From 85c81856e8dbffd3cd965c6063ba361e95840925 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Tue, 29 Oct 2019 11:20:19 +0100 Subject: [PATCH 01/11] Add Group Management Events - NewUAC Description --- .../security/config/winlogbeat-security.js | 248 ++++++++++++++---- .../testdata/security-windows2016_4727.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4728.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4729.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4730.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4731.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4732.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4733.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4734.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4735.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4737.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4754.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4755.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4756.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4757.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4758.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4764.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4798.evtx | Bin 0 -> 69632 bytes .../testdata/security-windows2016_4799.evtx | Bin 0 -> 69632 bytes 19 files changed, 198 insertions(+), 50 deletions(-) create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4730.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4731.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4732.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4757.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index d5305e7f3f2..56ceb33a6a8 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -18,7 +18,35 @@ var security = (function () { "10": "RemoteInteractive", "11": "CachedInteractive", }; - + + // User Account Control Attributes Table + // https://support.microsoft.com/es-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties + var uac_flags = [ + [0x0001, 'SCRIPT'], + [0x0002, 'ACCOUNTDISABLE'], + [0x0008, 'HOMEDIR_REQUIRED'], + [0x0010, 'LOCKOUT'], + [0x0020, 'PASSWD_NOTREQD'], + [0x0040, 'PASSWD_CANT_CHANGE'], + [0x0080, 'ENCRYPTED_TEXT_PWD_ALLOWED'], + [0x0100, 'TEMP_DUPLICATE_ACCOUNT'], + [0x0200, 'NORMAL_ACCOUNT'], + [0x0800, 'INTERDOMAIN_TRUST_ACCOUNT'], + [0x1000, 'WORKSTATION_TRUST_ACCOUNT'], + [0x2000, 'SERVER_TRUST_ACCOUNT'], + [0x10000, 'DONT_EXPIRE_PASSWORD'], + [0x20000, 'MNS_LOGON_ACCOUNT'], + [0x40000, 'SMARTCARD_REQUIRED'], + [0x80000, 'TRUSTED_FOR_DELEGATION'], + [0x100000, 'NOT_DELEGATED'], + [0x200000, 'USE_DES_KEY_ONLY'], + [0x400000, 'DONT_REQ_PREAUTH'], + [0x800000, 'PASSWORD_EXPIRED'], + [0x1000000, 'TRUSTED_TO_AUTH_FOR_DELEGATION'], + [0x04000000, 'PARTIAL_SECRETS_ACCOUNT'], + ]; + + // event.action Description Table var eventActionTypes = { "4624": "logged-in", "4625": "logon-failed", @@ -27,15 +55,34 @@ var security = (function () { "4720": "added-user-account", "4722": "enabled-user-account", "4723": "changed-password", - "4724": "reset-password", + "4724": "reseted-password", "4725": "disabled-user-account", "4726": "deleted-user-account", + "4727": "added-group-account", + "4728": "added-group-account-to", + "4729": "deleted-group-account-from", + "4730": "deleted-group-account", + "4731": "added-group-account", + "4732": "added-group-account-to", + "4733": "deleted-group-account-from", + "4734": "deleted-group-account", + "4735": "modified-group-account", + "4737": "modified-group-account", "4738": "modified-user-account", "4740": "locked-out-user-account", + "4754": "added-group-account", + "4755": "modified-group-account", + "4756": "added-group-account-to", + "4757": "deleted-group-account-from", + "4758": "deleted-group-account", + "4764": "type-changed-group-account", "4767": "unlocked-user-account", "4781": "renamed-user-account", - }; - + "4798": "group-membership-enumerated", + "4799": "user-member-enumerated", + } + + // Descriptions of failure status codes. // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 var logonFailureStatus = { @@ -1054,9 +1101,9 @@ var security = (function () { } var eventActionDescription = eventActionTypes[code]; if (eventActionDescription) { - evt.Put("event.action", eventActionDescription); + evt.Put("event.action", eventActionDescription); } - }; + } var addLogonType = function(evt) { var code = evt.Get("winlog.event_data.LogonType"); @@ -1101,7 +1148,30 @@ var security = (function () { } evt.Put("winlog.logon.failure.sub_status", descriptiveFailureStatus); }; + + var addUACDescription = function(evt) { + var code = evt.Get("winlog.event_data.NewUacValue"); + if (!code) { + return; + } + var uac_code=parseInt(code) + var uac_result = []; + for (var i=0; iO!>k;*R$Dk>-n1u1e71O$z!P!+2d>jhh|+UoP?f4|xD?aYQj3Q zd(V5`^PTUUIcGAoXi`>TQ32Kc_|%SSq#DH$rD=6f`Hz36ol*PRe|(eJ4Pp$$7>F?t zV<5&rjDZ*fF$Q7`#2AP%5Mv<5K#YMOWMF8~q`{L*rl5}>`kXGU=EE2i7}%I-QR1p| zLTB6mpY4p@KVyaY4y^-3-!&pS5l?i?Z$3iQK7ptoh9Q3JXWtK8^B8RMr!{Qy=WBKT zt7<>*TZ(;?>fjlG-`}V~lC$dAC|394YadhFqi}8(?)hS!`|vqVe9l)`&9-X5b*D}! z(?lNQQJ2TkEuS{sW7CGUwGMmsN*yIfI z=f&iB8cH`(0hLfCe$T}>aDzIyDK(y|sF;dyumT6-wVpH?r&UrJT}oZ?uYx9GPXW%! z!*&;>h1gS0rTA4!lW=Ai{4T}*t~3qDN|0Ve-SDpmwz^So{9h0@UlH-kr`6V;L|I9> zm5vQiE=|XsD|L$ycxG+wPk~EH^zSngXpC7S>-s|3*Rge7io_KMkX)`jt48N~v*~aWo32-K5U=DzA}=tPwN>$2#B}V9D`qI=+)cSKt8qew?0wEi6DWo4-vp7i%5%ETQj0i4xRiJXS+8*D_W0d@*p>^-+PAvPVl6X)qP z7p1UVYHN#OL!8Kl^@+$pl@5HWZYWf|!x;xklNd|Vp+u$Gi8!$W{}hS@N(iuP<)Xc{ zPXZX8thf~df{Bz6r={s~VrR^sTOiTFI5Q7ID$#Lsp{0@L*J^8Z0&pT1T;Gxeov30+ zfx(69iZ5PkMOOnt4rQQJ3v<<&um@gJDHlr`GZZUou8WGR7g|*Ldj^*Lb*(! z7L-6ua1>PlTl`I+B>g;nC;rRAuQW=S)n&l7iCJM^y$J59gr?AK?ay6{;jwK8mSJIkLTH?yR~T@TTVAP@W5 z6Anen?Jg_px21k~CoUj9dLF(3_JHwPP>g&aZJb@bcAs6(c#@xH>W7>ReoxPrei%HRJOyR_90H%mt^{(+#?Q45V^pTPp?sgmRdQ^0B(oKnX#y)jsOl3k{S_>RfA`%lOds^+25smVSwE3B=9$4TPL$cV+op z!