acfb", "w": 48, "x": 0, - "y": 67 + "y": 71 }, "panelIndex": "9b501e59-33f0-4655-81b3-02c955d7acfb", "title": "", @@ -1734,16 +1625,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -1751,17 +1642,25 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "55cb36c5-c31b-41d1-9a59-afa10ec49cb8": { + "c997f5ea-bded-428f-9371-4c25b161a032": { "columns": [ { - "columnId": "Host Header", - "fieldName": "Host Header", + "columnId": "URL Domain", + "fieldName": "URL Domain", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "HTTP Method", + "fieldName": "HTTP Method", "meta": { "esType": "keyword", "type": "string" @@ -1777,9 +1676,9 @@ } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count desc\r\n| KEEP `Host Header`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND dest_host is not null AND http.request.method IS NOT NULL\r\n AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host), VALUES(http.request.method) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)`, `VALUES(http.request.method)` \r\n| RENAME `VALUES(dest_host)` as `URL Domain`, `COUNT()` as Count, `VALUES(http.request.method)` as `HTTP Method`\r\n| SORT Count desc\r\n| KEEP `URL Domain`, `HTTP Method`, Count" }, "timeField": "@timestamp" } @@ -1788,18 +1687,22 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count desc\r\n| KEEP `Host Header`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\" AND dest_host is not null AND http.request.method IS NOT NULL\r\n AND user_agent.original is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host), VALUES(http.request.method) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)`, `VALUES(http.request.method)` \r\n| RENAME `VALUES(dest_host)` as `URL Domain`, `COUNT()` as Count, `VALUES(http.request.method)` as `HTTP Method`\r\n| SORT Count desc\r\n| KEEP `URL Domain`, `HTTP Method`, Count" }, "visualization": { "columns": [ { - "columnId": "Host Header" + "columnId": "URL Domain" + }, + { + "columnId": "HTTP Method", + "oneClickFilter": true }, { "columnId": "Count" } ], - "layerId": "55cb36c5-c31b-41d1-9a59-afa10ec49cb8", + "layerId": "c997f5ea-bded-428f-9371-4c25b161a032", "layerType": "data", "paging": { "enabled": true, @@ -1811,28 +1714,20 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `COUNT()` as Count\r\n| SORT Count desc\r\n| KEEP `Host Header`, Count" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { - "h": 16, - "i": "5ca41ef3-f946-4113-a52c-4624ae80a2f5", + "h": 18, + "i": "13c8b791-37c8-464f-b799-120216f92c79", "w": 23, "x": 0, - "y": 71 + "y": 75 }, - "panelIndex": "5ca41ef3-f946-4113-a52c-4624ae80a2f5", - "title": "Host Breakdown By HTTP Method [Logs Corelight]", + "panelIndex": "13c8b791-37c8-464f-b799-120216f92c79", + "title": "Host Breakdown By HTTP Method", "type": "lens" }, { @@ -1841,16 +1736,16 @@ "references": [], "state": { "adHocDataViews": { - "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", - "name": "logs-corelight.http*", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "logs-corelight.http*", + "title": "logs-corelight.*", "type": "esql" } }, @@ -1858,25 +1753,33 @@ "textBased": { "indexPatternRefs": [ { - "id": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "timeField": "@timestamp", - "title": "logs-corelight.http*" + "title": "logs-corelight.*" } ], "layers": { - "149d6145-deb0-47eb-a9d4-22dd302aa054": { - "columns": [ + "9e5ba40a-cabe-48e5-8c1c-85e81e68b301": { + "allColumns": [ + { + "columnId": "URL Domain", + "fieldName": "URL Domain", + "meta": { + "esType": "keyword", + "type": "string" + } + }, { - "columnId": "Host Header", - "fieldName": "Host Header", + "columnId": "Vendor Action", + "fieldName": "Vendor Action", "meta": { "esType": "keyword", "type": "string" } }, { - "columnId": "Status Code", - "fieldName": "Status Code", + "columnId": "Count", + "fieldName": "Count", "inMetricDimension": true, "meta": { "esType": "long", @@ -1884,8 +1787,42 @@ } }, { - "columnId": "Status Message", - "fieldName": "Status Message", + "columnId": "a023c81c-4ae7-4f41-8ca0-6639f05a355b", + "fieldName": "Status", + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "Status", + "fieldName": "Status", + "meta": { + "esType": "long", + "type": "number" + } + } + ], + "columns": [ + { + "columnId": "URL Domain", + "fieldName": "URL Domain", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "a023c81c-4ae7-4f41-8ca0-6639f05a355b", + "fieldName": "Status", + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "Vendor Action", + "fieldName": "Vendor Action", "meta": { "esType": "keyword", "type": "string" @@ -1901,9 +1838,9 @@ } } ], - "index": "6aca573bd91405e29061774c47708367fafd5165b53f364a28649651ed65671e", + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null AND http.response.status_code IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host), VALUES(http.response.status_code), VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)`, `VALUES(http.response.status_code)` , `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `VALUES(http.response.status_code)` as `Status Code`, `VALUES(http.response.status_name)` as `Status Message`, `COUNT()` as Count\r\n| SORT Count desc\r\n| KEEP `Host Header`, `Status Code`, `Status Message`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\"\r\n AND observer.hostname IS NOT NULL\r\n AND dest_host IS NOT NULL\r\n AND http.response.status_code IS NOT NULL \r\n AND user_agent.original IS NOT NULL\r\n| STATS\r\n VALUES(dest_host),\r\n VALUES(http.response.status_code),\r\n VALUES(http.response.status_name)\r\n BY source.ip, destination.ip, event.id\r\n| STATS Count = COUNT()\r\n BY `VALUES(dest_host)`, `VALUES(http.response.status_code)`, `VALUES(http.response.status_name)`\r\n| RENAME\r\n `VALUES(dest_host)` AS `URL Domain`,\r\n `VALUES(http.response.status_code)` AS `Status`,\r\n `VALUES(http.response.status_name)` AS `Vendor Action`\r\n| SORT Count DESC\r\n| KEEP `URL Domain`, `Status`, `Vendor Action`, Count" }, "timeField": "@timestamp" } @@ -1912,24 +1849,29 @@ }, "filters": [], "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null AND http.response.status_code IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host), VALUES(http.response.status_code), VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)`, `VALUES(http.response.status_code)` , `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `VALUES(http.response.status_code)` as `Status Code`, `VALUES(http.response.status_name)` as `Status Message`, `COUNT()` as Count\r\n| SORT Count desc\r\n| KEEP `Host Header`, `Status Code`, `Status Message`, Count" + "esql": "FROM logs-corelight.*\r\n| WHERE event.dataset LIKE \"http*\"\r\n AND observer.hostname IS NOT NULL\r\n AND dest_host IS NOT NULL\r\n AND http.response.status_code IS NOT NULL \r\n AND user_agent.original IS NOT NULL\r\n| STATS\r\n VALUES(dest_host),\r\n VALUES(http.response.status_code),\r\n VALUES(http.response.status_name)\r\n BY source.ip, destination.ip, event.id\r\n| STATS Count = COUNT()\r\n BY `VALUES(dest_host)`, `VALUES(http.response.status_code)`, `VALUES(http.response.status_name)`\r\n| RENAME\r\n `VALUES(dest_host)` AS `URL Domain`,\r\n `VALUES(http.response.status_code)` AS `Status`,\r\n `VALUES(http.response.status_name)` AS `Vendor Action`\r\n| SORT Count DESC\r\n| KEEP `URL Domain`, `Status`, `Vendor Action`, Count" }, "visualization": { "columns": [ { - "columnId": "Host Header" + "columnId": "URL Domain" }, { - "columnId": "Status Code" + "columnId": "Vendor Action", + "isMetric": false, + "isTransposed": false }, { - "columnId": "Status Message" + "columnId": "Count" }, { - "columnId": "Count" + "columnId": "a023c81c-4ae7-4f41-8ca0-6639f05a355b", + "isMetric": false, + "isTransposed": false, + "oneClickFilter": true } ], - "layerId": "149d6145-deb0-47eb-a9d4-22dd302aa054", + "layerId": "9e5ba40a-cabe-48e5-8c1c-85e81e68b301", "layerType": "data", "paging": { "enabled": true, @@ -1937,41 +1879,33 @@ } } }, - "title": "Status Code \u0026 Count of Status Message", + "title": "Status \u0026 Count of Vendor Action", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "FROM logs-corelight.http*\r\n| WHERE event.dataset == \"http\" AND dest_host is not null AND http.response.status_code IS NOT NULL\r\n| LIMIT 10000\r\n| STATS VALUES(dest_host), VALUES(http.response.status_code), VALUES(http.response.status_name) by source.ip, destination.ip, event.id \r\n| STATS COUNT() by `VALUES(dest_host)`, `VALUES(http.response.status_code)` , `VALUES(http.response.status_name)` \r\n| RENAME `VALUES(dest_host)` as `Host Header`, `VALUES(http.response.status_code)` as `Status Code`, `VALUES(http.response.status_name)` as `Status Message`, `COUNT()` as Count\r\n| SORT Count desc\r\n| KEEP `Host Header`, `Status Code`, `Status Message`, Count" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { - "h": 16, - "i": "071e07e4-abac-48f5-861b-1b0ce1953b68", + "h": 18, + "i": "8bb1b69c-6fa1-441c-98ae-541441f84007", "w": 25, "x": 23, - "y": 71 + "y": 75 }, - "panelIndex": "071e07e4-abac-48f5-861b-1b0ce1953b68", - "title": "Host Breakdown By HTTP Status [Logs Corelight]", + "panelIndex": "8bb1b69c-6fa1-441c-98ae-541441f84007", + "title": "Host Breakdown By HTTP Status", "type": "lens" } ], "timeRestore": false, "title": "[Logs Corelight] HTTP", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-07-22T06:44:38.653Z", "id": "corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa", "references": [ { @@ -1981,65 +1915,91 @@ }, { "id": "logs-*", - "name": "c10a2818-5123-4659-b8ea-b2d10bd30584:indexpattern-datasource-layer-905d13e6-21a4-4779-9c73-28a4deb568e5", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" }, { "id": "logs-*", - "name": "c10a2818-5123-4659-b8ea-b2d10bd30584:def3a9ea-34bf-49ce-aa98-69a815ff7186", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", "type": "index-pattern" }, { "id": "logs-*", - "name": "c10a2818-5123-4659-b8ea-b2d10bd30584:bf973b64-4cf4-469a-a480-b122f3696781", + "name": "94a222a3-12d8-465f-9b6a-6bc9912e7203:indexpattern-datasource-layer-a855e866-c8d4-4020-bc24-7b45a0f5feff", "type": "index-pattern" }, { "id": "logs-*", - "name": "83f18fd5-7218-4311-959a-a4432445b483:indexpattern-datasource-layer-905d13e6-21a4-4779-9c73-28a4deb568e5", + "name": "94a222a3-12d8-465f-9b6a-6bc9912e7203:23df9023-008b-4984-949a-1c0b609f0683", "type": "index-pattern" }, { "id": "logs-*", - "name": "83f18fd5-7218-4311-959a-a4432445b483:05767edc-f58d-4d6f-8616-edbc12bc2571", + "name": "94a222a3-12d8-465f-9b6a-6bc9912e7203:4c5d01bb-6669-4db9-a96a-61809b99e4b5", "type": "index-pattern" }, { "id": "logs-*", - "name": "6a6df5ca-b787-4131-84da-762da0d6755f:indexpattern-datasource-layer-905d13e6-21a4-4779-9c73-28a4deb568e5", + "name": "94a222a3-12d8-465f-9b6a-6bc9912e7203:702283a1-b201-4a81-9020-0f5a41360be1", "type": "index-pattern" }, { "id": "logs-*", - "name": "5e4a9ee0-ce63-4797-a871-f1a5e9fa7452:indexpattern-datasource-layer-7ce1f462-bdd2-4cea-99ba-afa9526a29b6", + "name": "cd300038-00d3-45cd-a6aa-5786aa48a325:indexpattern-datasource-layer-a855e866-c8d4-4020-bc24-7b45a0f5feff", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_afc48b88-9962-439c-9835-de744be7ade5:optionsListDataView", + "name": "cd300038-00d3-45cd-a6aa-5786aa48a325:9f853943-931c-4f72-ac37-e23f42fd318e", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_524af843-c613-493b-a129-aa52c6c05d43:optionsListDataView", + "name": "cd300038-00d3-45cd-a6aa-5786aa48a325:eabfc1fb-c92b-4a3f-bbe6-3809ed8f0ce8", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_7fb8732f-b009-425b-8552-7c0008ec41d1:optionsListDataView", + "name": "4c86dae5-df4f-4af8-9475-e1b18f629ee1:indexpattern-datasource-layer-a855e866-c8d4-4020-bc24-7b45a0f5feff", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_35a99a9f-d770-4824-b6fa-b15185d700df:optionsListDataView", + "name": "4c86dae5-df4f-4af8-9475-e1b18f629ee1:fb7fcabf-dadf-4eb3-a2a7-45ed610ba78e", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "4c86dae5-df4f-4af8-9475-e1b18f629ee1:5948699a-a78d-4431-abba-e38c09b707ca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8e3f2d90-8a81-45a6-904a-a1cecca8fe05:indexpattern-datasource-layer-7ad92b47-6e92-40d3-8a7c-23de142ed6fe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_afc48b88-9962-439c-9835-de744be7ade5:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_524af843-c613-493b-a129-aa52c6c05d43:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_7fb8732f-b009-425b-8552-7c0008ec41d1:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_35a99a9f-d770-4824-b6fa-b15185d700df:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8.json b/packages/corelight/kibana/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8.json index a3dabb8022e..c55d7795ca1 100644 --- a/packages/corelight/kibana/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8.json +++ b/packages/corelight/kibana/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8.json @@ -208,7 +208,7 @@ "description": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - **AWS VPC Flow**\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - **AWS VPC Flow**\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -15370,7 +15370,7 @@ "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T11:07:34.814Z", + "created_at": "2026-05-11T11:23:57.152Z", "id": "corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8", "references": [ { diff --git a/packages/corelight/kibana/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203.json b/packages/corelight/kibana/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203.json index d6737c8874b..561c52f188e 100644 --- a/packages/corelight/kibana/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203.json +++ b/packages/corelight/kibana/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "25c95ad2-d9ce-4855-9bbe-4e949dcd4656", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -55,6 +56,58 @@ "observer.vendor": "Corelight" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "event.dataset: tls* OR x509*", + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "query", + "negate": false, + "type": "custom" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "wildcard": { + "event.dataset": "tls*" + } + }, + { + "wildcard": { + "event.dataset": "x509*" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Aggregation", + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "event.dataset", + "negate": true, + "params": { + "query": "tls_agg" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "tls_agg" + } + } } ], "query": { @@ -94,7 +147,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - **SSL and x509**\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - **SSL and x509**\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -162,7 +215,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-36ca6566-64fc-457d-8f1f-a283e2792d7b", + "name": "indexpattern-datasource-layer-175a78af-d160-4466-a06b-0aa85c0bc279", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fdd8510c-f50a-499e-b2ca-4f6c7238fd8b", "type": "index-pattern" } ], @@ -170,15 +228,32 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "36ca6566-64fc-457d-8f1f-a283e2792d7b": { + "175a78af-d160-4466-a06b-0aa85c0bc279": { "columnOrder": [ - "3dcd3aa0-343a-4cd5-aee6-b8c0e9bf29e8", - "c8c450cc-785e-4e5b-ab32-65e83576aa57" + "58a01101-c283-44a8-9c8d-3a5b090cf461", + "0b55a912-d89b-4c3f-82da-11c2d62bebb9" ], "columns": { - "3dcd3aa0-343a-4cd5-aee6-b8c0e9bf29e8": { + "0b55a912-d89b-4c3f-82da-11c2d62bebb9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "58a01101-c283-44a8-9c8d-3a5b090cf461": { "customLabel": true, "dataType": "string", "isBucketed": true, @@ -191,7 +266,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "c8c450cc-785e-4e5b-ab32-65e83576aa57", + "columnId": "0b55a912-d89b-4c3f-82da-11c2d62bebb9", "type": "column" }, "orderDirection": "desc", @@ -203,29 +278,10 @@ }, "scale": "ordinal", "sourceField": "destination.domain" - }, - "c8c450cc-785e-4e5b-ab32-65e83576aa57": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" } }, "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } @@ -246,7 +302,7 @@ "alias": null, "disabled": false, "field": "destination.domain", - "index": "6f6516d8-4601-4b34-bac1-24f9a787d17c", + "index": "fdd8510c-f50a-499e-b2ca-4f6c7238fd8b", "key": "destination.domain", "negate": true, "params": { @@ -267,7 +323,26 @@ "meta": { "alias": null, "disabled": false, - "index": "554b25a1-9950-4801-820e-0088724f3ca3", + "field": "observer.hostname", + "index": "8449f673-b67a-4ebd-89c7-7746d92203c6", + "key": "observer.hostname", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d9603469-df56-4852-84a8-2905659fc6ce", "negate": false, "params": [ { @@ -315,39 +390,16 @@ "store": "appState" }, "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "233db244-dacc-4687-a304-18d0dac87659", - "key": "event.dataset", - "negate": false, - "params": { - "query": "tls" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "tls" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, + "alias": "event.dataset: tls*", "disabled": false, - "field": "observer.hostname", - "index": "08304475-a100-4296-985d-740ca532fbeb", - "key": "observer.hostname", + "index": "48036000-70aa-4aac-b3ac-13a779bebccf", + "key": "query", "negate": false, - "type": "exists" + "type": "custom" }, "query": { - "exists": { - "field": "observer.hostname" + "wildcard": { + "event.dataset": "tls*" } } } @@ -360,15 +412,17 @@ "visualization": { "columns": [ { - "columnId": "3dcd3aa0-343a-4cd5-aee6-b8c0e9bf29e8" + "columnId": "58a01101-c283-44a8-9c8d-3a5b090cf461", + "isMetric": false, + "isTransposed": false }, { - "columnId": "c8c450cc-785e-4e5b-ab32-65e83576aa57", + "columnId": "0b55a912-d89b-4c3f-82da-11c2d62bebb9", "isMetric": true, "isTransposed": false } ], - "layerId": "36ca6566-64fc-457d-8f1f-a283e2792d7b", + "layerId": "175a78af-d160-4466-a06b-0aa85c0bc279", "layerType": "data" } }, @@ -376,143 +430,101 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "destination.domain", - "index": "6f6516d8-4601-4b34-bac1-24f9a787d17c", - "key": "destination.domain", - "negate": true, - "params": { - "query": "" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "destination.domain": "" + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "0e3090cf-37f1-40c2-8f73-873f6714d933", + "w": 19, + "x": 12, + "y": 4 + }, + "panelIndex": "0e3090cf-37f1-40c2-8f73-873f6714d933", + "title": "Top Certificate Subjects", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "adb5fe3ee72aece1bc70935b2117f58c0fedbe068e7ad94404f1c53d09fca3fc": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "adb5fe3ee72aece1bc70935b2117f58c0fedbe068e7ad94404f1c53d09fca3fc", + "name": "logs-corelight.ssl*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.ssl*", + "type": "esql" } - } - }, - { - "$state": { - "store": "appState" }, - "meta": { - "alias": null, - "disabled": false, - "index": "554b25a1-9950-4801-820e-0088724f3ca3", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.domain", - "index": "logs-*", - "key": "destination.domain", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "destination.domain" - } + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "adb5fe3ee72aece1bc70935b2117f58c0fedbe068e7ad94404f1c53d09fca3fc", + "timeField": "@timestamp", + "title": "logs-corelight.ssl*" } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "tls.server.subject", - "index": "logs-*", - "key": "tls.server.subject", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "tls.server.subject" - } + ], + "layers": { + "568daad0-13b2-41e8-a930-a3277c34c89f": { + "columns": [ + { + "columnId": "SSL Aggregation", + "fieldName": "SSL Aggregation", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "adb5fe3ee72aece1bc70935b2117f58c0fedbe068e7ad94404f1c53d09fca3fc", + "query": { + "esql": "FROM logs-corelight.ssl*\r\n| WHERE event.dataset == \"tls_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `SSL Aggregation` = CASE(count \u003e 0, \"SSL Agg Logs Available\", \"No SSL Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `SSL Aggregation`, status\r\n" + }, + "timeField": "@timestamp" } } - ], - "relation": "OR", - "type": "combined" - }, - "query": {} - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "233db244-dacc-4687-a304-18d0dac87659", - "key": "event.dataset", - "negate": false, - "params": { - "query": "tls" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "tls" } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "08304475-a100-4296-985d-740ca532fbeb", - "key": "observer.hostname", - "negate": false, - "type": "exists" }, + "filters": [], "query": { - "exists": { - "field": "observer.hostname" - } + "esql": "FROM logs-corelight.ssl*\r\n| WHERE event.dataset == \"tls_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `SSL Aggregation` = CASE(count \u003e 0, \"SSL Agg Logs Available\", \"No SSL Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `SSL Aggregation`, status\r\n" + }, + "visualization": { + "columns": [ + { + "columnId": "SSL Aggregation" + } + ], + "layerId": "568daad0-13b2-41e8-a930-a3277c34c89f", + "layerType": "data" } - } - ], - "query": { - "language": "kuery", - "query": "" + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 16, - "i": "1a61d61b-0151-45d6-934e-a4359ae40424", - "w": 36, - "x": 12, + "i": "bd73f8ea-1b73-470e-8d06-26d22280d743", + "w": 17, + "x": 31, "y": 4 }, - "panelIndex": "1a61d61b-0151-45d6-934e-a4359ae40424", - "title": "Top Certificate Subjects [Logs Corelight]", + "panelIndex": "bd73f8ea-1b73-470e-8d06-26d22280d743", + "title": "SSL Aggregation", "type": "lens" }, { @@ -521,7 +533,17 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-285b953a-092e-4d1e-afc4-aaf2cea4c7d6", + "name": "indexpattern-datasource-layer-175a78af-d160-4466-a06b-0aa85c0bc279", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f34ffe7d-b3ae-4fc0-9c52-c31d48ce9a5b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2bb7b28e-3bf8-49fd-910f-e2f71567c502", "type": "index-pattern" } ], @@ -529,15 +551,14 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "285b953a-092e-4d1e-afc4-aaf2cea4c7d6": { + "175a78af-d160-4466-a06b-0aa85c0bc279": { "columnOrder": [ - "e20e7338-bdbd-49e0-9fd0-3706982c1b14", - "16c7561c-53d5-4aa0-bbda-e5a7b414547b" + "58a01101-c283-44a8-9c8d-3a5b090cf461", + "0b55a912-d89b-4c3f-82da-11c2d62bebb9" ], "columns": { - "16c7561c-53d5-4aa0-bbda-e5a7b414547b": { + "0b55a912-d89b-4c3f-82da-11c2d62bebb9": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -555,7 +576,7 @@ "scale": "ratio", "sourceField": "___records___" }, - "e20e7338-bdbd-49e0-9fd0-3706982c1b14": { + "58a01101-c283-44a8-9c8d-3a5b090cf461": { "customLabel": true, "dataType": "string", "isBucketed": true, @@ -568,7 +589,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "16c7561c-53d5-4aa0-bbda-e5a7b414547b", + "columnId": "0b55a912-d89b-4c3f-82da-11c2d62bebb9", "type": "column" }, "orderDirection": "desc", @@ -576,6 +597,7 @@ "parentFormat": { "id": "terms" }, + "secondaryFields": [], "size": 10 }, "scale": "ordinal", @@ -584,7 +606,6 @@ }, "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } @@ -602,20 +623,17 @@ "store": "appState" }, "meta": { - "alias": null, + "alias": "event.dataset: tls*", "disabled": false, - "field": "event.dataset", - "index": "564afe32-0721-4c57-8b43-b94c74fa2c21", - "key": "event.dataset", + "index": "f34ffe7d-b3ae-4fc0-9c52-c31d48ce9a5b", + "key": "query", "negate": false, - "params": { - "query": "tls" - }, - "type": "phrase" + "type": "custom", + "value": "{\"wildcard\":{\"event.dataset\":\"tls*\"}}" }, "query": { - "match_phrase": { - "event.dataset": "tls" + "wildcard": { + "event.dataset": "tls*" } } }, @@ -626,16 +644,16 @@ "meta": { "alias": null, "disabled": false, - "field": "observer.hostname", - "index": "477d7f4d-43f5-442f-b7ce-6fc12a7e6af7", - "key": "observer.hostname", + "field": "tls.cipher", + "index": "2bb7b28e-3bf8-49fd-910f-e2f71567c502", + "key": "tls.cipher", "negate": false, "type": "exists", "value": "exists" }, "query": { "exists": { - "field": "observer.hostname" + "field": "tls.cipher" } } }, @@ -646,16 +664,15 @@ "meta": { "alias": null, "disabled": false, - "field": "tls.cipher", - "index": "5edd4f63-31ae-4fd3-9ce1-1cb972d3deee", - "key": "tls.cipher", + "field": "observer.hostname", + "index": "8449f673-b67a-4ebd-89c7-7746d92203c6", + "key": "observer.hostname", "negate": false, - "type": "exists", - "value": "exists" + "type": "exists" }, "query": { "exists": { - "field": "tls.cipher" + "field": "observer.hostname" } } } @@ -687,16 +704,16 @@ } ] }, - "layerId": "285b953a-092e-4d1e-afc4-aaf2cea4c7d6", + "layerId": "175a78af-d160-4466-a06b-0aa85c0bc279", "layerType": "data", "legendDisplay": "show", "metrics": [ - "16c7561c-53d5-4aa0-bbda-e5a7b414547b" + "0b55a912-d89b-4c3f-82da-11c2d62bebb9" ], "nestedLegend": false, "numberDisplay": "percent", "primaryGroups": [ - "e20e7338-bdbd-49e0-9fd0-3706982c1b14" + "58a01101-c283-44a8-9c8d-3a5b090cf461" ], "truncateLegend": false } @@ -708,92 +725,17 @@ "type": "lens", "visualizationType": "lnsPie" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "564afe32-0721-4c57-8b43-b94c74fa2c21", - "key": "event.dataset", - "negate": false, - "params": { - "query": "tls" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "tls" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "477d7f4d-43f5-442f-b7ce-6fc12a7e6af7", - "key": "observer.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "tls.cipher", - "index": "5edd4f63-31ae-4fd3-9ce1-1cb972d3deee", - "key": "tls.cipher", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "tls.cipher" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 15, - "i": "bff2c27e-3dfc-440f-b8cc-d873091e21f3", + "i": "dba54a10-6b39-4ffa-b933-73c5aa79cdf4", "w": 36, "x": 12, "y": 20 }, - "panelIndex": "bff2c27e-3dfc-440f-b8cc-d873091e21f3", - "title": "Top Ciphers [Logs Corelight]", + "panelIndex": "dba54a10-6b39-4ffa-b933-73c5aa79cdf4", + "title": "Top Ciphers", "type": "lens" }, { @@ -842,530 +784,354 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3004118f-134f-4321-af37-781efdd04bac", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.*", + "type": "esql" + } + }, "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", + "textBased": { + "indexPatternRefs": [ + { + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "timeField": "@timestamp", + "title": "logs-corelight.