*Yu51VXN;2zlo6$p%Z@*!fZ#eXm7s&Dblkdz=bem8KF&2wll}r{;lJ^S^e;p8 zy+d}Kj&06ueZ1TV@WD}1Im(uGS)hA94)%)huYBG$-TNF;gKsEwmlm)K%B!w6*!QsK;n2Sbo`B;IR?08nm8MZo{OXRV3_HD7}V0{@lvw?#>B6m{wqyJ|8u#Q+yzteXUO&FY%cn?bP$Lh#_Jr;{rI!Z=8 z7G$o~k##*ry_R~s9Q@y<_@7&t_kQ&F@1xh_$q)xS75y_%EHoAF>Wa4-1qYK3_P*VLgaN(Zdpx9_And z6J#+xL{Sf1`kLs0-R452hjA0`i=rOxx9|^QQS?v}jPwtJ%oBRZ{}KKnH2TFI{}Oz^ z-w#Bd%W?S+`-BWGcZr`Csq%kj%a`BSX&>yzPh#S;PHVKvB%+tWyC8Ed?{0{TXh!;m zYt8N8JxUK#cHEm4Jv~^pgJMziFyO67JqR*S=%FFCgZc=G_=9^@`QNpENfgW9s-Gkl zrTp)B$0+|*$wY$86XoAf`$_r(Z}A7!XeaJddiXZ+& zaS?jG%)7*;OBDYT`fVKTEdOFr0SG7DK68B(WFF(6?ta+J|NSc83(Jo!a+ZIw=u4*H z6;Q+kg@pNEhp!;>82_C@Y1ox3uFPXZaV4;(u;A9@!oVGLP|(=}u<-FID{a z$r|vPv;2!i1t6S={so!G_{W&2ng0h=zQ;|R`Kt{!`e*jrU$Gb_UTrY{+&>d!-sb;7 zmFwdNN@h9BzgV>5-;efJka?GX9;aBQvVZpBV-5fJ7W!p^%(eWR<0GE8`4fEY&!znSc>~d&w;7s0 zUWvI(Jg>A!7fpeA-sVcBqufbtzO|zx`+ig`Dgfbx>+uA91(|DgR4+gJKPul(+_n4M z?Kb*3_W2i!FZtUI3BaRl_~N0jJ^>o$KObK~<}vek}=3&Y{kFN_d*Ya=nqYd?WBd?k{Y3^sPQhGRg>6%^6>Om}u9(HUo z^w1fa5M(huM6sV4p$G17Jf`$;@J8*G=;^_#pD7ka4|#ty^uYc>kaIdYQ=w_VMq5k%fDFcizVLXex|g~g3M$5 z(~+m8pULSO#s7h0Gix8R5g*ytzgQIgkJxGWzqS}>5o8|Yzfn_G?XZr-qUdPx;Yb|`vY3wa)qwxM<8^h{S?liwknuWB z*D4*wHCyz+BR1ND`uQWPabK}0I(qlhNF50>&*;c&7pKa0>r|%wzmx zoX^bvvnu=D-aYFJXZaV4!oQ>vR|_(a@sHYW=6{{a_NdY4G=0=j|05QKcS)sRFUY*j z|9X|}rK^^H;w=ASQFxb>`JV~@FUY*j|8pwa2L?Xnd(2V&hb znaB7?Ud{Y(RQy-A9KHP+NBI|vE%9nl?*C3uNLc@E(}@I`$N0zlwaol)Qn`NozMO}j zb(DXxr~rf$=6_BLB0=Uc{_#dMGyi{7`CfL>x_!>_FBZeZs}12_ka>)Mt?7I-|C?2= ztNwZS*Us`U7Ei~&AoCdi$gY|HEh_ux5A8R3oumFoEL!out0j>j^BDg}Z(At*^E$tm zRQ9+0C2>LY__tbDDHiMUpNzFTynaWJxt9OPb(L60XI@viRb{(&*d1Eq@ZUSB|NFM< z_x#A}{W@ZC>VUF4lI9WZAIWKrmJQAy!B>#EmUr{>?1nnuHDVnd*T+98Jv>^mE6$D{ z>^}z*i$i@h3`?5BPc~T((@k=K03kRrwEDoY}}u`P=u$Vo?DIC(=F(GS`;BwLdn!?}q0` z>`?jk_w3rj4*&J5e^>#G=%{jn^9WZ%EKU=34&E{@82t{q(1gZnoHllJWWPNSi{XYqZE$y$5EjZDND}`nAVa;}v2tWyeSPO)y?@{2-?_+Hz?BW%Q2(nQQqsx5o{2yn+S~ zcso`4N1X0adN}xg>vhiRK`e?M-m5Y6um+kCWHCKNaeXfJzBG^~dSJKss?x)f%u!L) zgH?Z7EQ%g}`?{eA_78&06MAS!{pDun{_GS~9& zhWNAs?FB&yH&)ouQT@h$t>*EI#WcKG z!VeT<6q4^S*3lV@8wHtbbrd;|zl6G*=kdRzayzqa#hZ3`w;%6`#inJC+}|9}#e2=< zv_^X%1%C?%^;eL&mUlOdJL>aHCEnxbVTY9-in>4gZuInE^&C_ziXQ%1M-PI`6MAS! z&q2d~H=CbF98u+eWcE!*?UaB0{BSz{9*B=dq>oI8$-uP#$Itw~r}DjX^NP#U9pzsvhKW}j%stP)}UGFUaV$q8Kb>Lr+d5r%O`9)ciq zE$?oK1B&qu>2h@P|W&wRTzCwh9Y>X(T{(L;~@k$Mnhp3p;s?3b|)K2+tu<==mb zV)Z1ZD1iR5_ydlMK2mzvd*#V7cKm_;et}q20Ky5k z4`0R^$Xu%j>wdv-DmBNYAFF(~Eh@OuS^mZ1{Y3Xe2;ujB3jc!4WBgZAhVakz;IE4R zNpm({vCGl;NGys!eDi}ye<;XY%fB1qBYmB;_(M*QDLq_z^5a}*^&l2S57&GcsRuz8 z(?b-WOJ78lR3&=g=hB}jJ-kz~Zd~;AVD(&DEQ%i1e-x<)LFNfPc>1|C>*;SwM;(Ue zmPSuUR&lpj6desZ7O5ja<_R4&*tmNF%3u5n#~+_6J@k3t&g|Vb;tu<9w^&pF!U@NH zcj8?Ng3Psgu#UTtPl@|D{Y>Ti?ho6??QxWUu_*QN{Bt{o$HllGEXX{@e=!vc|2#hV zx#GWSdQt!A@ozOAEEa|T$sI!cH%Fhd8}u*8T+4stcrfPo%Xn~aOiTJg@&0+=cefh6 z-#%`c|2Flab>9Bq&0BLfO*-7S-zyW^ve!z*D$mR&?tRG0w_(wnO*R^6#KiPEfs ze*xj8gg8=(JD7j@wA$L4(9Soo?8~gJJsU92La8-Hn$-^*!60dY@w|~rsd1Tcgx8nT zP56y!MS-P!z)t~RFpdI#tuevj(LU_-1sjv!j~nxjuk{^puYS#^?`Q?qd_f;yqUk#Z z=sPq%BVOMzN#7AqE&Kq*U>0JBZt_KJ1OwD0PD|3yJf@$CZ9bFXw~klvv#=3tM5%#d z-bi8ip)($nGxqU;1WE{;;EhB|h||*ao3;)xz%19ov*qb*J#nhgF#!LF^JZs->mQL;9X z{ROWRL-EpaB>Wlo(A<|#^&2eu|Aro{o*Rfo(ZgTs=s}QqLJtk;xj`P6yQ~xZQZId? z*%SX2#qzi6zlcRC|EfKa{y>m&LLh;}JjQNSLhWn2a zNB?kpXkY(gaYL8iKGEux6T_a`dELK$F@M@t;a`w>lYey3Sag1fFW1+h8k>dTem#%Z z-XP_&ve8RL!)o+(M#lz?{x$jkXTGiVckoWUeh2j$6+} zB?rso#qruaS-;Hwb&AqaqbJXaE4HB{`}JEaDgfbxb+ijQ5@fE`5w~xLPp!v!;d;#D z6-6rF&!+Vn6+Ql~#)rhB)Z?KyhU)PVa6cSnAjn+HKaUR$9u(FUg~x|@q^DTz-@mq^ zdx;I*+wb>_#T8G^`e`xzXQvl9txjlL~ zs|T?tdbshAh8|i$6M`(JhbTS|AJZAWSoFXxf2q<#o4;HVMLk%J1Bpe^!`?dnL6CVu z4-IJ?h=+IeaUhP1%2fGxc)s-|cKm_;xJWE20O5q&2lfYo%(dlznz*PS92YVFzf$?u z3QHa4Uo7?@>d_1+7APdbzaaA(|HgA;j!Vl`uD8Aa$*}0@-zqK@i=*Qx8_%d{xk8eR z$3Yihq+XD@mj60&X+cC>%8wlR^I+SFcdm9cE)|RKO`Uq>YQ&{`W^r1h4dK23{Ei@V zE$?oKOZ_y2@+1!7v@#?IT6sa*d}s9_7DW#`XB&EW1ey?JF+D^vF3m&n`$P{MpG;MH z_-?`_QPhJ~Tq+ht4^_W0^uYc>ka zE&tQ>4~*ye%>OKv?|0r^bYQKG_SruFVo~bfn9fH1V}C5jJjOqkP)K~l>2DPONA@Od zf7((0#p3F{8!!EA+|whMFUbGtS94eXg!TU+zJknS{DW^Z|J92Br?kJl@T{Z!i^XPG zwSmAW+&>fk1(|pG=XqVT75}w!I&QYZfBpIgf5!Vr{nS6bzv+FXVp06h_L~g$~;FyX%yogQzzR$5tVRXp3=v zLFQWiBcH$GiJPn&<^J>>#rx`QH#c9DAFX-SR_lMn;`$9a?H1+}t=Pe7jW!;fC*%E@ zg3PtNoBd})ofpU}L?fQR-m3KQ;KuXPoz;U_6g?bz#n8iWtUnQCF+D_ce5C?SvibSz zZAuTNyB^k6lS_e=Nwn#(%NSf4ml?Omtt$=qhw= z@UmSRg$_-={>BVv)}1A#^nPM7;vw;WRqsXmzuTo?@U{y6#J9kI`rrL*-*fS#L&u*z z3HgjdKPd7w9T|1{Mj3dQMBP4I2IcB6`zS)ct$f}!-TN^(cPVZb}lg?ChNH ze&@UAo_pucWKcnV#>9d=s{Zn+9Tg}wiX%$Xsvq)Se@;8A>b3v+B(W337>F?tV<5&r zjDZ*fF$Q7`#2AP%5Mv<5K#YMH13$>Xpo07X6N)Bbj30WPuB_m%F)6U1E>W9i7j_OE zZU29^GwPO{E6itT8X)?<4$+BtqGNvZH$*KHhW)B{lIS?g-w1ng-w2at&V?1 z?dN?2#@qb>}d}+idpH@|M z6220@6^{;3Hci8s%XEtnc)zNuUjUbQ^vmf9G*Y*IBW&g3s1khJ4etyQ;}v)NDGOi= z@g-3(NLpa5(nIS;ei}?u^k3quR7#EO7e~W!*iGt)uX5^`$Qnum@m(vt11vc{P3w1( z=t`U-2b4`j^(X2On7W{!0={4z1^ilF`WbeJ($7k)Lu1ro6TwswzVij^lHU&>H^T>! zc<#P<%EW=}s{;KX;)8tD1Rt6xoerArr_s7ECh3Rx*q}zu@qwEFzn*9opb>B&yM-xY za~hv1o?7CAw457WO`t3A^)&dc7(C{JcRnx{NPJkR&e-$Lx-dFX=X3xL%>w{- zQ7(?r>ETwyn!0>?QiKQPN1!J__2RT7sKtmS8F48lwnyQF44ILHnD+&fD2cJm!H*;$ ztoUbL8lWG>I0|$mLhG+^Tt9l|)^O=2ub2NRWM$K$|K{8K0rC?UY1 zm0dfhM*K;m_NW`M3jo!PpocQQ4I^9Sou3qRGzp^&EjhLX{t zg=(2VjVOWY;afBTZ1FpRlJw*Bo%k;UpVBB5Z;iIawZI-j+=hC zxB@5bq`pCOuO7hKfe#K`xv1w2>z<4yV;UK$E_g_gk68cg=G`p|0I>))jFA^hu zk&PPWk}pN027LS_>i7$cMYR zv9DJ|{E&S{6hS}4ulPpz@7h&K0czQGasI*M&z#fnNBT0_0aTT=|C8I^<|5Tb1TC;$!(YH9XxtVZcWZOT1C>Upw$j~4#H>W zAQkGNxerO!%J0Zs)Bu&?8v3aYW&2uH5LI=f3hd$hcL=DwL)CKD!b3V6KbHU08u9;E z@b9PI>Ag+-i^cUDvRW+6C0ci!%Sui77i4EtTTR&dU-3Ww!8X0lMK{8NT?H>R!#k9^ zOApu{{;IAGPR)1(!L70Yt&;N(R?2ng{ijk_eCmX(q%)2vN1~O7ebYcLM~>>l1^c$B zT2I{`aUlmWq6ju7=z`Hdvwm1dtfxOH9gQ21lz2D1_+xcsza5K3D;*`H9Sbto>d3ks zqg_ioUJm~6RQ%7KnDbur`0t^&;|UNO2NnI*S1i`26kY1$)E5oGeP6r zrA3?-i_$(;r;O0!Y)1fI46K68wf-^3*~t(l$JtZ+h4!b!v~0w(P#?@=%gNa0u@%qX z@BnfM;%_KJI#b;3hu=+xYa>TCr^ZV?9eXJ^2IlH`Um^@lUO`gAC4lMQ%JafNJjr4$Xx4x>-t{=fYl z!~d(2i3FJ^{9jwgN%{qEi3b(vC+<~x_%89_P&@I!eqJONt@KcVK0=VWRu9&B5k|et zyX2)y6#wITZ5-h&|6)-A2p8Nxb9)qI9^;?xddSTGeX8CIOO7pamVdG6OQztJP{cTe zg!x~Gw;=Nv|7}9^*`ohHs#;&LwDlfm`4@{4e{MM**&hiqkMWP?PG*M>2 zW;)BiShV8bkN#JXd6$2lr&y+{f7hRmz4m<6^lvpUBo-z9ueey#=O^C7HKyj^Uy!+$ z|HyeEtcx(u3q2^UeM+0N|MJ@(e?8g$yil34*yQr6ZCig!v~@6-mD=U0m=gl;g3PtN zyJ234*F*kX#(`WeS9+*_{JV3V)q_|RJ!~3g=wUMEXa!kJ4^g~c7NG~eZt{@Q!>ajh zn?z3!R`Y~nQS?wW#LxrB2SMfuJ=CUo!tv(oWh<2bcm82(GdupbpO=b71t45-|G@D; zkh#|X*7HK>pUvZfKdE{j+&}C*XZaV48CaT*1TDN?LHHMB9^)V47yfzO-NTCicV3Gx zx5IzU@}r{`>jlK3#J|+hM*MpV<1#_!TK>)X5wF|)8Q%8SQl5F;K(yCwhHm02!&)X@ zS6ZNpCeOTXbEVQzc7C((?C8jT92JWSK)B#`JPvO`=2{)qD31Q0s`uk}?mmCJjd6~B z{>9>p{uToRh$tIAfAFi1frk0d#aobhjDJ%c<#EL$ivRj=ciXmXrjz4Lu~_l+-nq+W zVg=YHE-STpShCOa>w?U+{F~!wZN1*8-w$IRXRcCuIC|NdUC!!3EQ%g>Y%%oE7Mc)b zF+D_aoEf199&bFV^l;!t?d9m{!D^f-7DW#^e>U{M@j;MzLJzfRoLOWZXFjI-SglIwIE5lS)T7H{0#7j>MwqXz`&)9SO3Sj`X_$|F`pX)$g;`p9>)KbzH7hI*Mzs z=>CUo^anMIM^^K`Vo`K-BH>YGKrv1sk@zFXJjOrrdUO1F zPSv_&zulS6@-G$@fbjYi(Z3+`82@7s3FQw>Tka>)MJSfi0 z|MRNaZ#?%9J?3cq5sSjRl)}Ft^BDhlo}rol7gV)-1!qrM<0$`PF$oB);=dsC82_lN zng5N7|FXs-wm%VzAks$LJ|9HNZng30y){otr_0Thp@-G$@ zfN;V5&u&B{$UMeBo``1V|Ie!4%Q~;y=PdtXF-*ML5dH<3$N1Ok&o}eGS=GAyUw3`& zEdOHhbo>i4kMWP{n)%$6A3bp@qhHzg~C7I=l7zj{+7Qb zE{GogR`*qk#p?VgpSNAJ>ql14 z*Aa_T`b@q(X&%w5!?>)}GQs)7cndPu@@~GKU0c_?M%+io?eQ;4508}YinF5!``3ZQ z;vgRl#x2d^E1Rr`v3LtI*XqIgI*{o;DqeTIP4PeX@F%wTx8EMcqO`}0M;h&MEY|-E zGS~9&hW4mG|6kUh^KkGbrH3AEQv7z>W6ktnwcc1PiXI9x4Lxvt7G$2#LoU_)Inj~N zc0Kd@kjP_e_8iz^^Lpd$%Krlw_p4*a|MugtSX2PQh4jyY%(ecvj>o3w-SGN|9je~` zt{ocL;lF0>&uYD&Sd{j+@fxH34GbE{T+6>X9(!%QpZ@o(WPJ^nJC%;kzNYnA(bJLD zIxVp%I_jQd=;&97d3l3KrLmSg3Fgxt;bI3zb4Jbc-cPxVzC)k5+k65uM^1lNRWAq|Mz~GBK&h+yj$_V zcmMRY^=$B8v;Np>zCtXf?D#OZ9_A~KAKP%m zh|4`n4+q|By3ScWh(*!EyOo9>)<6@2ET)Gj-k(d|FAJoJ9ylz%qV%w&-|#5v!D_rL z7DW%gf8Edn#|J^?2|d)N@p1$6czLh#|Lxo7K4&K$*zcdkqLu$QL79Tgwf?uxkA`iT zCH*s(`xO6wd|>kp^=~jDIb19m}h#)-zw7G^2r| z{EI~eAY3s2tbak~G5*_Aw&p!=ci&(;?MkVBl{mg=34&Uke`;~ zIi=Z>k8rtP>0$A0Gd^=x4`NaDaGv&2c)W59`G_Ek=^={wDeGZ?Sq}%49u`br?yw%j zqUd3IT%;ZZSxgU6)C0Vaze0|K(_&(Zh!ch91_U&lY4cJw#Ct z*RDzmg!RDJ3Eoh8xcI?+Uqnw2R@Vu{qUhmINs)RGWS-E27oX!k*P;ZRzn9t2rT4^h-Z#NVIie&a2rhi=CrG ztnv=AD0--0-_Qg17lO&o9&I=bMMjiq*URI~YCt9AThF%3_a@B_t2 zh2(q8b+pCJje^XzI*MG!UqqeE>-gVMwVlzt^i4aw+t2sJV*SYv-`5b=#kC9CEw%gVTY6+3OYS!9Jk zo6XlF4lDm3o^{hvJN~a(98SmI1M$(&^kL~R8G7{)?XSwf?uh4my>lnXd!= zRnhT&!Ogb#w;zwiqVV5wmJyFPASMek*YfX%c#Nl;7~^l&#Sx{4Kjdb7+Q`OyjQ#c~ z78QVSA^o!;bFCh%+oNe6KlA^ts`t*#E3Qa)lz*`pCSGkY|J)u0naB7?4lePK%lA~R z2e5k3B`#${r$I{%w6Ht3FgK#;kX z|HyF}F7TPhW$&wMmu^0A#ZDV>$9^6l7RPMAD19f!WhMK#tkn8qEc`u22!hPDyt^R} zD8w_QOU&c4zbQRD{oU5A=;^^~TqYJp4_#i3)Po@NgdS?;xQuo1f%5;BfBz+l{@Dn0BSb#kPgcwm2AAQlyXaKZh<7jXtM z*XqG~Trh-+&3WlZs@}~D@|1xSP{Bt|_yW&58_QorB zIhr4dMTv)Rz8@J61(|F4cSC-p-zP2ckjrCA50{<%DBD>*h(*!E)gMIaL6F7t5XI}# zovDn@1NBI|v(jG57zjb(CjK{%(%wzl)QlaqA^OK(`{>!Ho z^o}0?R`bDPQTU(GD#U+7j5#|(|ANf5{723QV|~BO2Y1J^q|X)apY=Sl)!_ZMG0Xh7 zst2v}_WN(n$=;NIsAsR2$2I4um5RGO`_&^qHizR~ijxFxz(%~*l_nr%D#KrGx(rYB z?|`qyV^1CxQVzD;qnwC6C8RF^rFyqD(6Z4L*^&JSWe$A)vXad%JK_CA_(|7dIcW8V> zyuKq}-w{uZ`~byZ7Gj5P@&#-J15__gOVW=#rXPuIK9b=#jaTq9uo0|7sewY?NMZP) zBOa9__VE`9ln^+<8;O(!F7W^ySS{>7AFu*0Dq!j*S1eLjEf5>SsTysg6|W9 zd+9g|evNr>?n|e}4Ho@Rp$Dt$24Ye4@b_wZ5M-XvLv6Zlki&kL`vkwxy-zf2{I^l` zzt#9fEQ^2ew>-=}ev!~BcI1ge9WZ(KLv{<#3_DFm6f`9GofZ+X`I#8<-ON6DjqxIeV7 zf3dis{qG-d^74tnPwu?-+w0~}-75SGGH>#a0UC?W5AkLDT2)|kVt8E7^R+jKUsl$6 zv0!keexFgY_EY~o0jv4imdawQUpCAs7z~)xxUAIHVN|i9u7S+8e&M|JY&3GPOkSL? z&5`?;IlfL(I;!);d2xj{bY#DMi$w(>T(FLIK}UkjwL0Sd?a-<1I49hWdA_1R)%%&W zZo{L;zt#MZSd?}==*CbxJ`C=Mzz2fNwfyt^(18A7T~T;`h-Z2V)&5u4mUb$#p?mw| zezCaXiJ8ABMEq>?JeQSPIe70_$3W&<-p%o|w&wYI=PK7JxGYk7Xfn4;7iaY#7DW#? z{@Kt&6KFz^#q)|8YA{L7txaTicdT92yOQWa(iD zu09XMdC_F$|5nd6z0^)Tu%8!+MFk*SaR0#ZK#;lC|EI}|^1^u$^Zy%FZ*5|+!~BcI zE<{}#0L21@MEDnEUgO`mZp?XUiK_Ls_dXsRJ^fqdrDAbJ9A)Af6)jgtl5sicBFxka zGS~87EicWB$V>T>BflPKKK_o?j^?Fe@!cs?My*C(x@RVrmD)fa3n12I z11U%H5H8C?a-fwLrOkI%4`NaDuydB7hlimFK^D_P6!X#?xZfvw;QVBY(!=-TE{&od ztnyN^D0(RWouLPg4}#1SdZ^QU_UPvi+G~(m1Cep$wQ@o z5M-|P|7r5l;)uL-s^b5n@}BoN%fDDu0K$dvFUY*czmb=+{>xRp@A&_U6VCE47H3~T z53&BoDJ0B4uc;GcUgN(sLjTiLtzR#BBWsO~{M3H@5sT9QT(m5*{}E&!{ey_o(4#s`JXxvbPSLH}(rE)!&~<=+kC16uH*F;B^P z;dG^kf42xOaaIpvQS>n6d_xbJSWPL&VtR<;_yEgT3nS*OXDB^%-PtFKdaxQFh(*yu zY70XT93KRkC-hL8#s~UJ1@0fXpZKlvf5%Z*FSQd7?Dx-NQ2_`S(mx0?*ZTi7;{)S* zKJ!0Q)%%?zi}tUz(LdYgUo1-d8`;)qe;khmnaB9YEfkU;arryN|KYt!+n;ijf3diF z@5akM9rM(%=V{q+{b|NXtM{2+S#TU~z@i`DzFRmdTlW1e4-xt9OP z>#w-tCijiwoLK2<=buA};5tdLO?c&td+>VwiZf!TfVP7Gz%Izfk8tUJFt`3|}VGRT$dfVY@UO z1Dag@i5bq^cb1gW{qe=fha~=$zZ)6*D-_$DcU~`3%Q6 zDDp8K?W&E9+TmFe)yHt{C|iHnM*+rdCG)QC)O*p2tR=TyvUl+4Ex9#0<7j2$DxA9m do=h=WCy;ZEiTdb}pGAS^5P1B)GyU&Z{Rhslf5-p; literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx new file mode 100644 index 0000000000000000000000000000000000000000..49da30221a502888bf42297ba20b7a2ee3aba32b GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<;Ta!*P*DUSJOl)hH-v{FAVErPRU%1BBoCSd2|{U56s%Sr zqC!zbDt}Q>Q9(f{ND+b{C}>25qFA+9RJ35#>hGU^XZD`m*)U+7y3@@3cKI!Lc6N5o zcfa%9bI-kVXEL}TFFn5?mukK|YDWc1jbeyWw3>(f*Pm0)seb*xK1uWhQ3j$6L>Y)O z5M?0BK$L+f15pN|3`7}-G7x1T%D@jYFt{LZ;KZUy7~={?+1SKIBfE(Ic)OlYjymq zYCrE=ihX%C@bty!Z`35oc{OYls&nygA6MHWaBMox`C^Up@G(Ets|wtm>2DlJ*lC{ep}>@u(XlD9v2>-Mb8d53!Ser0^iwWtXn)xQBf zicPK{zg|p?rNMMF>4 zQ}C7et$2)&vS=F4T&7!u!24HM{{pzgqhC&sqfxr`n_(*lN0s2)?s%t*7_Yj|OPK&$ zh%br!e$ss7lpfkP@zM~QqW=v9!){SWe3f0#K-MrCgzwtm?PJODY1+P< zKv&}w*`O>R)z8-i=(UX^)&dc7(C{HcRnc_WsYu7oPD>%pt5sL)1mHk+T(6=y zov1=cfx!jZiYHcUMn4CHOzMCp+8Ih2fCig^vM0)c;35rzD4-kh1NL$nwu?a{E1rEZ z02m}lFHehuyV-41fIL7k(FHidC-FKj!$;Sk&TL)PJCPd2c>N8im6sagP)JjML&@mS z0=0~zCKN{v@GY7Ew)h=K3HovRPW+dSPbrj)w?>sQt+2<_eHxz-ua*^+OG@T*-1Nf5 z6*y^6^$nVP%>dQ`d~o2(K|QAeYKPP6)B&29g73M8eB`g`qWfo$DIc?F*vc3C^oqG; zds0mn0^z#X=ti;93GnvQ$E&W(`0{YGZ?_)#M+uq>9|f=FVUzn=ehs>nB_-i{knVzP z?B__>8zuLyq5I>zc*z!+;#?7`ZeA~Xg=&0G!6DkXJz@qkmV#j%mjj60qV^D$pE|DoqCeu zVbO~wgnkSSrWrM&^H3(LZR2NdeDEP+K_>Nv@^j!N_EF$WCA#Q1Ot)7@hyqHnXAt)F z4vQbMFBC=45AiFu3I4l&Rf3ONcUzQq@WgYcGy+l%k!5rP&~uV81;MKennM?~(F{bY z!N4JERd=Tf?BV=(D5$(!)pFK?LpmEjmjC2h@&8xw z@1;JeeGL4I#q}F9TP?