*" + } + ], "layers": { - "3004118f-134f-4321-af37-781efdd04bac": { - "columnOrder": [ - "ed51292f-cad9-4860-bb84-1bc53d13c15a", - "9dfce745-b8ee-4d27-8dd8-d8aad86e3028" + "2f7627f5-9a2f-47b5-9c7d-82f1bcf0e219": { + "columns": [ + { + "columnId": "SSL Subject", + "fieldName": "SSL Subject", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "Count", + "fieldName": "Count", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + } ], - "columns": { - "9dfce745-b8ee-4d27-8dd8-d8aad86e3028": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "ed51292f-cad9-4860-bb84-1bc53d13c15a": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "SSL Subject", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "9dfce745-b8ee-4d27-8dd8-d8aad86e3028", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "file.x509.subject.distinguished_name" - } + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "query": { + "esql": "FROM logs-corelight.*\r\n| WHERE observer.vendor == \"Corelight\" AND observer.hostname IS NOT NULL AND (event.dataset LIKE \"x509*\"\r\n OR event.dataset LIKE \"tls*\")\r\n| EVAL `SSL Subject` = COALESCE(file.x509.subject.distinguished_name, tls.server.subject)\r\n| WHERE `SSL Subject` IS NOT NULL\r\n| STATS Count = COUNT() BY `SSL Subject`\r\n| SORT Count DESC\r\n| LIMIT 10\r\n| KEEP `SSL Subject`, Count" }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 + "timeField": "@timestamp" } } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} } }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "6fb9f18b-2091-498b-b6e3-8580b674b44e", - "key": "event.dataset", - "negate": false, - "params": { - "query": "x509" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "x509" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "abf12c96-6668-46a4-a639-adfe96bbc996", - "key": "observer.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.x509.subject.distinguished_name", - "index": "85ac0951-223d-413f-87de-ff2d3640aa85", - "key": "file.x509.subject.distinguished_name", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "file.x509.subject.distinguished_name" - } - } - } - ], - "internalReferences": [], + "filters": [], "query": { - "language": "kuery", - "query": "" + "esql": "FROM logs-corelight.*\r\n| WHERE observer.vendor == \"Corelight\" AND observer.hostname IS NOT NULL AND (event.dataset LIKE \"x509*\"\r\n OR event.dataset LIKE \"tls*\")\r\n| EVAL `SSL Subject` = COALESCE(file.x509.subject.distinguished_name, tls.server.subject)\r\n| WHERE `SSL Subject` IS NOT NULL\r\n| STATS Count = COUNT() BY `SSL Subject`\r\n| SORT Count DESC\r\n| LIMIT 10\r\n| KEEP `SSL Subject`, Count" }, "visualization": { "columns": [ { - "columnId": "9dfce745-b8ee-4d27-8dd8-d8aad86e3028", - "isMetric": true, - "isTransposed": false + "columnId": "SSL Subject" }, { - "columnId": "ed51292f-cad9-4860-bb84-1bc53d13c15a", - "isMetric": false, - "isTransposed": false + "columnId": "Count" } ], - "layerId": "3004118f-134f-4321-af37-781efdd04bac", + "layerId": "2f7627f5-9a2f-47b5-9c7d-82f1bcf0e219", "layerType": "data" } }, - "title": "", + "title": "Bar vertical stacked", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "6fb9f18b-2091-498b-b6e3-8580b674b44e", - "key": "event.dataset", - "negate": false, - "params": { - "query": "x509" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "x509" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "abf12c96-6668-46a4-a639-adfe96bbc996", - "key": "observer.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.x509.subject.distinguished_name", - "index": "85ac0951-223d-413f-87de-ff2d3640aa85", - "key": "file.x509.subject.distinguished_name", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "file.x509.subject.distinguished_name" - } - } - } + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { - "h": 16, - "i": "afe182df-eaff-4276-bc75-4844ad0f83c1", + "h": 17, + "i": "d83076db-a279-45b1-813e-56c9370ccbfe", "w": 24, "x": 0, "y": 39 }, - "panelIndex": "afe182df-eaff-4276-bc75-4844ad0f83c1", - "title": "x509 Top Subjects [Logs Corelight]", + "panelIndex": "d83076db-a279-45b1-813e-56c9370ccbfe", + "title": "x509 Top Subjects", "type": "lens" }, { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3004118f-134f-4321-af37-781efdd04bac", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.*", + "type": "esql" + } + }, "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", + "textBased": { + "indexPatternRefs": [ + { + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "timeField": "@timestamp", + "title": "logs-corelight.*" + } + ], "layers": { - "3004118f-134f-4321-af37-781efdd04bac": { - "columnOrder": [ - "ed51292f-cad9-4860-bb84-1bc53d13c15a", - "9dfce745-b8ee-4d27-8dd8-d8aad86e3028" - ], - "columns": { - "9dfce745-b8ee-4d27-8dd8-d8aad86e3028": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "___records___" + "90615214-9648-42b2-befb-962d1a379254": { + "columns": [ + { + "columnId": "SSL Subject", + "fieldName": "SSL Subject", + "meta": { + "esType": "keyword", + "type": "string" + } }, - "ed51292f-cad9-4860-bb84-1bc53d13c15a": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "SSL Subject", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "9dfce745-b8ee-4d27-8dd8-d8aad86e3028", - "type": "column" - }, - "orderDirection": "asc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "file.x509.subject.distinguished_name" + { + "columnId": "Count", + "fieldName": "Count", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } } + ], + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "query": { + "esql": "FROM logs-corelight.*\r\n| WHERE observer.vendor == \"Corelight\" AND observer.hostname IS NOT NULL AND (event.dataset LIKE \"x509*\" \r\n OR event.dataset LIKE \"tls*\")\r\n| EVAL `SSL Subject` = COALESCE(file.x509.subject.distinguished_name, tls.server.subject)\r\n| WHERE `SSL Subject` IS NOT NULL\r\n| STATS Count = COUNT() BY `SSL Subject`\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `SSL Subject`, Count" }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 + "timeField": "@timestamp" } } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} } }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "6fb9f18b-2091-498b-b6e3-8580b674b44e", - "key": "event.dataset", - "negate": false, - "params": { - "query": "x509" - }, - "type": "phrase" + "filters": [], + "query": { + "esql": "FROM logs-corelight.*\r\n| WHERE observer.vendor == \"Corelight\" AND observer.hostname IS NOT NULL AND (event.dataset LIKE \"x509*\" \r\n OR event.dataset LIKE \"tls*\")\r\n| EVAL `SSL Subject` = COALESCE(file.x509.subject.distinguished_name, tls.server.subject)\r\n| WHERE `SSL Subject` IS NOT NULL\r\n| STATS Count = COUNT() BY `SSL Subject`\r\n| SORT Count ASC\r\n| LIMIT 10\r\n| KEEP `SSL Subject`, Count" + }, + "visualization": { + "columns": [ + { + "columnId": "SSL Subject" }, - "query": { - "match_phrase": { - "event.dataset": "x509" - } + { + "columnId": "Count" } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "abf12c96-6668-46a4-a639-adfe96bbc996", - "key": "observer.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" + ], + "layerId": "90615214-9648-42b2-befb-962d1a379254", + "layerType": "data" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 17, + "i": "35eced3a-4745-4ea3-ac38-3534b134515b", + "w": 24, + "x": 24, + "y": 39 + }, + "panelIndex": "35eced3a-4745-4ea3-ac38-3534b134515b", + "title": "x509 Rare Subjects", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "name": "logs-corelight.*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "timeField": "@timestamp", + "title": "logs-corelight.*" } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.x509.subject.distinguished_name", - "index": "85ac0951-223d-413f-87de-ff2d3640aa85", - "key": "file.x509.subject.distinguished_name", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "file.x509.subject.distinguished_name" + ], + "layers": { + "5cd7f46d-14e2-4192-a26e-50b5428d714d": { + "allColumns": [ + { + "columnId": "SSL Issuer", + "fieldName": "SSL Issuer", + "inMetricDimension": true, + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "c0ee7280-7b76-4409-9fcd-91eb69fa85c3", + "fieldName": "SSL End Time", + "meta": { + "esType": "date", + "type": "date" + } + }, + { + "columnId": "8f6c1dde-7e75-4852-bf55-3047941e86d2", + "fieldName": "SSL Subject", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "SSL Subject", + "fieldName": "SSL Subject", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "SSL End Time", + "fieldName": "SSL End Time", + "meta": { + "esType": "date", + "type": "date" + } + } + ], + "columns": [ + { + "columnId": "c0ee7280-7b76-4409-9fcd-91eb69fa85c3", + "fieldName": "SSL End Time", + "meta": { + "esType": "date", + "type": "date" + } + }, + { + "columnId": "8f6c1dde-7e75-4852-bf55-3047941e86d2", + "fieldName": "SSL Subject", + "meta": { + "esType": "keyword", + "type": "string" + } + }, + { + "columnId": "4d7566c0-cb11-4821-817a-20c98bb51dce", + "fieldName": "SSL Issuer", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "ef9316bda12c85af54487101bc5893c026388eda9ec7e84dbd4ea0a11d2a18af", + "query": { + "esql": "FROM logs-corelight.*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND observer.hostname IS NOT NULL\r\n AND event.dataset LIKE \"x509*\"\r\n AND file.x509.not_after \u003c NOW()\r\n| KEEP file.x509.subject.distinguished_name, file.x509.not_after, file.x509.issuer.distinguished_name\r\n| RENAME file.x509.subject.distinguished_name AS `SSL Subject`, file.x509.not_after AS `SSL End Time`, file.x509.issuer.distinguished_name AS `SSL Issuer`" + }, + "timeField": "@timestamp" } } } - ], - "internalReferences": [], + }, + "filters": [], "query": { - "language": "kuery", - "query": "" + "esql": "FROM logs-corelight.*\r\n| WHERE observer.vendor == \"Corelight\"\r\n AND observer.hostname IS NOT NULL\r\n AND event.dataset LIKE \"x509*\"\r\n AND file.x509.not_after \u003c NOW()\r\n| KEEP file.x509.subject.distinguished_name, file.x509.not_after, file.x509.issuer.distinguished_name\r\n| RENAME file.x509.subject.distinguished_name AS `SSL Subject`, file.x509.not_after AS `SSL End Time`, file.x509.issuer.distinguished_name AS `SSL Issuer`" }, "visualization": { "columns": [ { - "columnId": "9dfce745-b8ee-4d27-8dd8-d8aad86e3028", - "isMetric": true, + "columnId": "c0ee7280-7b76-4409-9fcd-91eb69fa85c3", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "8f6c1dde-7e75-4852-bf55-3047941e86d2", + "isMetric": false, "isTransposed": false }, { - "columnId": "ed51292f-cad9-4860-bb84-1bc53d13c15a", + "columnId": "4d7566c0-cb11-4821-817a-20c98bb51dce", "isMetric": false, "isTransposed": false } ], - "layerId": "3004118f-134f-4321-af37-781efdd04bac", + "layerId": "5cd7f46d-14e2-4192-a26e-50b5428d714d", "layerType": "data" } }, - "title": "", + "title": "Table SSL Subject \u0026 SSL End Time \u0026 SSL Issuer", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "event.dataset", - "index": "6fb9f18b-2091-498b-b6e3-8580b674b44e", - "key": "event.dataset", - "negate": false, - "params": { - "query": "x509" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "x509" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "abf12c96-6668-46a4-a639-adfe96bbc996", - "key": "observer.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "file.x509.subject.distinguished_name", - "index": "85ac0951-223d-413f-87de-ff2d3640aa85", - "key": "file.x509.subject.distinguished_name", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "file.x509.subject.distinguished_name" - } - } - } + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { - "h": 16, - "i": "5559c2c4-8059-4ace-b297-e0aac1a4138a", - "w": 24, - "x": 24, - "y": 39 + "h": 18, + "i": "fe7df02e-aff8-45dc-a880-14d2dc3f8433", + "w": 48, + "x": 0, + "y": 56 }, - "panelIndex": "5559c2c4-8059-4ace-b297-e0aac1a4138a", - "title": "x509 Rare Subjects [Logs Corelight]", + "panelIndex": "fe7df02e-aff8-45dc-a880-14d2dc3f8433", + "title": "x509 Expired Certificates", "type": "lens" } ], "timeRestore": false, "title": "[Logs Corelight] SSL and x509", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-04-08T07:04:43.213Z", "id": "corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203", "references": [ { @@ -1375,35 +1141,46 @@ }, { "id": "logs-*", - "name": "1a61d61b-0151-45d6-934e-a4359ae40424:indexpattern-datasource-layer-36ca6566-64fc-457d-8f1f-a283e2792d7b", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" }, { "id": "logs-*", - "name": "bff2c27e-3dfc-440f-b8cc-d873091e21f3:indexpattern-datasource-layer-285b953a-092e-4d1e-afc4-aaf2cea4c7d6", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", "type": "index-pattern" }, { "id": "logs-*", - "name": "afe182df-eaff-4276-bc75-4844ad0f83c1:indexpattern-datasource-layer-3004118f-134f-4321-af37-781efdd04bac", + "name": "0e3090cf-37f1-40c2-8f73-873f6714d933:indexpattern-datasource-layer-175a78af-d160-4466-a06b-0aa85c0bc279", "type": "index-pattern" }, { "id": "logs-*", - "name": "5559c2c4-8059-4ace-b297-e0aac1a4138a:indexpattern-datasource-layer-3004118f-134f-4321-af37-781efdd04bac", + "name": "0e3090cf-37f1-40c2-8f73-873f6714d933:fdd8510c-f50a-499e-b2ca-4f6c7238fd8b", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_25c95ad2-d9ce-4855-9bbe-4e949dcd4656:optionsListDataView", + "name": "dba54a10-6b39-4ffa-b933-73c5aa79cdf4:indexpattern-datasource-layer-175a78af-d160-4466-a06b-0aa85c0bc279", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "dba54a10-6b39-4ffa-b933-73c5aa79cdf4:f34ffe7d-b3ae-4fc0-9c52-c31d48ce9a5b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dba54a10-6b39-4ffa-b933-73c5aa79cdf4:2bb7b28e-3bf8-49fd-910f-e2f71567c502", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_25c95ad2-d9ce-4855-9bbe-4e949dcd4656:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb.json