^TT6coWDoywoWM@@cZP@x>@jv0=cD>I>H^PEl1uwL~JCM3d z510mj)zk*3W;}x6R#|{n$@vE>hz1bw*aw1xJ)4(aOcXX&{#)N6q1abz4-U zr%ppm$VQAPf{lr~VD!(dAJ!4;=?_Xr;|C_h-v=-LSRGk!$70b;M~P_1g3PfxGH=Id z*V2xcga3OJ|8w%Q-;W&sJ@s}x5n|(@qQCly#fFrmOMSfhqA|GdhqoYeEdRc3^)oJ0 zX)SMOPM9@j^&2fWo!H}V&bw81$r<$kZtj6z4WHOA+&)s!PUb0Ax=rfxl@KgKva8N%c^dwRc+c3Mo!LM#jP!92E{jBOrU@%#-B zAcrFU1~R0x#ohk+-DJ2nd}MQaywu|%>p=7{U+Lkq1%qtXgIE+jEH>z2HZm|l7S%%p z^}ycOL=PM`7brc99sfWC^{~VwK8QupLy-c`UgSgSpS>nPg=iV{#1^B z`d(G*FOn)_9*9`}nrxCkiN%V4F6li5ikSP=3*$ZmniS+t>ky9xnPd4k=1&kj5%Vqm z;3CEQ^TWM^p0~ie^}I+dHr+=JpU=V7po3giX=MpSFN1eM=2+gHkQdSP)D71e`@#E^ z9wzO)KRt4KFzW}!qUfRT+u?c;WUkOdUFrw*84`&H_bdP3vwm>|{cko-5{u&hyWS1? ze^nxpAajNP>*_d3zu+zLpaT8G14<9y#UC7IB_3GMi^QUt9xBjB2r|d&!8|X*sF!({ zymYbRe|+yvBkkp1EGhuOg8OG~kAlo){L{UU82MkK>b;=k*g|{x7mJ=m@?Q-_j8{mQ z|8;l^GMDk+E-;@h`v0S<^+ikD?y;ADu_*E9wiDs~ksxy!|5)y1)c;b&f6w&3pW4g6 zSX2Olh3H?9xr~3zi5mHTP}O_vgc-ltU}1b_z5f-9LE_a0^UvcmLFR7$A5yhGvA<}h zz5I(sGyc8ke+8L)`R93xWvcr3{^{838zZKFvw0!0DDi*ArJ6oJ@jk9GwFLiy%(483 z&kJE)gmGTzVQKAC+MWBC-~RaP$=2tE%9O=sS5|M|_FJNDL%6Kcu1v<95O^14j^*76 z^Fq8H^5-%Re7^YD-!CS#6PkVW+n!RuvVdf@9Ok0?E?n%BNr zv91jGU zWBqSFFNFTtI4<~;s`tVD!!NLxf3cX3rRhk}g6kE8e?jIl{vm$hpV!?zs`!8R_1JPN z{MRl&I%=|BKrBl9OCA%7e{W-4CdeGizcD}Jb(=rK+xl9{v#%S7^t#Q!OtD{=Q(f?ERe)68(7w)hy&auwF zSbWLbYLE{RWy9wWfAtB_F#kDt3o@7SZ-}Eju6RuG-|(I8+n3F>bDSv_E1umuXW2}w z0Nc!El{Obk_IZ9?kU5rrV;rrk*BkZwVT|LuUNCoUOk9K(ZkNIAw9H*CInej z4-p(^hUtOF8;>hJ9JpC~C31Q&8)u3|(L?s1Lwex&Ajn*yhq^S*EHaKWpHTik^-25P zR{U?he-?{p^1mQ+tpCmPqZ;cERxAE{4mrBVUjD@*9@WvyIL?&*S&+Gme>(h(j5E1h zqxj!{Y)19N7V;zO`WK6$|6!G(_}3EiEP~8s{I?5VfAFN@zv5)`Hp^}0Uo0vB!GiVA z`G_EM8UKd$2Ru%GO4Ymgo6GxI;lFnCEN1t|ibc_XlXpV;XZ{75WBE6Z58QTtEL7vw z@2}={M69Eym5y$0vD;=HiAB-TqC??25@b;w>30MEZ|Cc3-e;{p7eMCgxLm7r6w_$o zgO6J14{8^W%;tT?qUh+z@o*gpGS}$HZS%g9MMs?1J)?B=@d^p+zhx?sAafc2c)pgA|IMn_Pdt$M$aA*xFBTPm zV8Q&)ZbBr;T*g11h-T#f&#K{0lOd@sH{n`QNIlfAQen6W7@qf5f60|GSzJ2{M=QfAo$8!av{V_mZmq*1yHi zj~xGI_f?9;n*1l?-W|SwN02#||M2@NaUY%WzRGQ?+SNnu(&`8Q-bwABw_UsIM`q90 z5sOp$PQEK)F41elxvbJM!1<$i3o^&@ZoHmdSJ%6S-ABjm@h?gbkCpCcRXvkl{WmUU$4*@jvJAaZCJLZ;xV8+T*38LhW%J*8dAK z$MWxl_NYJqU)G=VaPVcNho0?{yjI#{?et)_-dHS(9ttx;df@mh$Xua^9IE|uqQjr< zdiM1p;m6kQIk3gX^~O7t{|7DVU(bsFt;b`rr~m{D>7NCeWBqR)j}6be;q?(aRlU94 zIySMwf9=|z*?K>*DD7|4b)oh*$R9%HSpJRi*lp|m^uK2%>ub2IR608My0+&;PDf_z zw8Wz5s7H24N54WG7i6x{k=xd31=o#oe!ffTXxsA47FKj*y+06(!Hz&}aDTw@NRT;J zN9O$jYAN#+T)v`eJ#NZ?H7ORx%hvf9i!HE{7y%`Coj}G%g3M+7zyHf5;h*#3-HQLc z`=_sMV1fVI^~YxO6=E@I=SMjWFkf-v0GCzTa%lf$jE@AFWBE7s$8~kSf(G_|Ct1cv zT<%eNIPiY+b@u8(EQ%i9s|x914KyLhqI!tn{khcR3SWxofy3gfN)Lw7p%ks>;1D>H1q#vC{vI**8k@D(eSOa zq<`jepW^?I4{f=rp@sh0I{#wvfS(SZ10KNX7-f98D~-v0`J{`TIt1C_OZtUh%oT@j)z#9zKc->0vGUY(W;)Lj?73 z{i+0CP!D{a;7z56OCR3%Mdb8gcAY>hiXQ%y5UvM7<_bNy@j0Hwa=nS;OO?{m+gIE+j97+k-gCL9QA%c1c`}_0UZ@jJa(EZrvj*-)Y zS>7QQMGp-dhV;Pwg&=c<9^9CB1lK3hgl)o%XRY#qN?Ou>^Syg)HZ zA^9G29qn;*qabsvj>6aR7g1;9I{tT6ZD+JBeai~(*7H5F*l_ZrOB&<4c=s7xR%s6= z;cwxf{R%S2^6rFrM}3{CNQ?2yt!LFdPgL{1N8*FnXi=;2>A^dQJwp@+J39W?lN zv-x_&VdekBvu-(R#s9U7!>RatARZc)Iy@C71FwE!(aisR9bAw(*8k?$L8sC*<8`3F zDmp$WxYZK>*5k2Q6#hHS3dQ3Mh{=M?vHUwB9^>gIq478C;)v42A9B(^ZDL_Q#(H}c ziwZ!nkp5YaIaUwm?a{D~pZR}J)w^=bimOs>&6ahX`G$^T}I4SFCS5M++! zKYUz<3w*|L*$1lHrCSbMRcRsaSkD8*;@BORq*h{FRp8Zt1$Qk<)|Ob!o9EdRYHaxE=(VEA-&%>(Z>Je<&Tb8JblbIUSkh z-C|L6G~igcjs%%2bW~^a?(y)y#1+mzjw?O%eDLm!-4^l=>v^|WQ~-hn=Y4nMSqg&8 zv3fAiyHQWc`?&m6)%)HLTgU9Nm4C4)?eXFZ+Xm;wcpNOqT*iMP6$<}6Klz#BzkFIj zpUClVHXke&h5w0d0{l0|n6ne~FUTCrfB1Yb*7wVNa1Sg?`dsn;S+678LcHHOcA57M z^`Ld${@|_Kvo_})>ec&|@hv%OCF3s7{td{B%@KH);v~MCuo0_uqlrkF%J5g4uD}!h zJL0Pe*po|zl#T5)l=;|GLiz$w%EOUq_*{(r9ce1QD?-@?_sVvnuGs2CJ@9`n;h}{1 zrVM8=e)4G5)ia=-Z(!Nezq7@xTZ*A4pa;<8Fx6h|}>{E31c+diEzE-s)%Z34#&zE2G9 zr4uOlHTK~-FP|PaSoA-I9?Y&Ah(*!E-)rbWkhww+b?Lf6Hv3)f6Z}H=KGCcR-$u~? zX5$yJDE=?s6CMu)nJfHXSH~|L4}$X|oX35s^w9YBJ(X7Cf%Wl=SUi&+1es&?U_O2U z|B^p*`A@}v-=@_z^Dh?Ts2*Z|=(+*-&jnadA;{d#|4GGv>vQJCzZx7rN*?{g{h@XJ zi^UCTzkjmXD<_9MU3vYtH_V&5P52jN?&Kc>G!~r~;>+^1slaA_a9q#xwKs`hR@Qr| zU`UmIpHZUrQ~x~yv-#TA%3_;eHqI^>0+`ddtkTwDRI#Cc2$^I3!g=etXyjm-+&EvG zE%z^Te4V6pRPU(^VhSzj$a?!0iwZ!nU>)s(js%%wb;SMKq0`%OcCa1ud_{q(_j4)T zM?{W)v-u&hDD8Og&4G4&7~Btq4+NQG`RDnefdhiNqTu`x&-4_k{jaSp?ObF*_twY# zVsXV&Gk;Nt_}OkFmsMIhc<)p%gv_zL8{=nP&GYrnRjyNTS)}yPY);p%_Ub__iXLwM zb4U-(pb0@1)k6fYhmUHHSS)(rp1)Y>p~c@WkDwmR=7Geb=wWY-_#nt!p@+IO55&{E z`aBTlMU$2P+q}^Hax3w`dR`G4dzA6|8G>iwfth6`4@{_ ziMlodiunqO@Gr>R#((I#G3TWvs@B`z|71wy^lz4zip7yJl!0qhv|J%c#O0t%FjFtc z9Ls-=yfil~FXc;){CcS6gu7SUnwN^j_ohr4y&8Gxo|#-$X@htyfVd;b9Lu{C@=`Ai zqHM`SxGW3EfmU9UGS6N;h(*yu<*bk%9)%_ZSyT@Z%uBQ3evjyZ^OGq`58sc!Jc4>K z%S*+g=%M^~Aw6(>5M-{XUI#7!}8LpivN$xd);p@|6)-A2o}P>Aafi4p}ds!U#{wX_y1R%w3mOeIQt@c zg!MmOAz}V`O`RZf8~>$Y`k$t1{YJ@~nQJWMr`F?-Sd{+fl4arjk05gy|MxHd73*Hs zr`)3We`5cdMNeDc-}=0@SX|rWrPQY|J}7L-WtFxW`frbMnILm4|4tYm(EN`=^OT$y zPFH&PcPsy5d-Wg|MGr$S4Cx^Qt0@IpR1XmxA7B}4Vc5L&45f!|m3pB_5N8bDgePk`UgSgSpT14d=R>x z&-~9+^?vur!u@M4^v~A$7mL#VMzs&MKaR(O%w_!J77EFaxcr^s|M1>~9naXxzgS$o zcheQ0j(ukM^7%Qx_-f9|pRxWw#9NTLjDPTLOuK{;>W9nPd4kjt_WU zU<Cd9Vr+oePF1`tjZ}H+=!wN8ImW@xj*t!AtAWfxi_|zFU zlIi#3(=>d8=bM6Dv)jq6+alZ{#kZh^aAp9<6zt)f*z{Kpd6JCl0&i71dh^`OcdY2h zdOs!>&!i(k=2#t>=MnKVSmG#Of4xod|6rf1Ka3pzX4hZEV$FVR6>^A{nCBN{j^#i6 z`YW!u$$g_do}R6EU%ma-#tU;IwXWLi{vWZpenV!f1vx}3c5+#zjRWV2cz&iJb1d)1 z_*qxi1@axDVb@=8S9*A8(?zNF>Om}u9uB?|(!)^PewojS2<=buA};5udY`x|*Jl33Vvu;X!TfVP7G!SYzfk8tR`XMT3|}VGH5l69VY@T} z1DYKDi5d3Xcb1UUAR64tl?LPZf|7Z9ZE5Eer~gNW88k%Y2jp(K&8lm ziy~6_i-L*@ib6q(EP|k*5f!Rp)nZ++1*@(8n*Vp^-ScK%7%)zK)6D$d_(28+6^t7&zGxEq_@U3~(h5F|L4l1)M12=tm%~5* zn-AMLI;{I)^F5jdh`z5wbRwSUnBRPasAU3CFAPKc*w6kSxaKj~1w>q_HsS}9GY%cukXmC#u1$;Ual*lv$> z0`^RyV*DzmaX7O*eivhZ2bzjwMMyhSNBrx8t&Y?k|L2Fzmqh&XX;oDxQC3oJ#iIh0 zP1A7aQr#j1-mj|a8sL%={rijr8mU{q8Mg9p))XA=hHr+5@$!58lm)PbI7k!>k`@@F z^w7GIp9WKzekBg2QfgekI2w-ArmHi)&aGo2YbXuGu~zs7SaN)u*6$|K6}Uw%D4T%n zPtYMSbwNJ`e8D&h__ez9GwcwhpOsjLMyt~%fT~#l*CwW!$sl{R{obfO9&1qK(Y zE53NG30(~cS=0_yv=fxl9~CweX%D0Wz(soqqJVC~1zgJQv0V%rS@B#J{eeN8^osTg zC~hvcG9V98OmrU32#CKPml>d|kY~28@|{c#;{3sS)WT2oaVn&#f1zYFXrWvtP$Np9 zdN_(IfGz$eP?CP0z7zjt;8z-@;;Yf8z82Wy>o%Qlh)?s1{|pQ0e$$U4uE0%ut0SoH z)g4$n@WGBN5BZ!5sO?V4Q#)v)497W#eC99df_vwTDj&6E=&Bcc_l&z}drEZ{LhgF> zx90`e(X-3u?YVDuzF~gZ_}$w|hfGYvK0XVj=Eo+tv-}x&3rkAe^+3G{aIVkGApS0_eXosH}A$d}@y27LY{>ih_t+2HghnyBl?Kq^6iExLEN0*K*)J^QkKs*ET`yB zAmoY)kY_HROt8d_oiC*hEV9Va)IrY4_%@*i`d5B)mGEIdS7g5CM%;m$;WAY3&Javz zs5ldKc@VTZis0+{6W<8`-LN_-KrOp28F%RTvt!^GPIv62Mz}T)rOss@LN-O07&~S2 z-CI41+u+j<-(GYT$16CagxW%q1F*;JKV+ZbMb2b@ltu0?sd4VE`N?xf6{}0WS(+HC zs>xc9X=xj{GF$mA>_!2G{8k#atNSf3Q2z8sA+p~Zf;634piqaV4@(F4p-*47xFoMK zyh9F*sf+d%)%OnBaV8#X;^l^-q&Z6Bl4D)w>zy%(>{S~~xdeS=4B z&8x{BM=4Kw6>38VJqF>svy%$7(Awdr*(sw@k3HA~jj>b2$EBrQC?te=2pwuTF?c zI^&FT1X}snHx1;nFR9*Luy2d1wbbq5@p9n-i(q5CE*Skc>xXs3ditHxQO#b2D472y9a#sAz1xgSK2{~mfh9uKjxQ_(+t#bSL* z(WRcF4m1S!eeo4!uH`?lt#0NeDy-%0tg*94t$CyQrsI2qO?kJ9E;*v^&(%HDX5$x^ z3)c@0K^G`ix=!l+wVm>*nV(%{;b+C7)Q>eOBXmF85rCHfs~~f2`I!CeWC)Y}?5XWS z`%`>cHhfvA4d%Y(WNdTaipOub133i#Hx&P!$?x{Vb(2xFkv*GJ{iW^?SqGwrg-Q=! zEE?#r9>k*PVW~+Ea}a?EvX~yCs0S{6P4vKSbCJ@+=$!kasE7M4{DW8&Jro5a{evL$ zgdXyKgntN)esRaY2;VcuUyT>is8p&ggI#7~P=`9HJut8eYJ5BB3Hv3RcD@kKPJ zkZ}8ujP^m0xwibR<0q|eIDRTeJAJpx^;apo;_i!D{F-VJKZ(VPf85`z42qcd_48xC z0Gc$!PV3>11(|F4H^)y9JQ4FP?cfr{`*Xwm1D~_OyZyLGEH>Ux^`FZlT6&1nO06`B z=wk_hv*-4_57vlK0+e? z;9gb!cWqc2#qzi6Cy7NV|2y6_%71k-ks$L#`PbHdlK#M3{6PiUiTjiuzDqnb)Q&%} z9~X&5D?L=8jSyt6)q{0hgkCT6E^+Bn#eYt(O(UG;Uo0vB;e^{~u8)GuWBk+I51aYF zU*&tzlw*sX_@wb4fZ%zpbT z7Q@7=4d$QwXM)Vz{6DC2ef&VtENA%_i&p&m(f$fD@AA*%6w6ii@BYKF*I$U5{;kG^ z#G?5Bl^1LJ_{0Zz#?&1A3o_U8A2}|Bc@gGup@*clm$f)P5zpKF z8NT-CQl5F^^0wmxs?H)VjZ@+yOi>E7pLFU@>w~mjh%|BS9`0p|J=w4^} z7mGcy#M|7@l=fMWd5nKL^0f3bIbEyxKX7bj)k8MoBm4Rni=zLbyA1!=9OEp4%wznw ziJX7%gyO&AMAKF)9OYjuDgfbx_0RE$AoCdiruhflPkvJ6yZGBn``Y2ZX5%bY>tn^D z=)ciBhW?p`_@%9bYwrS6N~lm77qwoUp~uVIIh^(&_L!|9a;Bl@O}<+T>XsVe^38a z_c+VHSX2N`;a`w>jDL*tnfZTKWxwNl=X~ib|6)=2msH|vLFO_3QQOV@uUFX~KH|Lk zk2>mq#G>#nsr2gwnYa1hpt8Me^|DW$#nsqinzJjOrXXK3dCMV0Md z!8w!GI?BITOacNc|1Zcq#y|3E=6{pozqIj)9nUz*zgTRH_v~{2H%B31{Wni15@a6Z zAMe*P^S@c;`tkd+9)8wQ{>7pK5Kfr?IgN+}naB9Y8_~@C|54?8dFS=}o#kIFhKW}j z!oMK%82?)R1!n%Ys9cx-^X_k)q|v5wBXu5z2o zcGciJw7TKHck)xe@7e18I%2V`&*VFj<`KO%jMGXj6P!PSuOM?R@8;*(wROI0#5y{z zkAG5nc(i19oE<&be-0!T2l;3)mNbW-Y_cB4;48>ns|V}nK&Ew6JnwkB;(zXu&usBu zv*)>1^-(NJeY|+2Q6I-({=Xn|E&pz)kNW%nW&SyL2VYit=+P#{Z>K)iOb=G`jm4tq zp)k|X1N&z|<_SIIQO(~I9rBwrHmRJ-Wbf+XMDTg3Pr#vThHMOBtu&^c9usF=hSNrrGE(+vi^_Hp5I}IF#^n z0_h(KGLP~9!7oyTe~ydyDE{{yn6a*&4gPD^9$WQ~#A3?MkMrtbyyEylPAjz)(EiKl z9|@9JSB@bb5o9qv zL@_>PJq$4G;h@sP!Wk7ntAiZ7k@ z4`NaD@Nt5nhjnPP1zAiFQPjf?tCIp@J@9jaHOm}u9*(9Odf{A=ci)A9E}d^9wDSUOCGK7GZa zRr&LCa6#tU^0$5tI+doGp9B3_(eYuyEw=c#?~lcz@ZWK^;g2`MCkryy^6v(JjJKN@ z{cqOAdrA+#%ggw@k&W>f`}I*QDgfa`+Gj!LT0L0TN7Foh=Kp<_?_FC~UY_nK|6(yr zyxL&?xjqUqkMWNfT>K%YAE;apZuQv)XZaV4R{XCA|ANe8{1+MTx8i=nQI-A14R8M{ zdi-1U%fw=J{x_p<&>iuBAagDMk^M3};4}BjK2+H**>dpmT{irV{Ww4@j^1%m`Y!a# zrtIgmQtOMp@b~B;2r}35?uIy^5buzlV(ypyMd{(0@3v({PY+i8GO;Ln=<-^m9t4>u z^iV7NWvqjbRQYfH_n)Fz{#NT3#G;h{lLw6Q&r39rd7}Jl>vK5@pua5sfa9W%l^*t8 zd2*y3e_+2~AQlyXaKi1wS8)b1*XqH#UoeD<&2i}`D&Nfu@~?E3f3bK!(ftrY_`RRP zzaaA%|E1JU_~&}?SH=IhIh(H7?Pz=?7R4XF^FA*aWb9xgli zNw%|k5R0ORYd?zAgCL9PA&SqXJ5wo@iyrv7^ruP>@0P3|9X&l*J(m`XqK6G1N9sY4 zc|s4KelE>=`kT^Gt0CFN(bJJt+$|PGNBxgQ>PV1zLPxbW?#@B^i(ldR<1?j)9uM4^ zxyMG_VL$E`iwZzE;kfTkyh}llxmFL>aX0cQaUZ9jt9;-6QOmf!j`A-Sr9NJGe(UhK z825t(naB7qq(b4J$0xr~{FhHF=p8-&t;U1JqVPYyRfzwF=yP_2{soz9`HvhA#{7O6 z5AKd>Nna}7zv%hiHiP&1qnG<{S1(%U?GN9&Eqn90!##VwlGB{MRw`C`_NzyJY!1h_ z1UCsx#74ZVmC~)E)ol6JAP)Bc-^5`Ik?ts+tMyd<)CIepOZH0>(KgwfaaidSN3N zBrPz8H&Q7zu3sGC_2o1jzfr9yu#6A*Dc}pnQNXX&B{)3VkDb0?UGn>JW8U$Nz60*n zule*HO~9Hj=;KQ?eMcXChsI~b>pRBjJL0L4AD|e_BJ9vjzKD%rfa=9*N&1<`^fR%| zXEOYz@d|zhHiC61HBiVKDGWb!#$$5Eem;;u34s&5kw^(~TAF^-rU3?+Mw(x%s_KuM zX7G-9tqEOCLn({ef!aQ`o#s5tc_)V!Ry3OymTB1e?~tv_vKUl28;fu(1X=;1Ft8HxZ2#LQn!Ivi@Kd{P_}7gKrfw7d1(`SbM+c2X z=ZE;ReXT06IU(Gy=keN!QZB3Nyi_o_QeS73to_t~Prz!twxzPz>K6@j3kCz`G)^nE z_2^Y>tZN{1ZMksVdNwLKSSBxy*XGLlW%jR=l#c2=d0t$h4ISC9-(pb#2q&zg-O!OB zbFGfJeLH+=JqE&tQRrNt3(=~Tu4C*?iwb(Vjzr~rf$;a`w> zjejF9W&M|{eBb$>iWAQAFBa!qKo7J2a}*NhpXbyGGOzJp5~2TTD%WpJc{6LRjri2Q z{}GGQ{#>*?vi%Wc9^?Ps71y!uWq!(Z#sA|6)-HL<2LJZQt;OQHMlYp5iT*)hb51L@ z&Cq{a^veX9Yx#FW|9}>LY>ZQKTsTAN;omKSOP$q&SQI@BIp5GjCT3F#vX~yC*gwED z*20K!>zPUqU3c|~q8_aJ2Vzn5klMn~1N#R-<_SI2rv8CGQ-RwDZYO@N%D>~4*DkZ; z5A3(kVo?DIC(=F$GS`;>Y5E7o^L*ximdf|L?=3#C&PMxepMS9^^>1WbqyDi!7Gxgd zA4@1CKH~H@ivJ_~l6E}pDF0${&Av^SeLni>VJjBqUGw$aRX=0>e}u0f^BDi&+suE3 z;{Pe_Z!bLSDF0%y0ak4wFben2gnvQiUH*Aq*KEaq)tuH_?C@W+{=uK|K2ksRPVa4c zAE{Ur|FdJd;eS~Fg3Pu2oBIbmFR&TDp`~4T2PL+68Q27bWBR+O@N0s;yo(os@e(gy z8diWovt0bj$JUKlgEW=8;#VguB-7X9(=;5x`%OWv)p9cXwg@YvcnO+;GZQ$7P9ErI_ah-lBB$=Gj^A*wK;wc1$duPDg^wwK}qnBNAzl_)&iTdaL69f!h0KS#1PFf&M(MZ%YWqaS3Gf(b)(#$o}+kQv;CHai}Rv2ui9$;k67HWF{{O* zJff95Ijz*jfb(R$KU0vomUpxNtgZ6`d4*`i^Vi#y9v<9uLAtYg5R0ORL$4Tm7=raD zf-I(oXpXOxph-4Af4yDl;U=u6kDeZ^##h9m=wa|KLl5j91equFP;19m=Bo0)uvy+Y zcFNy=TqG71fN;X?!`q0j1(|Eh-#RWr{gb$e(|Ic2$1l%!n18VtCSGkY|Ll(inb-I) z)cKFsg47S)m&tS$x;A*(E)7SACQpB3hBNEVl2W=qu>|pu_`mY^BmLieDHy!1f)?fBffPUMQdDnL8y?ABT w()pL{8$4=jUQO;eO4+yy_wIl3hPRyPWNRKIhys z?R1R{bq|jW+TxUoAI#|-SlX;ESX|^E-`6cIeejPPp#cOCKmY**5I_I{1Q0*~0R#{@ zp+MKjP{+=(JN1A3C>`%S=h^yE;L<9y7kkd=i%S3fPw(g0nqjq8PAhU|KUbI?&6<6g zDL?nCro7q3`WfP{ro$(wb3lE1TA@BY{TP=&6hHT8PwCmvqIfRR{ZH|aB+C}{F&ek! zbq~bXSE_8c+B~?Z9WV2Lq%)Eqbmnz-MAqxqYfdZuH=Zc1y>Czc(8EW9+90s%;F0T} z$s{%X`ty(W_P#arS=+_$Zf|@|Bk@x0_4d3jeSn@0R%flt?y*4|vnky_q$9U0&U~vj zYrAdKMwB_JjBLP;iSl5uT%WXQWsjOP7O}D4* zN)@{=F7ZQu#XPL7)~UQTI&!|`yqR^M7VH`|(J!)L4SzTc!Rd+_%cY8G%VmNpJ53Lg zmAt=bpPP=9^))&sj zoneubcNkcsZu}MS^vcSdU8M>1X>lU&F7TGJ)})){&Dr&S-mXygjOJ}zjstS{qFHOm zi2Z8a?2B7$d%Q}W4u_^4DmthDe2NBCCgkzA$k)`S*}{SuOe%>dXZ7izpw&{|OS;oF z^R%y3gC4R+63M5E1uJ+gdsQjf5T5(4$~wYg9>+)+Ny2)w%5`_gZ+PL`g0-u~DFyDU zWlAHB+AUUCZO%6ZpZ3;w>dm{3TJkX+r&5hCmr`j|eI%R6n{QNV0K3D$r^Ak->D}US zXg1AbDSTWRuh|_cIH|ulioE4>zP0+)?%kM|@Xpva0Vq~lJ{{DB%gHxmPY-H|cBo{( z7SdQ4w@+G~1(~2!3ISBmC$4QQA3}|4DR^+vyOPQV%k2h*u+5tFif+(KxlAu?kIox) z?vO=`7Q~3%t_nWOExH~Tqpx_Mi^~*4vPnPNlGk+mv`s7Wh}i5@mB=Og^-xdFuG5&k z_jugZwj`Y?