b/packages/corelight/kibana/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb.json index 393be23289f..b0ac73f4301 100644 --- a/packages/corelight/kibana/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb.json +++ b/packages/corelight/kibana/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb.json @@ -14,6 +14,8 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "network.protocol", + "id": "012bb6c6-f9ee-4c39-8e75-7c4dee5a5026", + "id": "012bb6c6-f9ee-4c39-8e75-7c4dee5a5026", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -23,7 +25,7 @@ "title": "Service" }, "grow": true, - "order": 5, + "order": 4, "type": "optionsListControl", "width": "medium" }, @@ -31,6 +33,8 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "0168efe7-05c1-4272-a872-b1c823371951", + "id": "0168efe7-05c1-4272-a872-b1c823371951", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -48,50 +52,53 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "source.ip", + "id": "1d3b9da1-34a5-4de7-9da7-0c21106b5dc8", "searchTechnique": "prefix", "selectedOptions": [], "sort": { "by": "_count", "direction": "desc" }, - "title": "Originator IP (id_orig_h)" + "title": "Originator IP (src_ip)" }, "grow": true, "order": 1, "type": "optionsListControl", "width": "medium" }, - "2c37ab99-5bda-4366-8bb3-235facbbff93": { + "8b2ad078-061b-4a83-ba8d-55aa43f40bdf": { "explicitInput": { "dataViewId": "logs-*", - "fieldName": "source.port", - "searchTechnique": "exact", + "fieldName": "destination.ip", + "id": "8b2ad078-061b-4a83-ba8d-55aa43f40bdf", + "searchTechnique": "prefix", "selectedOptions": [], "sort": { "by": "_count", "direction": "desc" }, - "title": "Originator Port (id_orig_p)" + "title": "Responder IP (dest_ip)" }, "grow": true, "order": 2, "type": "optionsListControl", "width": "medium" }, - "8b2ad078-061b-4a83-ba8d-55aa43f40bdf": { + "9817e2bc-c2d0-4bd1-81d2-97746b1d84ff": { "explicitInput": { "dataViewId": "logs-*", - "fieldName": "destination.ip", + "fieldName": "event.id", + "id": "9817e2bc-c2d0-4bd1-81d2-97746b1d84ff", "searchTechnique": "prefix", "selectedOptions": [], "sort": { "by": "_count", "direction": "desc" }, - "title": "Responder IP (id_resp_h)" + "title": "Connection UID" }, "grow": true, - "order": 3, + "order": 5, "type": "optionsListControl", "width": "medium" }, @@ -99,16 +106,17 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "destination.port", + "id": "fab65a21-501b-40ed-b010-2856d20d5c6c", "searchTechnique": "exact", "selectedOptions": [], "sort": { "by": "_count", "direction": "desc" }, - "title": " Responder Port (id_resp_p)" + "title": " Responder Port (dest_port)" }, "grow": true, - "order": 4, + "order": 3, "type": "optionsListControl", "width": "medium" } @@ -146,240 +154,40 @@ "store": "appState" }, "meta": { - "alias": "NOT is_broadcast: true", + "alias": "event.dataset: conn*", "disabled": false, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "query", "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "source.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "source.ip": "255.255.255.255" - } - } - ] - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": true, - "params": [ - "0.0.0.0", - "255.255.255.255" - ], - "type": "phrases", - "value": [ - "0.0.0.0", - "255.255.255.255" - ] - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "destination.ip": "0.0.0.0" - } - }, - { - "match_phrase": { - "destination.ip": "255.255.255.255" - } - } - ] - } - } - } - ], - "relation": "OR", - "type": "combined" + "type": "custom" }, - "query": {} + "query": { + "wildcard": { + "event.dataset": "conn*" + } + } }, { "$state": { "store": "appState" }, "meta": { - "alias": null, + "alias": "Aggregation", "disabled": false, "field": "event.dataset", "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", "key": "event.dataset", - "negate": false, + "negate": true, "params": { - "query": "conn" + "query": "conn_agg" }, "type": "phrase" }, "query": { "match_phrase": { - "event.dataset": "conn" + "event.dataset": "conn_agg" } } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "source.ip", - "index": "logs-*", - "key": "source.ip", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "source.ip" - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "destination.ip", - "index": "logs-*", - "key": "destination.ip", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "destination.ip" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "observer.hostname", - "index": "logs-*", - "key": "observer.hostname", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "observer.hostname" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "network.protocol", - "index": "logs-*", - "key": "network.protocol", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "network.protocol" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "source.port", - "index": "logs-*", - "key": "source.port", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "source.port" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "destination.port", - "index": "logs-*", - "key": "destination.port", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "destination.port" - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} } ], "query": { @@ -416,10 +224,9 @@ } }, "description": "", - "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - **Connections**\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- **Data Explorer**\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - **Connections**\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -428,7 +235,7 @@ } }, "gridData": { - "h": 31, + "h": 38, "i": "183d2b7b-6b2a-46ce-b53e-e92f5126b3a4", "w": 11, "x": 0, @@ -444,7 +251,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-e6088802-b9ee-41a9-b31b-f58feaee3dc6", + "name": "indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" } ], @@ -454,56 +261,28 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "e6088802-b9ee-41a9-b31b-f58feaee3dc6": { + "50e6b196-4d90-4265-a488-e9618c28eba2": { "columnOrder": [ - "9fc89330-be1d-4d98-9688-06172974af64", - "3d91c2f4-704d-402c-b383-fd286c63efaf" + "a81d352c-2fec-4987-8941-1ec756642f74" ], "columns": { - "3d91c2f4-704d-402c-b383-fd286c63efaf": { + "a81d352c-2fec-4987-8941-1ec756642f74": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Total", - "operationType": "count", + "label": "Traffic Volume", + "operationType": "sum", "params": { "emptyAsNull": false, "format": { - "id": "number", + "id": "bytes", "params": { - "decimals": 0 + "decimals": 2 } } }, "scale": "ratio", - "sourceField": "___records___" - }, - "9fc89330-be1d-4d98-9688-06172974af64": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Service", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "3d91c2f4-704d-402c-b383-fd286c63efaf", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 15 - }, - "scale": "ordinal", - "sourceField": "network.protocol" + "sourceField": "network.ip_bytes" } }, "ignoreGlobalFilters": false, @@ -527,71 +306,28 @@ "query": "" }, "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "e6088802-b9ee-41a9-b31b-f58feaee3dc6", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "3d91c2f4-704d-402c-b383-fd286c63efaf" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "9fc89330-be1d-4d98-9688-06172974af64" - ], - "truncateLegend": false - } - ], - "shape": "pie" + "color": "#6092C0", + "layerId": "50e6b196-4d90-4265-a488-e9618c28eba2", + "layerType": "data", + "metricAccessor": "a81d352c-2fec-4987-8941-1ec756642f74" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } + "visualizationType": "lnsMetric" }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 16, - "i": "60704ce1-f587-47f6-ab7a-5b72e3824502", - "w": 18, + "h": 6, + "i": "1ff2ae04-48f2-433a-bea8-617b8193359f", + "w": 7, "x": 11, "y": 0 }, - "panelIndex": "60704ce1-f587-47f6-ab7a-5b72e3824502", - "title": "Top Services [Logs Corelight]", + "panelIndex": "1ff2ae04-48f2-433a-bea8-617b8193359f", + "title": "Traffic Volume", "type": "lens" }, { @@ -600,7 +336,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-56d0664e-d583-42c3-a59a-dd3cdb4bd754", + "name": "indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" } ], @@ -610,50 +346,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "56d0664e-d583-42c3-a59a-dd3cdb4bd754": { + "50e6b196-4d90-4265-a488-e9618c28eba2": { "columnOrder": [ - "ac825eca-e572-42b4-97ac-4764c170cd80", - "bc67890c-766a-4c85-96ed-6566fe9d9a81" + "a81d352c-2fec-4987-8941-1ec756642f74" ], "columns": { - "ac825eca-e572-42b4-97ac-4764c170cd80": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Destination Port", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - }, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "bc67890c-766a-4c85-96ed-6566fe9d9a81", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 15 - }, - "scale": "ordinal", - "sourceField": "destination.port" - }, - "bc67890c-766a-4c85-96ed-6566fe9d9a81": { + "a81d352c-2fec-4987-8941-1ec756642f74": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", - "operationType": "count", + "label": "Traffic Sources", + "operationType": "unique_count", "params": { "emptyAsNull": false, "format": { @@ -664,7 +367,7 @@ } }, "scale": "ratio", - "sourceField": "___records___" + "sourceField": "source.ip" } }, "ignoreGlobalFilters": false, @@ -688,71 +391,28 @@ "query": "" }, "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "56d0664e-d583-42c3-a59a-dd3cdb4bd754", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "bc67890c-766a-4c85-96ed-6566fe9d9a81" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "ac825eca-e572-42b4-97ac-4764c170cd80" - ], - "truncateLegend": false - } - ], - "shape": "pie" + "color": "#6092C0", + "layerId": "50e6b196-4d90-4265-a488-e9618c28eba2", + "layerType": "data", + "metricAccessor": "a81d352c-2fec-4987-8941-1ec756642f74" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } + "visualizationType": "lnsMetric" }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 16, - "i": "06a54807-76db-4929-a18c-ca1f2ded93b8", - "w": 19, - "x": 29, + "h": 6, + "i": "8978ab47-f109-4af9-a8d0-802b62697f23", + "w": 7, + "x": 18, "y": 0 }, - "panelIndex": "06a54807-76db-4929-a18c-ca1f2ded93b8", - "title": "Top Responder Ports [Logs Corelight]", + "panelIndex": "8978ab47-f109-4af9-a8d0-802b62697f23", + "title": "Traffic Sources", "type": "lens" }, { @@ -761,7 +421,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-56d0664e-d583-42c3-a59a-dd3cdb4bd754", + "name": "indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" } ], @@ -771,45 +431,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "56d0664e-d583-42c3-a59a-dd3cdb4bd754": { + "50e6b196-4d90-4265-a488-e9618c28eba2": { "columnOrder": [ - "ac825eca-e572-42b4-97ac-4764c170cd80", - "bc67890c-766a-4c85-96ed-6566fe9d9a81" + "a81d352c-2fec-4987-8941-1ec756642f74" ], "columns": { - "ac825eca-e572-42b4-97ac-4764c170cd80": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Source IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "bc67890c-766a-4c85-96ed-6566fe9d9a81", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 15 - }, - "scale": "ordinal", - "sourceField": "source.ip" - }, - "bc67890c-766a-4c85-96ed-6566fe9d9a81": { + "a81d352c-2fec-4987-8941-1ec756642f74": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", - "operationType": "count", + "label": "Traffic Connections", + "operationType": "unique_count", "params": { "emptyAsNull": false, "format": { @@ -820,7 +452,7 @@ } }, "scale": "ratio", - "sourceField": "___records___" + "sourceField": "event.id" } }, "ignoreGlobalFilters": false, @@ -844,71 +476,28 @@ "query": "" }, "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "56d0664e-d583-42c3-a59a-dd3cdb4bd754", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "bc67890c-766a-4c85-96ed-6566fe9d9a81" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "ac825eca-e572-42b4-97ac-4764c170cd80" - ], - "truncateLegend": false - } - ], - "shape": "pie" + "color": "#6092C0", + "layerId": "50e6b196-4d90-4265-a488-e9618c28eba2", + "layerType": "data", + "metricAccessor": "a81d352c-2fec-4987-8941-1ec756642f74" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" + "visualizationType": "lnsMetric" }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { - "h": 15, - "i": "7e93794c-5b33-4f11-a62c-20f9e97b95c6", - "w": 18, - "x": 11, - "y": 16 + "h": 6, + "i": "da472eef-ab66-454b-b6a0-8bf66ab28de4", + "w": 7, + "x": 25, + "y": 0 }, - "panelIndex": "7e93794c-5b33-4f11-a62c-20f9e97b95c6", - "title": "Top Originators (sources) by number of connections [Logs Corelight]", + "panelIndex": "da472eef-ab66-454b-b6a0-8bf66ab28de4", + "title": "Traffic Connections", "type": "lens" }, { @@ -917,7 +506,7 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-56d0664e-d583-42c3-a59a-dd3cdb4bd754", + "name": "indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" } ], @@ -927,45 +516,17 @@ "formBased": { "currentIndexPatternId": "logs-*", "layers": { - "56d0664e-d583-42c3-a59a-dd3cdb4bd754": { + "50e6b196-4d90-4265-a488-e9618c28eba2": { "columnOrder": [ - "ac825eca-e572-42b4-97ac-4764c170cd80", - "bc67890c-766a-4c85-96ed-6566fe9d9a81" + "a81d352c-2fec-4987-8941-1ec756642f74" ], "columns": { - "ac825eca-e572-42b4-97ac-4764c170cd80": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Destination IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "bc67890c-766a-4c85-96ed-6566fe9d9a81", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 15 - }, - "scale": "ordinal", - "sourceField": "destination.ip" - }, - "bc67890c-766a-4c85-96ed-6566fe9d9a81": { + "a81d352c-2fec-4987-8941-1ec756642f74": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", - "operationType": "count", + "label": "Traffic Destinations", + "operationType": "unique_count", "params": { "emptyAsNull": false, "format": { @@ -976,7 +537,7 @@ } }, "scale": "ratio", - "sourceField": "___records___" + "sourceField": "destination.ip" } }, "ignoreGlobalFilters": false, @@ -1000,37 +561,571 @@ "query": "" }, "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { + "color": "#6092C0", + "layerId": "50e6b196-4d90-4265-a488-e9618c28eba2", + "layerType": "data", + "metricAccessor": "a81d352c-2fec-4987-8941-1ec756642f74" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "b927d5c2-d3c1-4f15-a234-206aecfd123c", + "w": 7, + "x": 32, + "y": 0 + }, + "panelIndex": "b927d5c2-d3c1-4f15-a234-206aecfd123c", + "title": "Traffic Destinations", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "timeField": "@timestamp", + "title": "logs-corelight.conn*" + } + ], + "layers": { + "bb849131-adf7-4991-a1bd-bf0a890e8893": { + "columns": [ + { + "columnId": "b426cb82-8ed7-423e-8d48-008586f860ee", + "fieldName": "Conn Aggregation", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE event.dataset == \"conn_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `Conn Aggregation` = CASE(count \u003e 0, \"Conn Agg Logs Available\", \"No Conn Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `Conn Aggregation`, status" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE event.dataset == \"conn_agg\"\r\n| STATS count = COUNT()\r\n| EVAL `Conn Aggregation` = CASE(count \u003e 0, \"Conn Agg Logs Available\", \"No Conn Agg Logs\"),\r\n status = CASE(count \u003e 0, 1, 0)\r\n| KEEP `Conn Aggregation`, status" + }, + "visualization": { + "columns": [ + { + "columnId": "b426cb82-8ed7-423e-8d48-008586f860ee" + } + ], + "layerId": "bb849131-adf7-4991-a1bd-bf0a890e8893", + "layerType": "data" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "ed92036c-285b-4e49-90fa-0c7674d1d148", + "w": 9, + "x": 39, + "y": 0 + }, + "panelIndex": "ed92036c-285b-4e49-90fa-0c7674d1d148", + "title": "Conn Aggregation", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "timeField": "@timestamp", + "title": "logs-corelight.conn*" + } + ], + "layers": { + "e076bd8c-412a-4d42-bae6-7c9a08b2516e": { + "columns": [ + { + "columnId": "Total", + "fieldName": "Total", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "app", + "fieldName": "app", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL app =\r\n CASE(\r\n network.protocol IS NULL OR network.protocol == \"\",\r\n \"unknown\",\r\n network.protocol\r\n )\r\n\r\n| STATS Total = COUNT(*) BY app\r\n| SORT Total DESC\r\n| LIMIT 15" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL app =\r\n CASE(\r\n network.protocol IS NULL OR network.protocol == \"\",\r\n \"unknown\",\r\n network.protocol\r\n )\r\n\r\n| STATS Total = COUNT(*) BY app\r\n| SORT Total DESC\r\n| LIMIT 15" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "e076bd8c-412a-4d42-bae6-7c9a08b2516e", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "Total" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "app" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "7b027c87-710a-4c2c-a8bf-17f4ff83b97e", + "w": 18, + "x": 11, + "y": 6 + }, + "panelIndex": "7b027c87-710a-4c2c-a8bf-17f4ff83b97e", + "title": "Top Services", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "timeField": "@timestamp", + "title": "logs-corelight.conn*" + } + ], + "layers": { + "3c0f6334-cfe8-474c-ba0b-94807ac5d4b7": { + "columns": [ + { + "columnId": "Total", + "fieldName": "Total", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "dest_port", + "fieldName": "dest_port", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL dest_port =\r\n CASE(\r\n destination.port IS NULL,\r\n \"unknown\",\r\n TO_STRING(destination.port)\r\n )\r\n\r\n| STATS Total = COUNT(*) BY dest_port\r\n| SORT Total DESC\r\n| LIMIT 15\r\n" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL dest_port =\r\n CASE(\r\n destination.port IS NULL,\r\n \"unknown\",\r\n TO_STRING(destination.port)\r\n )\r\n\r\n| STATS Total = COUNT(*) BY dest_port\r\n| SORT Total DESC\r\n| LIMIT 15\r\n" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "3c0f6334-cfe8-474c-ba0b-94807ac5d4b7", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "Total" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "dest_port" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "b23bca1c-5f36-4726-ba18-f787d2336d0c", + "w": 19, + "x": 29, + "y": 6 + }, + "panelIndex": "b23bca1c-5f36-4726-ba18-f787d2336d0c", + "title": "Top Responder Ports", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "timeField": "@timestamp", + "title": "logs-corelight.conn*" + } + ], + "layers": { + "2879b087-ac45-4a39-9070-71d78348fb32": { + "columns": [ + { + "columnId": "Total", + "fieldName": "Total", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "dest_ip", + "fieldName": "dest_ip", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL dest_ip =\r\n CASE(\r\n destination.ip IS NULL,\r\n \"unknown\",\r\n TO_STRING(destination.ip)\r\n )\r\n\r\n| STATS Total = COUNT(*) BY dest_ip\r\n| SORT Total DESC\r\n| LIMIT 15" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL dest_ip =\r\n CASE(\r\n destination.ip IS NULL,\r\n \"unknown\",\r\n TO_STRING(destination.ip)\r\n )\r\n\r\n| STATS Total = COUNT(*) BY dest_ip\r\n| SORT Total DESC\r\n| LIMIT 15" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "2879b087-ac45-4a39-9070-71d78348fb32", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "Total" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "dest_ip" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsPie" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "579918e2-1b97-4aa1-bc18-64db9eda0e7d", + "w": 19, + "x": 29, + "y": 22 + }, + "panelIndex": "579918e2-1b97-4aa1-bc18-64db9eda0e7d", + "title": "Top Responders (destinations) by number of connections", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "timeField": "@timestamp", + "title": "logs-corelight.conn*" + } + ], + "layers": { + "adee1c58-010f-4ae1-9848-56703fb97398": { + "columns": [ + { + "columnId": "Total", + "fieldName": "Total", + "inMetricDimension": true, + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "src_ip", + "fieldName": "src_ip", + "meta": { + "esType": "keyword", + "type": "string" + } + } + ], + "index": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL src_ip =\r\n CASE(\r\n source.ip IS NULL,\r\n \"unknown\",\r\n TO_STRING(source.ip)\r\n )\r\n\r\n| STATS Total = COUNT(*) BY src_ip\r\n| SORT Total DESC\r\n| LIMIT 15" + }, + "timeField": "@timestamp" + } + } + } + }, + "filters": [], + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n\r\n| EVAL src_ip =\r\n CASE(\r\n source.ip IS NULL,\r\n \"unknown\",\r\n TO_STRING(source.ip)\r\n )\r\n\r\n| STATS Total = COUNT(*) BY src_ip\r\n| SORT Total DESC\r\n| LIMIT 15" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { "type": "other" }, "touched": false } ] }, - "layerId": "56d0664e-d583-42c3-a59a-dd3cdb4bd754", + "layerId": "adee1c58-010f-4ae1-9848-56703fb97398", "layerType": "data", "legendDisplay": "show", "metrics": [ - "bc67890c-766a-4c85-96ed-6566fe9d9a81" + "Total" ], "nestedLegend": false, "numberDisplay": "percent", "primaryGroups": [ - "ac825eca-e572-42b4-97ac-4764c170cd80" + "src_ip" ], "truncateLegend": false } @@ -1038,380 +1133,264 @@ "shape": "pie" } }, - "title": "", + "title": "Bar vertical stacked", "type": "lens", "visualizationType": "lnsPie" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} }, "gridData": { - "h": 15, - "i": "1a4ebe9a-d0ba-43f2-98af-58ccb8ef4ffd", - "w": 19, - "x": 29, - "y": 16 + "h": 16, + "i": "67f58941-ffd6-4ae6-9f9d-93d3c3e372ec", + "w": 18, + "x": 11, + "y": 22 }, - "panelIndex": "1a4ebe9a-d0ba-43f2-98af-58ccb8ef4ffd", - "title": "Top Responders (destinations) by number of connections [Logs Corelight]", + "panelIndex": "67f58941-ffd6-4ae6-9f9d-93d3c3e372ec", + "title": "Top Originators (sources) by number of connections", "type": "lens" }, { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-62eda5e0-300b-4569-9741-71dbddb82455", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", + "type": "esql" + } + }, "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", + "textBased": { + "indexPatternRefs": [ + { + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "timeField": "@timestamp", + "title": "logs-corelight.conn*" + } + ], "layers": { - "62eda5e0-300b-4569-9741-71dbddb82455": { - "columnOrder": [ - "2d9d5b10-8a78-4274-9195-2f89d165b3b1", - "e0de1794-e0f8-4bca-b19c-71651745f5c3", - "3daa85c3-162f-4c3f-a371-ae56110a4ab5", - "11aa8bb4-1738-4e1f-aa66-bf04a853c483", - "f61f408d-4fbc-4c20-af45-74d0b9f80f69" - ], - "columns": { - "11aa8bb4-1738-4e1f-aa66-bf04a853c483": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Proto", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "network.transport" - }, - "2d9d5b10-8a78-4274-9195-2f89d165b3b1": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Source IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "source.ip" + "46b75775-fbe7-4405-989a-0f3a42e3c7b4": { + "columns": [ + { + "columnId": "source.ip", + "fieldName": "source.ip", + "meta": { + "esType": "ip", + "type": "ip" + } }, - "3daa85c3-162f-4c3f-a371-ae56110a4ab5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Destination Country", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "destination.geo.country_iso_code" + { + "columnId": "destination.ip", + "fieldName": "destination.ip", + "meta": { + "esType": "ip", + "type": "ip" + } }, - "e0de1794-e0f8-4bca-b19c-71651745f5c3": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Destination IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "destination.ip" + { + "columnId": "ce24c1c1-26e0-4952-bd03-75d228f44ffa", + "fieldName": "service", + "meta": { + "esType": "keyword", + "type": "string" + } }, - "f61f408d-4fbc-4c20-af45-74d0b9f80f69": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Bytes", - "operationType": "sum", - "params": { - "emptyAsNull": false, - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } - } - }, - "scale": "ratio", - "sourceField": "source.bytes" + { + "columnId": "f486cfd7-a6ae-4f02-b5ca-6a7de21f9573", + "fieldName": "bytes", + "meta": { + "esType": "long", + "type": "number" + } } + ], + "index": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (source.ip IN (\"0.0.0.0\", \"255.255.255.255\") OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\") AND conn.local_resp == \"true\")\r\n| STATS\r\n service = VALUES(network.protocol),\r\n bytes = SUM(source.ip_bytes)\r\n BY\r\n source.ip,\r\n destination.ip,\r\n network.direction\r\n| WHERE network.direction == \"outbound\"\r\n| KEEP source.ip, destination.ip, bytes, service\r\n| SORT bytes DESC\r\n| LIMIT 10\r\n" }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 + "timeField": "@timestamp" } } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} } }, - "filters": [ - { - "$state": { - "store": "appState" + "filters": [], + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (source.ip IN (\"0.0.0.0\", \"255.255.255.255\") OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\") AND conn.local_resp == \"true\")\r\n| STATS\r\n service = VALUES(network.protocol),\r\n bytes = SUM(source.ip_bytes)\r\n BY\r\n source.ip,\r\n destination.ip,\r\n network.direction\r\n| WHERE network.direction == \"outbound\"\r\n| KEEP source.ip, destination.ip, bytes, service\r\n| SORT bytes DESC\r\n| LIMIT 10\r\n" + }, + "visualization": { + "columns": [ + { + "columnId": "source.ip" }, - "meta": { - "alias": null, - "disabled": false, - "index": "86b01239-d28a-407e-915f-49e8099cb0ca", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_orig", - "index": "logs-*", - "key": "conn.local_orig", - "negate": false, - "params": { - "query": true - }, - "type": "phrase" + { + "columnId": "destination.ip" + }, + { + "columnId": "ce24c1c1-26e0-4952-bd03-75d228f44ffa", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "f486cfd7-a6ae-4f02-b5ca-6a7de21f9573", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "46b75775-fbe7-4405-989a-0f3a42e3c7b4", + "layerType": "data" + } + }, + "title": "Bar vertical stacked", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], + "enhancements": {} + }, + "gridData": { + "h": 18, + "i": "ecc4c0d4-93d5-413e-b9d0-c234718b6012", + "w": 24, + "x": 0, + "y": 38 + }, + "panelIndex": "ecc4c0d4-93d5-413e-b9d0-c234718b6012", + "title": "Top Outbound Data Flows by Originator (src_ip) Bytes", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { + "allowHidden": false, + "allowNoIndex": false, + "fieldFormats": {}, + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", + "type": "esql" + } + }, + "datasourceStates": { + "textBased": { + "indexPatternRefs": [ + { + "id": "30745a83f179da5f11b16656250be0a248d7293f796a233331383a8b71ff135a", + "timeField": "@timestamp", + "title": "logs-corelight.conn-*" + } + ], + "layers": { + "ec1f6d7a-e410-417e-9a39-318c07942503": { + "columns": [ + { + "columnId": "source.ip", + "fieldName": "source.ip", + "meta": { + "esType": "ip", + "type": "ip" + } + }, + { + "columnId": "destination.ip", + "fieldName": "destination.ip", + "meta": { + "esType": "ip", + "type": "ip" + } }, - "query": { - "match_phrase": { - "conn.local_orig": true + { + "columnId": "cfc35fc1-b164-4c46-aac2-dd1807da2fa3", + "fieldName": "service", + "meta": { + "esType": "keyword", + "type": "string" } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_resp", - "index": "logs-*", - "key": "conn.local_resp", - "negate": false, - "params": { - "query": false - }, - "type": "phrase" }, - "query": { - "match_phrase": { - "conn.local_resp": false + { + "columnId": "8578ca9b-3d01-4b47-8252-a73f793d4750", + "fieldName": "bytes", + "meta": { + "esType": "long", + "type": "number" } } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} + ], + "index": "30745a83f179da5f11b16656250be0a248d7293f796a233331383a8b71ff135a", + "query": { + "esql": "FROM logs-corelight.conn-*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\",\"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\",\"255.255.255.255\")) AND conn.local_resp == \"true\")\r\n| STATS\r\n service = VALUES(network.protocol),\r\n bytes = SUM(source.ip_bytes)\r\n BY\r\n source.ip,\r\n destination.ip,\r\n network.direction\r\n| WHERE network.direction == \"inbound\"\r\n| KEEP source.ip, destination.ip, bytes, service\r\n| SORT bytes DESC\r\n| LIMIT 10\r\n" + }, + "timeField": "@timestamp" + } + } } - ], - "internalReferences": [], + }, + "filters": [], "query": { - "language": "kuery", - "query": "" + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\",\"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\",\"255.255.255.255\")) AND conn.local_resp == \"true\")\r\n| STATS\r\n service = VALUES(network.protocol),\r\n bytes = SUM(source.ip_bytes)\r\n BY\r\n source.ip,\r\n destination.ip,\r\n network.direction\r\n| WHERE network.direction == \"inbound\"\r\n| KEEP source.ip, destination.ip, bytes, service\r\n| SORT bytes DESC\r\n| LIMIT 10\r\n" }, "visualization": { "columns": [ { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "isMetric": true, - "isTransposed": false - }, - { - "columnId": "2d9d5b10-8a78-4274-9195-2f89d165b3b1", - "isMetric": false, - "isTransposed": false + "columnId": "source.ip" }, { - "columnId": "e0de1794-e0f8-4bca-b19c-71651745f5c3", - "isMetric": false, - "isTransposed": false + "columnId": "destination.ip" }, { - "columnId": "3daa85c3-162f-4c3f-a371-ae56110a4ab5", + "columnId": "cfc35fc1-b164-4c46-aac2-dd1807da2fa3", "isMetric": false, "isTransposed": false }, { - "columnId": "11aa8bb4-1738-4e1f-aa66-bf04a853c483", - "isMetric": false, + "columnId": "8578ca9b-3d01-4b47-8252-a73f793d4750", + "isMetric": true, "isTransposed": false } ], - "layerId": "62eda5e0-300b-4569-9741-71dbddb82455", - "layerType": "data", - "paging": { - "enabled": true, - "size": 10 - }, - "sorting": { - "direction": "none" - } + "layerId": "ec1f6d7a-e410-417e-9a39-318c07942503", + "layerType": "data" } }, - "title": "", + "title": "Bar vertical stacked", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "86b01239-d28a-407e-915f-49e8099cb0ca", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_orig", - "index": "logs-*", - "key": "conn.local_orig", - "negate": false, - "params": { - "query": true - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "conn.local_orig": true - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_resp", - "index": "logs-*", - "key": "conn.local_resp", - "negate": false, - "params": { - "query": false - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "conn.local_resp": false - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 18, - "i": "8a101011-405f-426e-9c97-1a2aab57de78", + "i": "7058f1de-886e-436a-b0d4-556100808f5e", "w": 24, - "x": 0, - "y": 31 + "x": 24, + "y": 38 }, - "panelIndex": "8a101011-405f-426e-9c97-1a2aab57de78", - "title": "Top Outbound Data Flows by Originator (id_orig_h) Bytes [Logs Corelight]", + "panelIndex": "7058f1de-886e-436a-b0d4-556100808f5e", + "title": "Top Inbound Data Flows by Originator (src_ip) Bytes", "type": "lens" }, { @@ -1420,15 +1399,16 @@ "references": [], "state": { "adHocDataViews": { - "047b9ce1c481e9105458e4238be7cbb304abc176b09c3b4d196d84686c42b5d0": { + "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333": { "allowHidden": false, "allowNoIndex": false, "fieldFormats": {}, - "id": "047b9ce1c481e9105458e4238be7cbb304abc176b09c3b4d196d84686c42b5d0", - "name": "logs*", + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "name": "logs-corelight.conn*", "runtimeFieldMap": {}, "sourceFilters": [], - "title": "logs*", + "timeFieldName": "@timestamp", + "title": "logs-corelight.conn*", "type": "esql" } }, @@ -1436,13 +1416,14 @@ "textBased": { "indexPatternRefs": [ { - "id": "047b9ce1c481e9105458e4238be7cbb304abc176b09c3b4d196d84686c42b5d0", - "title": "logs*" + "id": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "timeField": "@timestamp", + "title": "logs-corelight.conn*" } ], "layers": { - "f0c07097-c5fe-4a1d-a40c-f3de9ecc1611": { - "columns": [ + "e1e4e5a9-4c38-4c41-a48c-275d06caf22d": { + "allColumns": [ { "columnId": "UID", "fieldName": "UID", @@ -1480,431 +1461,146 @@ } }, { - "columnId": "Proto", - "fieldName": "Proto", + "columnId": "Destination Port", + "fieldName": "Destination Port", "inMetricDimension": true, "meta": { - "esType": "keyword", - "type": "string" + "esType": "long", + "type": "number" } } ], - "index": "047b9ce1c481e9105458e4238be7cbb304abc176b09c3b4d196d84686c42b5d0", - "query": { - "esql": "from logs*\r\n| where event.dataset == \"conn\" and (source.ip is not null or destination.ip is not null) and source.ip not in (\"0.0.0.0\", \"255.255.255.255\") and destination.ip not in (\"0.0.0.0\", \"255.255.255.255\") and observer.hostname is not null and network.protocol is not null and source.port is not null and destination.port is not null and event.duration is not null\r\n| limit 10000\r\n| stats values(event.id), avg(event.duration), values(source.ip), values(destination.ip), values(network.transport) by event.id\r\n| eval Duration = `avg(event.duration)`/1000000000\r\n| rename `values(event.id)` as UID, `values(source.ip)` as `Source IP`, `values(destination.ip)` as `Destination IP`, `values(network.transport)` as Proto \r\n| sort Duration desc\r\n| limit 10\r\n| keep UID, Duration, `Source IP`, `Destination IP`, Proto" - } - } - } - } - }, - "filters": [], - "query": { - "esql": "from logs*\r\n| where event.dataset == \"conn\" and (source.ip is not null or destination.ip is not null) and source.ip not in (\"0.0.0.0\", \"255.255.255.255\") and destination.ip not in (\"0.0.0.0\", \"255.255.255.255\") and observer.hostname is not null and network.protocol is not null and source.port is not null and destination.port is not null and event.duration is not null\r\n| limit 10000\r\n| stats values(event.id), avg(event.duration), values(source.ip), values(destination.ip), values(network.transport) by event.id\r\n| eval Duration = `avg(event.duration)`/1000000000\r\n| rename `values(event.id)` as UID, `values(source.ip)` as `Source IP`, `values(destination.ip)` as `Destination IP`, `values(network.transport)` as Proto \r\n| sort Duration desc\r\n| limit 10\r\n| keep UID, Duration, `Source IP`, `Destination IP`, Proto" - }, - "visualization": { - "columns": [ - { - "columnId": "UID" - }, - { - "columnId": "Duration" - }, - { - "columnId": "Source IP" - }, - { - "columnId": "Destination IP" - }, - { - "columnId": "Proto" - } - ], - "layerId": "f0c07097-c5fe-4a1d-a40c-f3de9ecc1611", - "layerType": "data" - } - }, - "title": "Table UID \u0026 Duration \u0026 Source IP \u0026 Destination IP \u0026 Proto", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "esql": "from logs*\r\n| where event.dataset == \"conn\" and (source.ip is not null or destination.ip is not null) and source.ip not in (\"0.0.0.0\", \"255.255.255.255\") and destination.ip not in (\"0.0.0.0\", \"255.255.255.255\") and observer.hostname is not null and network.protocol is not null and source.port is not null and destination.port is not null and event.duration is not null\r\n| limit 10000\r\n| stats values(event.id), avg(event.duration), values(source.ip), values(destination.ip), values(network.transport) by event.id\r\n| eval Duration = `avg(event.duration)`/1000000000\r\n| rename `values(event.id)` as UID, `values(source.ip)` as `Source IP`, `values(destination.ip)` as `Destination IP`, `values(network.transport)` as Proto \r\n| sort Duration desc\r\n| limit 10\r\n| keep UID, Duration, `Source IP`, `Destination IP`, Proto" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false - }, - "gridData": { - "h": 16, - "i": "8f900773-1a72-4f0b-8706-736019167702", - "w": 48, - "x": 0, - "y": 49 - }, - "panelIndex": "8f900773-1a72-4f0b-8706-736019167702", - "title": "Open/Active Long Lived Connections (requires Long Connections Pkg) [Logs Corelight]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-62eda5e0-300b-4569-9741-71dbddb82455", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "62eda5e0-300b-4569-9741-71dbddb82455": { - "columnOrder": [ - "2d9d5b10-8a78-4274-9195-2f89d165b3b1", - "e0de1794-e0f8-4bca-b19c-71651745f5c3", - "3daa85c3-162f-4c3f-a371-ae56110a4ab5", - "11aa8bb4-1738-4e1f-aa66-bf04a853c483", - "f61f408d-4fbc-4c20-af45-74d0b9f80f69" - ], - "columns": { - "11aa8bb4-1738-4e1f-aa66-bf04a853c483": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Proto", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "network.transport" + "columns": [ + { + "columnId": "e1a9b6d0-5911-4bd0-af2b-47d97fcf42de", + "fieldName": "UID", + "meta": { + "esType": "keyword", + "type": "string" + } }, - "2d9d5b10-8a78-4274-9195-2f89d165b3b1": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Source IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "source.ip" + { + "columnId": "5d7a447d-a168-4c48-9c0a-f5d1660a9394", + "fieldName": "Duration", + "meta": { + "esType": "double", + "type": "number" + } }, - "3daa85c3-162f-4c3f-a371-ae56110a4ab5": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Source Country", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "source.geo.country_iso_code" + { + "columnId": "cdb67eef-598f-426b-b929-eb25c011dc17", + "fieldName": "Source IP", + "meta": { + "esType": "ip", + "type": "ip" + } }, - "e0de1794-e0f8-4bca-b19c-71651745f5c3": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Destination IP", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "destination.ip" + { + "columnId": "1b928f11-701f-488a-9a57-95df986a54b8", + "fieldName": "Destination IP", + "meta": { + "esType": "ip", + "type": "ip" + } }, - "f61f408d-4fbc-4c20-af45-74d0b9f80f69": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Bytes", - "operationType": "sum", - "params": { - "emptyAsNull": false, - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } - } - }, - "scale": "ratio", - "sourceField": "source.bytes" + { + "columnId": "70680da7-9ed5-4abd-b44a-75526dbca90e", + "fieldName": "Destination Port", + "meta": { + "esType": "long", + "type": "number" + } + }, + { + "columnId": "4098087b-80ca-4cb1-bdac-4f3bae976af1", + "fieldName": "Service", + "meta": { + "esType": "keyword", + "type": "string" + } } + ], + "index": "9ac500899338b2fcf45fd20d129c34e52b042f3ade63945dd675f42672450333", + "query": { + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND event.duration IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n| STATS\r\n duration = AVG(event.duration),\r\n src_ip = VALUES(source.ip),\r\n dest_ip = VALUES(destination.ip),\r\n dest_port = VALUES(destination.port),\r\n service = VALUES(network.protocol)\r\n BY event.id\r\n| EVAL Duration = ROUND(duration / 1000000000.0, 2)| SORT Duration DESC\r\n| LIMIT 100\r\n| RENAME\r\n event.id AS UID,\r\n src_ip AS `Source IP`,\r\n dest_ip AS `Destination IP`,\r\n dest_port AS `Destination Port`,\r\n service AS Service\r\n| KEEP\r\n UID,\r\n Duration,\r\n `Source IP`,\r\n `Destination IP`,\r\n `Destination Port`,\r\n Service" }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 + "timeField": "@timestamp" } } - }, - "indexpattern": { - "layers": {} - }, - "textBased": { - "layers": {} } }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "06c8fb30-b5e1-42d7-ad6f-e4e9c008a38f", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_orig", - "index": "logs-*", - "key": "conn.local_orig", - "negate": false, - "params": { - "query": false - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "conn.local_orig": false - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_resp", - "index": "logs-*", - "key": "conn.local_resp", - "negate": false, - "params": { - "query": true - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "conn.local_resp": true - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } - ], - "internalReferences": [], + "filters": [], "query": { - "language": "kuery", - "query": "" + "esql": "FROM logs-corelight.conn*\r\n| WHERE observer.hostname IS NOT NULL\r\n AND event.id IS NOT NULL\r\n AND event.duration IS NOT NULL\r\n AND NOT (\r\n (source.ip IN (\"0.0.0.0\", \"255.255.255.255\")\r\n OR destination.ip IN (\"0.0.0.0\", \"255.255.255.255\"))\r\n AND conn.local_resp == \"true\"\r\n )\r\n| STATS\r\n duration = AVG(event.duration),\r\n src_ip = VALUES(source.ip),\r\n dest_ip = VALUES(destination.ip),\r\n dest_port = VALUES(destination.port),\r\n service = VALUES(network.protocol)\r\n BY event.id\r\n| EVAL Duration = ROUND(duration / 1000000000.0, 2)\r\n| SORT Duration DESC\r\n| LIMIT 100\r\n| RENAME\r\n event.id AS UID,\r\n src_ip AS `Source IP`,\r\n dest_ip AS `Destination IP`,\r\n dest_port AS `Destination Port`,\r\n service AS Service\r\n| KEEP\r\n UID,\r\n Duration,\r\n `Source IP`,\r\n `Destination IP`,\r\n `Destination Port`,\r\n Service" }, "visualization": { "columns": [ { - "columnId": "f61f408d-4fbc-4c20-af45-74d0b9f80f69", + "columnId": "e1a9b6d0-5911-4bd0-af2b-47d97fcf42de", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "5d7a447d-a168-4c48-9c0a-f5d1660a9394", "isMetric": true, "isTransposed": false }, { - "columnId": "2d9d5b10-8a78-4274-9195-2f89d165b3b1", + "columnId": "cdb67eef-598f-426b-b929-eb25c011dc17", "isMetric": false, "isTransposed": false }, { - "columnId": "e0de1794-e0f8-4bca-b19c-71651745f5c3", + "columnId": "1b928f11-701f-488a-9a57-95df986a54b8", "isMetric": false, "isTransposed": false }, { - "columnId": "3daa85c3-162f-4c3f-a371-ae56110a4ab5", - "isMetric": false, + "columnId": "70680da7-9ed5-4abd-b44a-75526dbca90e", + "isMetric": true, "isTransposed": false }, { - "columnId": "11aa8bb4-1738-4e1f-aa66-bf04a853c483", + "columnId": "4098087b-80ca-4cb1-bdac-4f3bae976af1", "isMetric": false, "isTransposed": false } ], - "layerId": "62eda5e0-300b-4569-9741-71dbddb82455", + "layerId": "e1e4e5a9-4c38-4c41-a48c-275d06caf22d", "layerType": "data", "paging": { "enabled": true, "size": 10 - }, - "sorting": { - "direction": "none" } } }, - "title": "", + "title": "Table UID \u0026 Duration \u0026 Source IP \u0026 Destination IP \u0026 Destination Port", "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "06c8fb30-b5e1-42d7-ad6f-e4e9c008a38f", - "negate": false, - "params": [ - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_orig", - "index": "logs-*", - "key": "conn.local_orig", - "negate": false, - "params": { - "query": false - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "conn.local_orig": false - } - } - }, - { - "meta": { - "alias": null, - "disabled": false, - "field": "conn.local_resp", - "index": "logs-*", - "key": "conn.local_resp", - "negate": false, - "params": { - "query": true - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "conn.local_resp": true - } - } - } - ], - "relation": "AND", - "type": "combined" - }, - "query": {} - } + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" ], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false + "enhancements": {} }, "gridData": { "h": 18, - "i": "c876410e-facb-444e-868f-b873445e0f27", - "w": 24, - "x": 24, - "y": 31 + "i": "3b82d614-a3f1-4059-afdc-9cc5faad1a57", + "w": 48, + "x": 0, + "y": 56 }, - "panelIndex": "c876410e-facb-444e-868f-b873445e0f27", - "title": "Top Inbound Data Flows by Originator (id_orig_h) Bytes [Logs Corelight]", + "panelIndex": "3b82d614-a3f1-4059-afdc-9cc5faad1a57", + "title": "Top 100 Open/Active Long Lived Connections", "type": "lens" } ], "timeRestore": false, "title": "[Logs Corelight] Connections", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T11:22:11.684Z", + "created_at": "2026-07-14T05:56:46.193Z", "id": "corelight-eff0434c-1e27-4c02-959e-9f5d95488efb", "references": [ { @@ -1924,37 +1620,22 @@ }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "60704ce1-f587-47f6-ab7a-5b72e3824502:indexpattern-datasource-layer-e6088802-b9ee-41a9-b31b-f58feaee3dc6", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "06a54807-76db-4929-a18c-ca1f2ded93b8:indexpattern-datasource-layer-56d0664e-d583-42c3-a59a-dd3cdb4bd754", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7e93794c-5b33-4f11-a62c-20f9e97b95c6:indexpattern-datasource-layer-56d0664e-d583-42c3-a59a-dd3cdb4bd754", + "name": "1ff2ae04-48f2-433a-bea8-617b8193359f:indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" }, { "id": "logs-*", - "name": "1a4ebe9a-d0ba-43f2-98af-58ccb8ef4ffd:indexpattern-datasource-layer-56d0664e-d583-42c3-a59a-dd3cdb4bd754", + "name": "8978ab47-f109-4af9-a8d0-802b62697f23:indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" }, { "id": "logs-*", - "name": "8a101011-405f-426e-9c97-1a2aab57de78:indexpattern-datasource-layer-62eda5e0-300b-4569-9741-71dbddb82455", + "name": "da472eef-ab66-454b-b6a0-8bf66ab28de4:indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" }, { "id": "logs-*", - "name": "c876410e-facb-444e-868f-b873445e0f27:indexpattern-datasource-layer-62eda5e0-300b-4569-9741-71dbddb82455", + "name": "b927d5c2-d3c1-4f15-a234-206aecfd123c:indexpattern-datasource-layer-50e6b196-4d90-4265-a488-e9618c28eba2", "type": "index-pattern" }, { @@ -1967,11 +1648,6 @@ "name": "controlGroup_1d3b9da1-34a5-4de7-9da7-0c21106b5dc8:optionsListDataView", "type": "index-pattern" }, - { - "id": "logs-*", - "name": "controlGroup_2c37ab99-5bda-4366-8bb3-235facbbff93:optionsListDataView", - "type": "index-pattern" - }, { "id": "logs-*", "name": "controlGroup_8b2ad078-061b-4a83-ba8d-55aa43f40bdf:optionsListDataView", @@ -1989,25 +1665,11 @@ }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", + "name": "controlGroup_9817e2bc-c2d0-4bd1-81d2-97746b1d84ff:optionsListDataView", "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb.json b/packages/corelight/kibana/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb.json index 8f5e7b952f1..79352a00105 100644 --- a/packages/corelight/kibana/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb.json +++ b/packages/corelight/kibana/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb.json @@ -20,6 +20,7 @@ "hideExclude": null, "hideExists": null, "hideSort": null, + "id": "53fb0468-7828-495e-9acf-0dcde0d4ee11", "placeholder": null, "runPastTimeout": null, "searchTechnique": "prefix", @@ -46,6 +47,7 @@ "hideExclude": null, "hideExists": null, "hideSort": null, + "id": "9f440d0a-0642-494a-b8dd-003dc9f07ccd", "placeholder": null, "runPastTimeout": null, "searchTechnique": "prefix", @@ -72,6 +74,7 @@ "hideExclude": null, "hideExists": null, "hideSort": null, + "id": "a7496e44-f00e-4f13-873b-8ba4fd31772f", "placeholder": null, "runPastTimeout": null, "searchTechnique": "exact", @@ -98,6 +101,7 @@ "hideExclude": null, "hideExists": null, "hideSort": null, + "id": "c535a1bc-d749-482a-8169-f700f5430ad4", "placeholder": null, "runPastTimeout": null, "searchTechnique": "prefix", @@ -260,7 +264,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - **Corelight Suricata IDS Alert Overview**\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - **Corelight Suricata IDS Alert Overview**\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -1018,6 +1022,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1237,6 +1244,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1264,11 +1274,7 @@ { "embeddableConfig": { "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 10 }, "gridData": { @@ -1286,10 +1292,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] Corelight Suricata IDS Alert Overview", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:23:58.120Z", "id": "corelight-f1208ffe-d168-46d1-9531-24de523d1bfb", "references": [ { @@ -1317,11 +1323,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[4].meta.index", "type": "index-pattern" }, - { - "id": "corelight-25c4969f-1368-433e-905d-fda0ae7e4923", - "name": "d6b0d9e6-0afa-481d-a617-1618154d0f0b:panel_d6b0d9e6-0afa-481d-a617-1618154d0f0b", - "type": "search" - }, { "id": "logs-*", "name": "15375c4f-775f-447b-a75d-4fdc6377b076:indexpattern-datasource-layer-70d67ee8-99ab-4577-bf0c-06f15b38818f", @@ -1347,6 +1348,11 @@ "name": "1d400e9f-5ccd-4afc-b22e-330166d5a8dd:indexpattern-datasource-layer-a9912cf0-82d6-4ee2-afba-dc23035bfa5d", "type": "index-pattern" }, + { + "id": "corelight-25c4969f-1368-433e-905d-fda0ae7e4923", + "name": "d6b0d9e6-0afa-481d-a617-1618154d0f0b:panel_d6b0d9e6-0afa-481d-a617-1618154d0f0b", + "type": "search" + }, { "id": "logs-*", "name": "controlGroup_53fb0468-7828-495e-9acf-0dcde0d4ee11:optionsListDataView", @@ -1366,33 +1372,9 @@ "id": "logs-*", "name": "controlGroup_c535a1bc-d749-482a-8169-f700f5430ad4:optionsListDataView", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[4].meta.index", - "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf.json b/packages/corelight/kibana/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf.json index 74b45d4ca75..2780397011c 100644 --- a/packages/corelight/kibana/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf.json +++ b/packages/corelight/kibana/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "observer.hostname", + "id": "31c87e45-d99f-4836-b47c-d7bf6892d9f6", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -70,7 +71,7 @@ "description": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- **Data Insights**\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - **Remote Activity Insights**\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- **Data Insights**\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - **Remote Activity Insights**\n- Security Workflows\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -2473,6 +2474,9 @@ "visualizationType": "lnsMetric" }, "description": "Total count of VPN connections using potentially unusual connection configurations such as static TLS key auth", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -3195,6 +3199,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -3285,6 +3292,9 @@ "visualizationType": "lnsMetric" }, "description": "Total count of VPN connections that are using the RW- Road warrior configuration detected (i.e. Cisco Anyconnect) and FW - Firewall subversion inferences", + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -3501,6 +3511,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -3535,10 +3548,10 @@ "timeRestore": true, "timeTo": "now", "title": "[Logs Corelight] Remote Activity Insights", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:12.251Z", "id": "corelight-f4864774-ed73-4b78-b861-5b8235ec12cf", "references": [ { @@ -3583,5 +3596,6 @@ } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618.json b/packages/corelight/kibana/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618.json index 81633c7b971..9bb4797bc5d 100644 --- a/packages/corelight/kibana/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618.json +++ b/packages/corelight/kibana/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "severity.name", + "id": "224819c3-9d2a-4c3a-bb89-9817b0833a8f", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -31,6 +32,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "notice.message", + "id": "7c5460fc-7b12-474c-9293-a9953c6e2743", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -48,6 +50,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "network.transport", + "id": "9063f853-fa9a-48c7-9af7-43a722080b85", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -65,6 +68,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "destination.port", + "id": "9414aa6d-01b3-4a10-bb5d-7809afca36c5", "searchTechnique": "exact", "selectedOptions": [], "sort": { @@ -82,6 +86,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "source.ip", + "id": "ececffb2-34d8-4be8-8708-2eea73ee3223", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -99,6 +104,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "notice.note", + "id": "f828f95e-cae2-44d0-8a3c-8bbac711aa63", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -201,7 +207,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - **Notices**\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - [Log Hunting](#/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3)\n - **Notices**\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)", "openLinksInNewTab": false }, "title": "", @@ -887,6 +893,9 @@ "type": "lens", "visualizationType": "lnsPie" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1007,6 +1016,9 @@ "type": "lens", "visualizationType": "lnsDatatable" }, + "disabledActions": [ + "OPEN_FLYOUT_ADD_DRILLDOWN" + ], "enhancements": { "dynamicActions": { "events": [] @@ -1034,11 +1046,7 @@ { "embeddableConfig": { "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 10 }, "gridData": { @@ -1056,10 +1064,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] Notices", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:24:07.296Z", "id": "corelight-f7da14f0-85db-48e8-a591-1f650af0f618", "references": [ { @@ -1072,11 +1080,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" }, - { - "id": "corelight-e0f9718e-23ec-4c36-8040-d687fc177db4", - "name": "3f4fb014-0abd-4274-9650-989177839367:panel_3f4fb014-0abd-4274-9650-989177839367", - "type": "search" - }, { "id": "logs-*", "name": "86499a6b-7a82-4079-bf25-32deec75f97a:indexpattern-datasource-layer-d9e882dd-717b-4717-87a1-c2e08632b490", @@ -1087,6 +1090,11 @@ "name": "37bcafa0-0746-4f5f-9a2f-2e78b0bdec80:indexpattern-datasource-layer-cf0ee37a-ae63-4731-8995-9b2313ce3e22", "type": "index-pattern" }, + { + "id": "corelight-e0f9718e-23ec-4c36-8040-d687fc177db4", + "name": "3f4fb014-0abd-4274-9650-989177839367:panel_3f4fb014-0abd-4274-9650-989177839367", + "type": "search" + }, { "id": "logs-*", "name": "controlGroup_ececffb2-34d8-4be8-8708-2eea73ee3223:optionsListDataView", @@ -1116,18 +1124,9 @@ "id": "logs-*", "name": "controlGroup_7c5460fc-7b12-474c-9293-a9953c6e2743:optionsListDataView", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3.json b/packages/corelight/kibana/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3.json index 7670ced438d..44347ae6c49 100644 --- a/packages/corelight/kibana/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3.json +++ b/packages/corelight/kibana/dashboard/corelight-ff07e65c-2703-4cbe-a45f-3881025352a3.