*4wI#our~#n&F|9tS_`^lzD5gywxjLuYj)n$Xg*S7e3TSx9;k!R!3lW zr&sAo>ik)6P^ocl+p909ec#Mzis#hmCsAYC7ZvBi4XjxnzHtp`ocAi!=HHB|S!-fi z`94A~d55ija!=pxzWrNYIJmhjz4q;z#R}1OUHNp=5#Q83`E~2j$8PERV&D3iO{aW# zzg`zFrCGa6m;OELsq+C}QptAR8BRgJp8HPNrL%wU`pSBAJfq#oC&+VG>&W>Im<@{I z_AsFs2bG!7Cp%)QM&Le;7sPF?E7z=BP_t7SzUljT%e57+*Y;W-$tmU9l?!V3s@{O5 zYErhu%by#UUl3=nOmDYc;rb~@n$%23HCyAF;WiVEuvYW)do{~ZYC(Cg8{@iXmZPj+ zRQLBsnT_iIiKu&|bcc>HEp8ugF4{ad#66#0?ztx11fs2IL}T{(>5-Cu*`;bK{;)^? zHuGJ{x5sJqH8pQW@=;A6qtD2Sa*w_h`z&mUd-1JxMtxPPMn*4_*~xl!s&y>4CE>9w zzW3KJrEAakvu_?A=WUAGzxt=OrEJh!)1$qkOOf@NzFRzH8}xDOONE>@weBDK`0Lki z&_;B;yzc{3-2siw*H|Pm5iV(ubbjk=UQ{zm&BuwPIm`|J-4tE%i2wo!An zu?G9bHXr&*|6WPX+pXq3zfaEAxGKE25BwX6ga85vAbU zeD^!wJ@?!@cP4`h3o<4Y=2Oj=NA0LYsZk73idOTG|N3*vS=Dd+*C&adAj&|LfhYq} z2BHi^8Hh3vWgyBxlz}J%Q3j$6L>c%|1_l)t3>aTL31j@g>vUx$e~n3j`SpnkQ_sIP zaJ2RR+0LlP@91niLo*-I5A}#n#1b9z8owcG6-U$y(-1%Pwf9GU^Ehnss~K$a>l=0a zYid95TY`NBHSqMo=Wo>{$vHJ_6sdFZZy#6N!*Of|&iPV}^YAf0*Q*NLo$hs^Oz6}& zplw_DG@j>p0bE~vuO`}BZ_AyJn@=MW=^OgXYV^K6$k2 z>XY!5_^o8LkFseR&Rnirguwe%SN{^Y#G_wLkE4;g^&4R;4@Z^a+irMgh#0T9*GpLd zTZAu({C?7WW0fA-H1^V9nxg*_UnNs=OurZ!j>B$JM|_=I&p_5t8i?;&m0;)ejhrrbNz2x)wW60;#>eDZ1KBN1 z5u4NaOtI7oAEf0>d_9h?z}M5@w-WG}2j2P6SZeGA?IZDFfjVQ)yX(W~1fA0XI5Zys z*hP6bMyH2c5o_x5=?P&Tlplc}AEm}<2~bNYmSn^v8Q30$6Eb8*5@6orPoM(c=JFvd}+BN1AEjpH&hR0~h|DuMdpjO75%YAHue1LyVEqhuck1$KMaZK=ej z183qoo#sbLESKu)BG`~1vVL7WDo~*VpQ0NIxOWKSfH#S;BpirWnjMD&%kWR3h@&_k zhgNp&tv%wv@OZ_o5a5rexEL)(mlFqLe%%6z4#1JQ5K^&@o1K0CfW%~>5m4RiLwXE0pKDXf+(aL@B{X8I<`wdBP*VL z(H|HjNH0r|gS**nQ-C}`G0}NA!YA>%Ak#-zq0Vew)jN?I#(4dy)Y3~0a44jyzoBGw zXn|VBQDcguRD6pjfGvK`ay=DMw4?Z|><)NNa0k!=pb!rbyOu_eDLq761bisYIM^}tqG<3yFy?e%7 zv^A+F3xROmb5z4v=>&ND=})V!&HU<6)9*GP{zoaA3m*lq6=0M5S$++?nI$FRdZ6xt zT>&QO8QwmQfU#&|!$EeD?!VGtB=jVKXm(#4b&hjGzlaa} zMK)@fN1h~&8uIa%sN*jP9q-ozP$^i*hk0?X#9U93Ct&GP^-H#>u%(3kav=ETZiN{Q z{W|6hI63f%UBT%+1I}!C?FO2tD>Q^uei7*>5AF`aJhnYaID@2{yKbc^cyHih6 zJS=+AgwT(n!8E0Y)C6Us+UC#asL$N^;6ucMEb0a2=fO+tqrjO;b$TB&rC$A zLBKMaPWS7p5%Ny=9iRF1^)Q~j^=oi)>D+5N^=`_Ib6#!EI9f&0tDw~mdJe*8 z=O7j6p}7x9)GF@ETi6hl;Tn3W9%Xx4R}xisqe|@I{C5bbyi3(`)`EjN8$Xr*$6%e$Rk>NoXaXr_!nenR9kJ>`d{%s?%}q*&P6xEf?WwOG{-xT zx=Rn34u93u2B&5`g5XwJh*rt@2P@@z^!`(+D?W8XR?-N=G>Z65{WL7k{dbthZyaXr`k?v|~Z$SRI+S zW3+2&$IHO~-HQJ?6LOD4j{hEdJ01_QaZu4;eZ^t}O46mCqrPYa?)%~`$Q;YRZ%h5m zOH^9R+gamgjb8O;iw(zj`gAoEk6nc*r^sJ}kcj?4kU7@>=J}J>H<&+F zpr5`+)%we%9WnPuEPqWl$)Chx8`}GTBKL?r=Mj-da|#z|sP{D0?r zA^)#TBobt<@PAz$C+QcwB_33wpSWM?;rsXlL#@OE>v@q_G}A*R`UpYhSUs5MMHuxm z?~<1;R{ZDm+AzXi{>7pK5G=TV=JqJaT*g1$^N5lE2UNWmlpb4XFaKiElSuw6p@F*`ohHs#;&Lq|I)7`4@{4e{MM*-X94vm+_C~PDcGNQT+GF=<}Jq z{EI~eAXte01)0nE$DF8<{|8mQ$Bdit+w~U4XV&{)u^1#?Z7}~lJ`-f_=Kmp8>*M>1 zXWGlZSTy6`i~d)TxtD*Qr&y}0f6t$ez42ni^lvsVBo-z9FTYsR=O>Qf8dD4KFUTCr zfB3u*)mjd}aUhq=lpY!!|NdNi^&l2S4;zPt^e`E7w1OXb1VM0o|lS61t3^(|G@D; zkU7@>=JP`6pN->!KdE{j*f;Dvd-)fO8CaT*1TDB;LHHMBF5@5K7yfzO-J^>C_uh!D zu)=@s@}r|B>jlK3#J}Xxq4@U>#$|%cvHTnJBVM=p3%sqbr9AVxfk?004BW(3jc{*g>jB` z{>9?U-j)M>h$!p7c=+p2fQI?c!&{KKjDJHM<#EMhivI@hcH6pirk&$Vu~_-+o;gcr zVg=YnE~~V;ShCOa>w?U&{2SwFUA^9@-w$IPXRcIwIC|OYo%ZTMEQ%hsZw~399W)`x zqI!tnI5SKSJl=R*>0$qk+N+V%gV{J!EQ%g-{~Xc-#|J^?3O&@Nab~e`ocV;1D>Je~gqnPdHLo*&g%f3QmN-(&F6-S+Y?7JK3rZ{s*q`e#ArGXCk%GcwNP za<$@r-?16h4_nBOtm|JaivEZ02*tk^m}e1WF5|y#`1*q<75|kdnzdeLEB|6q0SFeX zf6hk)nalV$tUus!@>8nbCEs4!*9!l&n`be*KUOS?{u{p=(m(Sr$Q;YRaeUym`(vRR zuYP|uuOng|J*{+fbMsv`>qsn$jussZ*O4HL>PWvE@P9jBSMxq={kZ@#U&rMdrK6aJ z3m<&cLVr-Zcw{#3D;7mZhd&M1ksx!8j@&lyJ6UwZdEGNgM^BD>=av-~bYwlR6N{;M ziU$O(-#*J=IImdWD1^+hIx-*E;Q1WJy!u(i|E~Tk?zNYHv8Vu?!oMJM8UJ|hjgkN7 zRP{R^KIaR2`4@}Azm$?!3o@7SkJfJFf32$a@Db-Vc+A%LBNl~sDP>$Q$lT5UI#ul@ zE0=s?FaKguc$bp-pMm%<$lT5U^QzkW`abP>+*bVuEfOA81{668iNqg4<}&_~*Bj%{ z3#!%~`|ZlKmw&OS00h^si2enc%lOB0AC3I4SJl6F`}$4x@-G&Je#USx&L--eDF5_QoFwe;UCROW-f8Fzq zz5I*C)A29JT*g1DYvg~ks{Vz8dW~OeYy1(5X8iALLL|ss#{bdV76|`*pWn->`kVh2 zKRuX=`;Dxgt&nGscP@tX~Hb zi-SBg7`HSBuWYg&#^No=9IFTO>p+J4sCeD+R>l9EL!VmW-+Fr#i_#u19vNznW3m2U zkU5rrC$vZX`Tw&1oQH$2C_VIOo8-099&4uuv-QSeQS?xh8PWsCXF=u)J>*gCpA#Ma zY}Yfd4+%fEcF%z=F|Ie>ru;u}QNMat{BJ!Ti$w(>SV;dY$Q;|D@s@7wt^k1D~VZ3aef3escD~SK`e?M-mePjVKp=%$fA0P;QhJO{W4#Q=z+uHYf2A``wfqv9?Zte zVo~&P$D1KNaC{JCuFykW8ZS3Aj+gf+|KGW7&I?xJf%X1bESmX$Ba|t~9P5Ac{Ak$b zS<*jqxmWT3$A>meY+#{(w$8s;-0!DDX8}n^g@pTOj>m$`W&CU5>sVe_wVwI2p1t|Rr&jp4o}Y?Ei9hqc3-5mfnPd5PLVj9? z=agnkKEmZbrH4hg&-mP4J%~lo!+F}r!STv5Xr>utoMm_9TdYC_bnaz3- zi=v0=G2wa;WKlgtP!I4v{t7wbg8Y4>HLG%9 zxNc>FFQ^B;PVkn}!^IEp{W5ZTFuP757DW$#N(k43AajKt-1r>N61m>Q@uf=XXmY~I zc8x5I1FYwvVo`Lo-yhNukHZ9+D|A#>=Slf*RhJn1nYWc59$UJ-y}f!6i=v04$ss-P zxKNNq^$@{+<`g{~PrLtQ>Om}u9uB62>p_r3^$yACIhd&V$sb1d>venIoAK?*FmS!G~;!k zzbZODD7@Jc|JLKNSQP#{&I-lj^@z!W%(47CAs*xDCZX{+>*BD|!yoc8K5J}YKE`@` z6pIQ#u#o;)kU3Tl=Izn2j-UB|U)6iZrsY?p*~-6I3=*$4n161Mg3M+7BL|mw$mJ1L z>%px*U1u-Wx}EAhbkxIio_0KtO$hc9D7 z$Q-K&^KrotDlz7zAFFz|D9j&aFaKik0ip*Wgy3^Og?~ZjGXBe{z3|WN;O~n6g4r9c z+-YlmBo-wezWqUXJQQS(<=+YUk$#`F#6vERDLq_v^5blK^&l2S57&Gct_MLD)k6fY zOLwMnst`T!b?Hx(9^NZkJ0@~^FuN`-7DW&1J_^@^AajKtTzy@d_4E&=qt-*ROCqNu zv%Fg@ijMjp3)hh#bA^uTY~Gy%|4Urq{Nq!lhaL~!mAT78-eEoO7K;i%u;9G!E<8&? zkU3Tl=6N^jDS024pQ(D^^I@x)-L~>C7NtF2cz&DUycmyz1)0nEFQOvhpXVn(SNvB@ zE9@OP{>|ot#iH;(zIA~AMi_H;g#HDYWBCuC561d_nGf!cWl3Ks-aqeocuR=)+s7>R z-liV3&f6cneQWl{f`dJKy_(a4qgFER^6ZyNUThA>y9_7sO~gj5)|JL1Wh%#CZMqCk z^zVSL#$iuB6;Up>(@{>qo>I~mfKmaDOvmRE?C(HR@m(>>&bU{$BXz-6N9vCM^9c_n z#5d(QgYlC`tFE2_?R*Q%o_^KU=K{t#@LB_u8NIOK_mk!u%Nxm*9Mdm`@c44N37^rd z$hU;Q@RHBtk0GB|t4|1cv==)){`%zg;>5h;8+`}Dt5@^rJDP$ukKe;T(exdC^c@-> z5v%Vg(09aAV=q84m<8COn|uiyejlaAXbJj}$Mhqy%||l)X0Zx>1~&ZlDA`xU8%Yd5 zaKz(s#9sa)j^cbLcq5+TVzd;E1VINH>7$T-_~&aLYJs7n0Ot9!{j!<5_I@6RBa0*Plu)y*lF{fcOn& z)SIyKtufxIltR|88;CM{y%?Xh8`ll`?BudaTNFn$9{h=d9os&gFfJ~nL~R_$3%*Yb z?xo`>_%-I?Ij@`=H(2yPhaSwX8;C{G!{2M@L6EsZ4|VCfK`#4U?i2h{_de0AaocM>c z0{$g`=JKD4|2|EsZRTGr#!)@Q{Lpm+?w<>>o8mFOKfU9+@2;OWb&K#X$lS?4252lgFT|JaXv(d=GGP!ZS zHdpRn=J+~E>8RdQ=fxCR(2@1_Efy7kV8J@t2^|SC$Lfgtw}Yp)_XI~AyCX$NQ8eu<~IIA*Nr(ZEmgJNdgPPAk<-6fUMdzx#84)#QPDDmBoUW`F2YQ` zAagALHS*H@u)LHnIr8hF7US+(Wouq47T=#TWz;Ij(ZAagA5PRL8W zG>~#758<*rAO~7;QOZ1f^&l2S4?AXs^zbM&A;_Y7h+tlt3-^0O51gM&QF{0x=h6u3 z!7MKoi=u~$--q9EF7W=QVYL%x(Oah3S8qs`Zd_eO*3e8h; zUN~Lp;omL&i|y5eSQI@BIX|R_Osu99WKlgtaD0GetVLn-)-#kIy6)%`K|Pp_55%JA zA-QEp4;&u^nJe^Am&OPBN(Js8xS#l)@_)xs*DSFT53KjkVo?DI7ScZmGROM=G~w(lPy6RQNPOzrBlZ0^?h}_|~vOOq%85Q$Dt?$2~|>sVhEp z!i{A5{rEHu-{ASCAlK}6GV8VocS!LqXd#@Lz%d1T_$D^}l}DZ=LA6tnWq6Oyp1({>{ z55NA3D{gY%D37OSE8bUay}8lCyhyF9HoN~vEUsIh)p9`|(emwFR%v6wc_N;lDaahl zyD@&&)pdbv?;yVx zWRCT}d0vF}CwUQ=OkAJs|WAL;Je#JJ%fBN73Y}Iv9!GYt?orHXb zV;mIzn2z=}#zyV&EQy+9xb~E-KkTCr^(cPVZb=;PBZh{<+t3~+1WYY z{mysKJ@?L?$-sjAj0pvKRQ=^sJ1S6W6i1Y%RX^lE{+xD3)$9N9Nn$66F%V-Q#z2gL z7y~f|VhqF>h%pdjAjUw9ffxfZ27Z!(fd%>f#}`e)7(etnRawDbV^Uy#U848sk`bY! z?f=hqZd-l$6Z09G28e#FLv%cz=&0ZP4N=PkqMn$B__?pWKk=K#V3S`>VUu6qs^ec( z`+46I?8~o)r#C)-rzT0xs%E25or{0_nA#qOV>58h7pt9zkNI!CD#6{UUgyh%PPGHt zw1H0(d5$Oax_8d%aj(v;)KWE#lC|4MFZIhWdHch+Zq449f3Qc-SH?D9gPQPBee2O9 z*yIZG>&4`F8b~)#9u-j;KF`5BFj0NEF*TmbsgMfrWhuUh*SgSn99Bk?=~C)|f2A}I zd-8Bh4z}B)oPa$gRE$r>l#e6Z<8v|gcc7{Gt_bBt)DizWW2+-|!~c0<^Q94=d|Fl2 z3HVCuL|^oh!65n6MSf*bUJXlpGN7vn4}-#V}lws#|Lf#{CcukfQG|?>=veo z&1rn5cxs6c(sCxgmOz)|>uK;?F?h@c?|f)HHS&XYjwlP%8GGDS7e*)Ooc70|c>usJ z%Ed7{J=}^|Qwx}lJJ2Qvrs@T z6IBQ)Ft|`#@x^OR=qfgyjC;rR8r!-2%TcfRUEwIPe^(Ha)sgGQU352>z<4yVVIaFu_g_gk68cg=G`p|0I>*_@FA^hu zk&PPWk}pN027LU*>iF}FW zAQkGNxerO!%J0lw*Z`H`8v3aYW&2uH5LI=h3hd$hcQB~DQ`K_Tf`d96KbQa18u9-g z`1ez<^j;?Z#p1g4SuGai60JSPWu+$k3$oLyttM>!ulOJLP@A4-qZ?ttu7nqw;T=ld zr3Y*ee^u88r)E5Y;8t0HR>}DXE9E-${!^(7K6OG?auJRwN1~O7ebYcLM~>>l1^c$B zT2I{`aUlmWq6jv|>w?igvwm1dtfxOH9gXdulz0!k_;Yn+za5K3D;*`H9Sbto>d3ks zqg_ioUIzZ}QvA=Ekn=(G`0uW_%*PtD@& z3X3=^7NvcxN*S)l*^U6b2v`M~YyD%6vy&lAjlqKCyMJ}kc|F8kh#|X*7=jxC!9Z( zqo2N8)%vTH9dY+XEq_h5$e+Yw#Xs)vIR%QC`_1!Xz5tpu*iRfkUF34QVyBqQ%nx4M?8goB* zkJ7`W?e}IxPY+i8pjZ?=^nN>14}#1SdZU@I&H(A$H<{{k%vlTIrzzeS{!$tsboNB8+;O zcgaf^EB?p!+%Vi({>7pK5H7fX=JqJaJjOrW{jiz;`&GRclpI~?EdOHBmrTJcpop;w z3G=@eZ$aiU{@aA+vqk@ZRJA^DN$cIt@-G%8{@ijbvOf}J9^)U&oy_`QqWJHg(fe~} z`4@`{K)4Y73o?)Kk2z5@{|~5oj~+MUx9e?;&+PZVVlhm-+F<^9d?v`e&Hsa{*2nf0 z&2*N3v1rA=AN{W&^Dh59Pq9>0|L#8>ef@=~>ECKzNGwYHUw)yc&rf`SYfR0-zaVoh z|B>@TSQlZQ7kWrq`;<0k{^h2he?8g$yil34*yOURty^v)+A@gCO6{^#%n5;aLFQWC z-7qi2>mjd_aUhq=lpg9I`{8V7^&l2S4;zOXdYFtkT0s`mLlm!?)auyS78 zCehP_)jXkC6g?CTHuS*pL6CVu54CBYaGd#i*>dIo9e>!;%#Q!<=cQs%0SFh|KX5z{ zWUlqU^}G=JXY;t=PpaMr_6ixuByUyKaW1M53 zf3f(Izr}z6BFg$NANuA~pke-V@fKtrEt+5ELJ?TXU@`@ zSOKPaTdz0j_rsXSnJbkZj$FEWr?Ywxi=v0^n+-j*g(d`9 zOb<~UXGZ9O#~Y6+J?y_hdnI~$uo`EIMbSgfpA9{5d=O-w&_it+XBL^qnU5>~pZK)x zE<66W-#?4RQ~6(zxz_*I`BAm?2dfnS-3J}n?JWOdu?KGPHjgumO7f|IEK2b1nbo@qyRwkA-Ud z`u)|sj)-;il+w}7&2~AgBe5ttT68c{M}jP-BmHi`|LuHT_4};#=K{!l9hYmAj^Y|D zeBcoq{Xxy*k=4AfSQH%{{wz{Qg3L2I^4h%bWYH1lbx$iDJu&X>TUOZ6k^Q_*EY`zQ zJRoTO_E`qQdBysM1~S*`$a-9Z=X03z>Sq-HyZWuT$65Zxq5^Od|ANe8{NuSdX8xa5 z)$e%ttS_DAUn~m$Qc7Me$UMeBTDzJ5wW`{~hM!aaQAgvCSQOr+lySWv^EUtMRJE6^ zT=J>2{EJ25T}tME2I9XU^EUs_scP@*^OWx~NA(}JNO)8kP>fYbB>o68kMWPZ-W-3P zSGDfgcUPvf{EI~eAiRD>^e@Of#y_6>Xy$*ts{TFO*Kcx`f3Yb1ODXynWFF%m4~jGM z|AMOao6kQ?k2@NF#G>#nrSLDvJjOqsXK3dCMOE#d!P%2mJIcRUOacO{_%Fyj#y{$6 z=6{3YzpU}_ZO=H$zgTRHhlKL@cdSCf`fr|2B*;9*Kc25;=6|EA_2c(tJ^ZYr{EI~e zAY3s2vl|f!GLP|(C!(48|Ff$1(u>yab(Vjz7$#nA2>*i2WBhCN=b8E6q-tIM&%3{M zmVdE$D*gqT$M{Ee&HQgx)jxk=&+%&=jXz@1ivOLBi3FL)_&;*n0^y(U^Lt5EfAe1x z=SPo!tNSX&Vs-wLaqkY_zaz+8%YWp3mAH@2d|%}jRqd)lcW8CPfA6H`&)crq^&_k2 z>xjiEy(iz1G?(bLp{p&zt zaiEU|;g;s`l}*;e7`z3UYxQ7#9msSa6|Xzqs`#IC=rddV+i#CzQQG5$BaHSq2J8O? znQQrXLwnSp|1ay$c{up8(nI$)DSkWcv1WR(T5l{CMGu9Uh8{RR3o=jWA(v|Yoao4B zyPkf1NaV3Kdk$=|dA;#A<^KVT`qr`IfBW%REGhuuLi%Sx=34(-$79p;Zg_pfc2#eG zmky2W@L#j`XSLo>EK2*^aE;Oa1_TXcuI1kxkG;0uPyc&Xvc87P9ZE-MUeo%F=;_F6 zot9V>9d*kwbo6V)aY5!89eHh?R(Rbg=jS_>jfo{Ypa*tDy-&7Slr%@6V-fmj=>A4;&U>ReD(5cUTnlU^QMA zi=v0$zhUTs?y^8-oKDcROeH;C=eg4Jb{vaJX14ue5B-}r9JQidg<6nzh$MTx0^~~2M&1m2# z|6)-A2p7yh>tB$0jQ{qOE&Atv=yg@^*_)4lW`}?K`Kefx_%rYO$o@x=xt4!7(_cz3K@vbwttkfPz z!Qa9``xRua<=qYQj`})N$@lnr*g>U-f=-Vfj-DQ@u7iq2(ZfHh=|PZrLJzg+I%xRs zX7lxkL(2b$X5Dzij{j>Ghtu)*KzuYLeP}vNhF*QdqLu&oI=CQnt^cjBgHEMs=IcQ3 zDLOtZxY-u}_T#Zw6#hHTGUD-i#AHF{TK?S-kMVR9WBkp!IIQ&Whunuq<{*`Q_=3@-G&{#H$VFpWCA#^BDig!6hDY`GKnS zpjMx)bC!RxXvP0p@Gr_b)U(oOp>-(e%}*v|vR;^=J`r0>AEtYj~jm0BN+g@42dL6EtYcQ@n# zg?NT^iFsW1SEYw%e%O)~Jv~^B%fzDSq4R5zdJtru&_k^pm$42$QvTokufIgm|5o=e zh(+=Lllu(+=O!A+JmLS^dR>kJ7%xja;JoN#rH4HuPmHh=5A2T%#G(QaF1UaAD$YRW zT0K~g3kFlMIWPT0)w_8?-biQp7mN23-47vzpZh8N3o?)KUq(XLT^sw&ZNIeKLPw2tZ*QHrce^)wcH8{ICdOEVo zyTzjDsNc~@9SJf|=&07_-DBZ@i7T9ce5Ul!{ee3(ciG50?C0HLQ2_`SocG;{XDJ9W z*XqGK??yc(@8j}wRqwk$Y8kiNQU1lEw8!($Z5^H$<8iPc^BDhyR4DxO{Nxvk|MF=C zy`smz)qJp66#mDz3i00%W6qAyzaVoh|B>^-Sl=)6!QHSd=}X1?7d;MdF?hdy^iuzA z>Ot$g{oz};W^c?t*rVqwW1Dl-O2u8Cee01Qo5S!f#YqAau@SFzq47wW%J5g4F2xi5 zJK(Ev*po+vl!NW|C?{Y~3F!+!DIZ6+$LC_~??6-WT@lKQaIb7f>Wr<9)D8dV5gtm2 zZ_026^CzEHRW$?J`3{zSeXFX@28^@dwfZPCdSW9OBrPz8H&Q7zu5TRS@#SHet=>y3$Q~s`64!g0jd|LCFw^V)sMtBAIb2W#w++4*a+64)IcF`q%i!@ z5s%3cd-;n5N(db1jYLX_)6(>lHVrVqG}8Q9RaHNnG=q1eAx-@9>@!~BcI1ge9WZ(KLv{<#3_DFm6f`9H4sZ+XVN#8<=PN6Djqx<9n9 zf3di}{qLV>^2+f+Pwlw&`|IXS-6H%8GH>#a0UC?W5AkLDT2)|kLU>%y^R*MjFDvT2 zR4}Mgzt1RH`)~g}0jv4imdawQUp34r7zCKpxUAIHVpOrdu7S+8e&M|JOf+(^OkSL? z&5`?;IlfL(I;!*JIdO$HbY#DMi$w(>T(FLILPvtkwL0Sd?cmAnI49hWdA_1R)%)4B zuEV0ozt#MZSd?}=@P<%3J_POu!v})Qwfyt^Q2%~mT~T;`h-Z2V)&AGkly)kzp?mw| zezCax$(g?_MEq>?0+*FqIe70_$3W&<-p%o|w&wYI=PK7JxGYk7XfmgBXJ_>w7DW#? z{Mpb$6KFz^#q)|8XA{L7txaTicdT937OQNU;t9c-?D0(iD zu09XMdC_F$|5nd8y~IvDu%8!+MFk*SaR0#ZK#;lC|EI`{^1^u$^Z#2_Z*4-c!~BcI z&P1IX0L6TTMEDnEUgO`mZp?XUiK_M14?Z0fJ^fqdrDAb-9A)Af6)jUpl5sic0?gD4 zGS~87EicWB$V>T>BflPOKJLy{j^?Fe@%<@NMy^6$x_c&2I z11LxG5H8C?a-bC#q|I|y4`NaDuw#~?hex0ZK^D_P6!X#?xZfvw;QVBY(!-BqFNvZa ztnyN^D0(RWouLPg4}#1SdZxRp@BIIYRb z`ji_L|Bvrmz33?${M({dy_EhW#s`JXxvbPSLjP?sE)!&~<=+kC1DgM_F;B^P z;dG^kf3*lMc2*B!QS>nQTtg3;SWPL&VtR<;_yEgT3nS*OXDB^%+0i?SdaxQFh(*yu zY70XT93KRkC-hL8#s~UJ1@0fXpSVf+zvIZOm)MC1_WNhCr~rfu=^q4{YyE$U@quwY zpZTAu>izEFh5Odn=%4NLFBYZ!jc9AMKaR(O%wzoH77EFaxcr^s|InVKZBIMOzgS$g zXTznRkA8aSviZ5c{ASLIU$Fi^!dsAejDPTL=D$Mm|CILk7oK&Lf3esAcWods3Xji( ze?jJ5{&`*3EX9A-?ADv?