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "source.ip", + "id": "1a827133-990a-4211-beb7-24bf597620d5", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -31,6 +32,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "network.community_id", + "id": "322b1482-8b1c-4ef0-ab99-07fc602522a0", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -48,6 +50,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "log.id.fuid", + "id": "4afae7f6-00f9-45f1-89b0-1e2bdaf0dab2", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -65,6 +68,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "event.dataset", + "id": "88a5a7d1-e872-4f20-906c-dd565b44fbde", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -82,6 +86,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "destination.ip", + "id": "b688861e-b689-4ed9-88ee-228b6fd40895", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -99,6 +104,7 @@ "explicitInput": { "dataViewId": "logs-*", "fieldName": "event.id", + "id": "f3ad773e-b9af-40a2-b5f9-1f0bae0f66c7", "searchTechnique": "prefix", "selectedOptions": [], "sort": { @@ -330,7 +336,7 @@ "description": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - **Log Hunting**\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)\n", + "markdown": "**Navigation**\n\n**Corelight**\n\n- [Security Posture](#/dashboard/corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b)\n- Data Insights\n - [Name Resolution Insights](#/dashboard/corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e)\n - [Secure Channel Insights](#/dashboard/corelight-45197477-c13f-4e52-a5dd-fb4f53564963)\n - [Remote Activity Insights](#/dashboard/corelight-f4864774-ed73-4b78-b861-5b8235ec12cf)\n- **Security Workflows**\n - [Intel](#/dashboard/corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11)\n - [IP Interrogation](#/dashboard/corelight-3a4a279f-f238-47de-90ba-f643c5647fde)\n - **Log Hunting**\n - [Notices](#/dashboard/corelight-f7da14f0-85db-48e8-a591-1f650af0f618)\n - [RDP Inferences Overview](#/dashboard/corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba)\n - [SSH Inferences Overview](#/dashboard/corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08)\n - [Corelight Suricata IDS Alert Overview](#/dashboard/corelight-f1208ffe-d168-46d1-9531-24de523d1bfb)\n - [VPN Insights](#/dashboard/corelight-023162b6-94da-4d8d-b1f6-de6192356cce)\n- Data Explorer\n - [Asset Classification](#/dashboard/corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4)\n - [AWS VPC Flow](#/dashboard/corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8)\n - [Connections](#/dashboard/corelight-eff0434c-1e27-4c02-959e-9f5d95488efb)\n - [DNS](#/dashboard/corelight-58885f47-95e1-4242-a1ee-783de69ace17)\n - [Files](#/dashboard/corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9)\n - [HTTP](#/dashboard/corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa)\n - [Software](#/dashboard/corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902)\n - [SSL and x509](#/dashboard/corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203)\n\n[**Integrations Page**](/app/integrations/detail/corelight/overview)\n", "openLinksInNewTab": false }, "title": "", @@ -666,11 +672,7 @@ { "embeddableConfig": { "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - }, + "enhancements": {}, "rowsPerPage": 50 }, "gridData": { @@ -688,10 +690,10 @@ ], "timeRestore": false, "title": "[Logs Corelight] Log Hunting", - "version": 3 + "version": 2 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:23:55.104Z", "id": "corelight-ff07e65c-2703-4cbe-a45f-3881025352a3", "references": [ { @@ -704,11 +706,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" }, - { - "id": "corelight-92c0bf7d-5abe-46a1-800d-281386e4b219", - "name": "7e49020c-ad4b-4403-9e43-3da48bddfc73:panel_7e49020c-ad4b-4403-9e43-3da48bddfc73", - "type": "search" - }, { "id": "logs-*", "name": "47ad5a2f-fb57-4348-9666-4061ea2ef49b:indexpattern-datasource-layer-926c4539-754a-4608-84f1-327fd0fefd96", @@ -719,6 +716,11 @@ "name": "ba9d680d-7753-42c8-8b16-c097ecff527c:indexpattern-datasource-layer-26a83693-9fca-4ff5-bf8c-44d42d1f13b9", "type": "index-pattern" }, + { + "id": "corelight-92c0bf7d-5abe-46a1-800d-281386e4b219", + "name": "7e49020c-ad4b-4403-9e43-3da48bddfc73:panel_7e49020c-ad4b-4403-9e43-3da48bddfc73", + "type": "search" + }, { "id": "logs-*", "name": "controlGroup_88a5a7d1-e872-4f20-906c-dd565b44fbde:optionsListDataView", @@ -748,18 +750,9 @@ "id": "logs-*", "name": "controlGroup_322b1482-8b1c-4ef0-ab99-07fc602522a0:optionsListDataView", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0" + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/corelight/kibana/search/corelight-039807c4-9ec2-4778-b548-0e08877fb8d2.json b/packages/corelight/kibana/search/corelight-039807c4-9ec2-4778-b548-0e08877fb8d2.json index 655d62473dd..505110e0615 100644 --- a/packages/corelight/kibana/search/corelight-039807c4-9ec2-4778-b548-0e08877fb8d2.json +++ b/packages/corelight/kibana/search/corelight-039807c4-9ec2-4778-b548-0e08877fb8d2.json @@ -25,7 +25,7 @@ "title": "RDP Connection Detail [Logs Corelight]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:20:42.096Z", "id": "corelight-039807c4-9ec2-4778-b548-0e08877fb8d2", "references": [ { diff --git a/packages/corelight/kibana/search/corelight-25c4969f-1368-433e-905d-fda0ae7e4923.json b/packages/corelight/kibana/search/corelight-25c4969f-1368-433e-905d-fda0ae7e4923.json index 9e0887de8c7..e1c91ac52ee 100644 --- a/packages/corelight/kibana/search/corelight-25c4969f-1368-433e-905d-fda0ae7e4923.json +++ b/packages/corelight/kibana/search/corelight-25c4969f-1368-433e-905d-fda0ae7e4923.json @@ -26,7 +26,7 @@ "title": "Log Details [Logs Corelight]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:20:42.096Z", "id": "corelight-25c4969f-1368-433e-905d-fda0ae7e4923", "references": [ { diff --git a/packages/corelight/kibana/search/corelight-845d2914-3a55-4057-9dca-a3fd4e226d54.json b/packages/corelight/kibana/search/corelight-845d2914-3a55-4057-9dca-a3fd4e226d54.json index 9909ee1e4da..45f93259df1 100644 --- a/packages/corelight/kibana/search/corelight-845d2914-3a55-4057-9dca-a3fd4e226d54.json +++ b/packages/corelight/kibana/search/corelight-845d2914-3a55-4057-9dca-a3fd4e226d54.json @@ -126,7 +126,7 @@ "title": "Log Data [Logs Corelight]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:20:42.096Z", "id": "corelight-845d2914-3a55-4057-9dca-a3fd4e226d54", "references": [ { diff --git a/packages/corelight/kibana/search/corelight-92c0bf7d-5abe-46a1-800d-281386e4b219.json b/packages/corelight/kibana/search/corelight-92c0bf7d-5abe-46a1-800d-281386e4b219.json index 9e1ae5f4506..5508a393baf 100644 --- a/packages/corelight/kibana/search/corelight-92c0bf7d-5abe-46a1-800d-281386e4b219.json +++ b/packages/corelight/kibana/search/corelight-92c0bf7d-5abe-46a1-800d-281386e4b219.json @@ -25,7 +25,7 @@ "title": "Log Data [Logs Corelight]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:20:42.096Z", "id": "corelight-92c0bf7d-5abe-46a1-800d-281386e4b219", "references": [ { diff --git a/packages/corelight/kibana/search/corelight-9d31f033-1900-47c6-b7cf-f34a9c00c2d6.json b/packages/corelight/kibana/search/corelight-9d31f033-1900-47c6-b7cf-f34a9c00c2d6.json new file mode 100644 index 00000000000..9d020e3308e --- /dev/null +++ b/packages/corelight/kibana/search/corelight-9d31f033-1900-47c6-b7cf-f34a9c00c2d6.json @@ -0,0 +1,192 @@ +{ + "attributes": { + "columns": [ + "host_header", + "host.port", + "software.type", + "software.name", + "software.original", + "version.major", + "software.version.minor", + "software.version.additional_info" + ], + "description": "", + "grid": { + "columns": { + "@timestamp": { + "width": 245 + }, + "host.port": { + "width": 86 + }, + "software.original": { + "width": 181 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.vendor", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "observer.vendor", + "negate": false, + "params": { + "query": "Corelight" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "observer.vendor": "Corelight" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "event.dataset", + "negate": false, + "params": { + "query": "software" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "software" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "observer.hostname", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "observer.hostname", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "observer.hostname" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "software.type", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", + "key": "software.type", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "software.type" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "host_header", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[4].meta.index", + "key": "host_header", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "host_header" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Software Details [Logs Corelight]" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-03-14T12:37:56.672Z", + "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "id": "corelight-9d31f033-1900-47c6-b7cf-f34a9c00c2d6", + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[4].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "10.5.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/packages/corelight/kibana/search/corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef.json b/packages/corelight/kibana/search/corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef.json index 12790b15644..00a85e70ccc 100644 --- a/packages/corelight/kibana/search/corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef.json +++ b/packages/corelight/kibana/search/corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef.json @@ -25,7 +25,7 @@ "title": "VPN Inference Log Data [Logs Corelight]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:20:42.096Z", "id": "corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef", "references": [ { diff --git a/packages/corelight/kibana/search/corelight-a44be701-0e99-4b53-9073-b7720df40481.json b/packages/corelight/kibana/search/corelight-a44be701-0e99-4b53-9073-b7720df40481.json index dcf3ad39bcd..9608a2a76e5 100644 --- a/packages/corelight/kibana/search/corelight-a44be701-0e99-4b53-9073-b7720df40481.json +++ b/packages/corelight/kibana/search/corelight-a44be701-0e99-4b53-9073-b7720df40481.json @@ -25,7 +25,7 @@ "title": "Log Data [Logs Corelight]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:20:42.096Z", "id": "corelight-a44be701-0e99-4b53-9073-b7720df40481", "references": [ { diff --git a/packages/corelight/kibana/search/corelight-e0f9718e-23ec-4c36-8040-d687fc177db4.json b/packages/corelight/kibana/search/corelight-e0f9718e-23ec-4c36-8040-d687fc177db4.json index c9e1adce5a5..136b9a44c19 100644 --- a/packages/corelight/kibana/search/corelight-e0f9718e-23ec-4c36-8040-d687fc177db4.json +++ b/packages/corelight/kibana/search/corelight-e0f9718e-23ec-4c36-8040-d687fc177db4.json @@ -25,7 +25,7 @@ "title": "Log Data [Logs Corelight]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-02-10T10:09:07.824Z", + "created_at": "2026-05-11T11:20:42.096Z", "id": "corelight-e0f9718e-23ec-4c36-8040-d687fc177db4", "references": [ { diff --git a/packages/corelight/manifest.yml b/packages/corelight/manifest.yml index ab4d8d672ae..3dd8684dac8 100644 --- a/packages/corelight/manifest.yml +++ b/packages/corelight/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.2.1 name: corelight title: Corelight -version: "1.1.0" +version: "1.2.0" description: Collect logs from Corelight with Elastic Agent. type: integration categories: @@ -64,6 +64,10 @@ screenshots: title: VPN Insights Dashboard Screenshot size: 600x600 type: image/png + - src: /img/asset-classification.png + title: Asset classification Dashboard Screenshot + size: 600x600 + type: image/png - src: /img/aws-vpc-flow.png title: AWS VPC Flow Dashboard Screenshot size: 600x600