@L#j>!FzZfsh@hK_cA??R4hvT*>Q=Tf6WKN^J3MU=xsz>Cd9VrwRJ)U3?Q5-{Qr$h81AaEC-+Ruyq~oL7GZk@Tn7S zB-8K5r)l^G&o>3RR=1Pcw?()^if=(PaApF>6zt)f*z{K}`BKd50&iA2dh^VzckJlM zem^D_Po*P4=2{(D=MjlCP~s?Gf4xQV|3I%RK8hayR@Yy}V)cG(C31-7nCBN{uH`@S z`YW!u$$g_do}R6EU$yn-h6{6}wXWLg{vWZpZhcmZ1-V4aw{uykjREJ$cz&iJb1m=Y z_*q-m1@axD5!YXDReE@E!+Gh>>Om}u9uB->=wUGKKM`axJw$VUr4(JV`TFZ^N)OlL zZu;oy!D@a*EQ%fm?J)Gf@j;MzLJzfeer1mG|M|^w&$8ox`+1RAQ~<&S_YZF)zZPV! z^}lsqg!U(S5tnmSy^md<=P>_bF-*MLVE#EC3o@_qU#RmRuLY?uhA)%pN(^oAuw5F4 z0Zp#{#0+QdJ4;IG_QWFOLlXbW-;a!cw~J%&v5h z6#1BrcGbp4?eHv#>SMTel&wGPqX6T!lDSuR>a}or*5cbQ-ZN;_=G>Z`ag?%gCC=Re dPo|ix6Ue#71buYK&!WI{2t0n@nf~{y{taHsg9QKp literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx new file mode 100644 index 0000000000000000000000000000000000000000..d3d06502c30aada232419ed99b89bf4a137bbc27 GIT binary patch literal 69632 zcmeHQ349gR^*;0R@<>AR64tl?LPZf|7m%gw5Eer~gGgNigm$OthW05r{9@(&zpH+&^YazX6E-EzsH?7+xhNy zzkBYvckZ1GEiA~GRG3dSKR&gi5~)UUL}^;hQ~u-MX=hcx@*m$Mc7qrLF$Q7`#2AP% z5Mv<5K#YMH12G0-48$0SF%VHo==Xa zp>#dvQ!$m{_dI+9lhwg3sqs`nMO27`r8p3;b*G6qt&FBpZ|a19r8EJ1@^MZswmTx7 zggw)!1iwnC0B3f@?-K0qMALDs7-?7PjDOv*)tP$Y|NOA|(uiL^t-AUY%1X+uWNd)4 zX$J0Grdx!-2Ub`A47j93|28v$#^~0shpjxEH4R65;F}?0yzDMNWdUpv4iW`}qy@$+ zJ+y7&r(smCUx`Dhlo~fMjz;0M8`K$J<<>KiHG+oVSQ~r;EIGbS+qaVFa@-;plubhR zC+QHFx}cu|zF-^${91kb33iCm&q}OEml-obdv#ED#1 zh5AXvC;6xuel$}$9XiubWA(C_qMzbpgBrEO53U0IdAvn{Mxy|^SePO4Hi97wyfx62S08 z#jOw!Or(T3ElrmbJ7fOb1c?sDnYj>Bv5uPyEsZq4R$Z+VfD^gk`V=SVL=`~_3@%hx zeDPW{x(X1or~|5K7bs;ADr_dwUPuRni;fUPAzgGx!BL1a41r4 zcUf7#EAhiSaRKqs3-ArF2aMN(x_g)gjQKby)Qd;-rGRiQ#!J<`+8S4;MO--qY_QYk z{2EsSFJH}9F_LqQs}m!x&c=0lBUb$$fSY;bxVP1f~eAeAfQLRWTISL$vi zl*3e%kJXh1N(hRr_EOhgY@lpV<67%n#)q!21?o(&^ecReA#ToZAmlu|D9h&?mQ!>m z5OPI@$TOEuCRpOe&X-aT7FpzI>LBN2e49}t{VTt@O8Bs!D>7emE$+b0a5<`X7YL>c zRGf*rJQP|TOYrsliEo1cu33{5pw``&792VG^i^;SXF7IDBV3z@Qs*)cA)BU4jGeOi z?rk2%ZSd)UZ(q8S;}x7yO6?)Z!PsN=AF|KzBHw4t#qo6}s1qw2fSut^5{tqX0vGD-GK<{T3G}e+Hot*>4R;nog}ys3X!xri1&?X8>DV znpYLxAqU3SNBfHEd#mg?6BAsHwefNzP|_SFamleR^L5Y1!CoQ$O`CspmwroDWi4B9 z$$?>Gx8>F5j$@T4y%M#dlOBWc-PuWnT4-)VlC_H4@|HA0W;lm_sz=$rHkCxxJ*X0U zIQ|_DDsNM{oU{0-&c=`BKebl;{~7%Isb6|O6aQjy~yNPlJCnes6 zQv9(xvR{wIqLq%4QI7?gYjtE@k5R9s9Ydi?j&>+wX0jh%}A86XxL zQi?A19Ce^ExF3M8AagDMf$jA(FHvDFZ)Z)IGj{E(EjORsA8gLMRdmS_^&qb9p*9=8 zxLmk?a0t3kvC@4?*RSl9Pwo8dY70Lr7NvfyO&P8G+0FpG6j%kBYs<&%XQx7#>}OAJ z7doEi)3V{qLTxbjEvI6e`&K-D!yU-s@V}w>@B94jKwLK!MH|_(=@{~lCV#2>L)L-l zVUg0qXN!k8tOv0udRS)C!(2pQf-I(oDC&VrUlTpB+gz;lFfQkwDC*%}3;!S%MGwWn zNdF+nJfVlYAK@QDqhH+dFUI%#<L-asDgRsFGRl8VGLazjMETd%evKJX`etdzI@8mbcySEdOFr z{Lf7%BikcE<}v;;-N~%~<%<7a8T~(XmVdFR0E83KzaaA%{}>ZB^M9Yp_qYkOe!a;? z|IB{-D;C4Vs}1I#`)7j8+x*|Ja((hp@oZ=L7mHT>`_cXiGVk)w;}k1Y_V4_|iC3PB zn*OcEg~X!x|5X=j`uN1Vc*fKc{0lPI@*g=agn1F>aiIsKwwJd%`%l05@z0a(j|-J4 zi_Lyoy<_`th_(;ov`YJFD#nDsyC8Ed?`{|u;`xwQNk5R&l}Zl{Pkwu@vw9GVqK7Rb z4LwZ77_A_S=^={G%Odo^&rKdwdRViteY5E4!D^gPEQ%hAhZ}le{~*Xbp@+IOPB_8* zylj;!|J}E5Z(*nW?Z>5JQ2_`i+&-{B5M-_`f9r7}w9n>#!5>tgdcJa}1i}?a#QT$)(Si}Flfqt1Fb1nbo z_=x9i{sdq9b1A=n-axeHZH5+cm0>Ou&nqp|MU!uyx4ByBD7&D=w{~=7-;at#1t6So zJbkhxYzweq9?r}F*S9sADTX``QGpMSCVg1^;}06fa3&mZ{eW1wOF^Y9g99^>ES zN4a0|u;Rbrn>}`{nC)agQ!G|Kbzt6#*_Z*gh0`i+KBnyR__`o-E&paeT34Sp@>-o! z=6>cHrHA9a*X?mu4`NaDuxp#4hxX8fAdBfCiv7$8J#c^H5v7O2*K2#Drw6NkrdSj` z*%c9HWB9#i~Re%ZXuN=Nw@iwZzEVf}MFBFH?(ziIvf_mdx2`7Zh9(gAk(uiZF{ z)%sYmDEe>mrlEi4Uy!+$e{=u9YwKg78o$22n&%O*j-F6Dy0OJRhjk%?LMyu|~8)|byR7>+A8H8zmBR!7$T8oZyw99KW3 z_}@2Z^LFBTPm)A$!;9^)V5d}jWiR@v|T_Bo$B%fDC@{w0;TT9A2+f7Es}{~J`c zM~yzO;lqylAF(LBODg?(LFR4#H>zweU$gvUXZaV4!n>r*|19`_LFR4#pHbO9G~fx} zBaZ4nY>^U)$F*`467fHR%wzl`t~dLiXH~8{58RjOEdOFr0SM1u5&a7?kMWQ9KAQR8 zq_Th4u1#B=|cRRskZBzi&pY0s z_@8&|6I=Y-ua9C;>f^;@jQThp^Zx~zYx#FWebnFoFZ0j2JNTl~L$7uzemnKCc6zXy zZ!8u?4@H@V9@sw%GEe9sk81y(=*V}we*gTC$a8D=9@rA|eB+&}{D&+ZSkF%R+xN#} zQ2_`i(mo3^*OtGvKQ_JZhUZ7@Qu+3G@6^N&|Fx@sR`dPDqSU|5zclLKkf4Fgwfvj? zvDfDN>3`2k=GSn#Tj}WRU$#9fdOEV2rzI9eM?G^59sL4+T#$K2M_!w!6`nWB@%bL5 zqwOoRTG-K%{q{gCh8qI4!R-P2BSGd`9a*;r$fb-^aJpCJdVKkyb!j&G%l7#fi!Csd z7!D=;oIv_Vg3M$5zx(qP;h*E;eTx4Bhi0yCV1xhKwZ~TD6=E@E*N1rxFkW%;FsD`8 zN@)K@^p6CYYxy^~$8~kQf(G}0GgbOWobFe8IQ(w&4bJL8EQ%i9sWSAi4w?{TF+D_a zeJ=Iv9Y_;Buv>gd>0#NxQBl-`RexD5iXMLVs-Xw=4}#1SdZqR^`71$`oX-Er09yXympz(mr!~Q1So!`?pSRXrq0$&%ana9He7s0ZC_t zgxhEK$AZjb{A-c(SYB4Sp8fKaS&ba!Uo0vB;e`2T{R=XW@!yfMMgQCmy`u6xciWer z*x}!Pd@2^j|1A7xWcwq?T+6>3;?q*Rr!-sQ5l#;&JuF=?>oaHdAQnXr=V>2>`zt39 zj|j4u9-A3}VbRQ$4(mZIiXLXhMe0G2#qN$Z}6g~VQ zDN+xD%oBR>;(I(x{v+5XE-pG(8+qdbnoC4IQ1;gIE+j98HVV zgCL9PA&Pp4`1|wRZoHxN(Bs6GPSMkYRoo#KMGp-d8hYUNLXdev4_=Hr!t)b&Uiq6! zM;E-bxzvu1YB&CCHIH8`rs2&JexMkmkbH-+j`mpGD9Bu^qsV#u#ni<-kN+)|+gUA3 zU$?`%{di9-Hk|spa}1fo@VZsy|47})VJHSqNfL|ewkPlJ#>3H zQV)X66MCqV{W8|U2dezH{p(LrEPt!@3t~~q|M5dc`R64X$UIU0b@jO%1<+p>f536k zhe{6zt~fQujz6&9FA$3gKse#{;fpu}nQQf6-7gqUCFZ#FBbD!#h51)F%fDE>m*`#y zA^hG?;a`w>jQ=v~ApCPZ_>1DdVD9G2_c$6KiAC{;ufG@R4+WWP`FBHnq_2|}f5_^{GEeBi)6b<@Pk&W9YBM~$Bziisio3<4=xET1NF50>Pw1%5#@#t6fAK3Ee|)0! z(Cfb2GWXetJM72ZVo?DICmi?PhIc6lGS}+CI_^e3CGO+&QqSVI= z&u<$Z7vp}gAoCdiMN}mG^Z4XvivNlkh5e$(ztwoKSQP#zwh8gy7=6yp(7zyaE&q|@ z!IKE$MT``)7UL-fr-|VB8A-E$T(&xi|{6@8+z;Zs|r+_aQM*+W9pWyK5Aa?qK^~vwYjd{n{ z`VP2Pzvk0-Gy`kCppP%n^d0^69U7kzukR?(cf?Z@KR_{<#n_>nd>$LY05yoylJqlA z=x1V^&t&+`;}!f2Yy|63YM_WWQW$>dj7Q{*gM1)?5&~cHMj|D|X=(aRn+F(R8fkv5 zx_S_9n!!8bwPth`ji4;*0BXC?Xc`2fGm-W}I+(6NK}@GYx(-z5>cvusVwr&LLXvze z#EtZPJcW&5GBt|x2OCf;zs@)aApU|G^(D-FYl3eBN+bKv4MdrJpG(ZzkLL#c_i$RJ zElnVr2>wLDuC1SL=oc4KvNnPJ1+NoB@zO~o{2BMaycbXR8!Y<&h90b*8;C{G!(VFX zL6CVu4|VCeK`xiOtP}h~FMXmp6aE>+^0(^0h(#&?iv5xPK#+N&{OfA}h5bQzT!iDe zzbQR5zIp#{JO03a|3xgGNe_a|wR*7bzkq*=z;=g~>YKQq3iwRT@KHqq5!0mG( z=2HkVZ}b19;=lD-3lm=o_a7yW{^9n}zW&AHrjEaRtl8c#hdr_TntxuqaQb%PUyyl| ze{|4Tbbg30+t;QNo0G!*dLFNxEakGg-V24ps`Pb6$=ZMW?+I9q*S1y`+x)z7Zs9P% zoWW_8wgJ70P4x|At}PdiThB%%2g~He@!DKjzs&x1iqcWN$Ipu^vY{jU^;;||0O5pn zvWJ^ro6hs2`PhUpfKOAKs$Xv@m zj}HwV6xJ1m$A@^Nr%3I8d3|Y@VjH@*-|rWTs~(^Ivm*G<!(aZ!FaE@J+Ft@5o+Dsh;9vDl5MTO*)Yq>u>zg3N3D8_$h7E}f=wz2n`F zhec2SR&l9V934lQct%Al6_R8;4!Q^<^@7Z`{MU#}^CRL?e&ooX`&&-9ZLOnmsaSlc zy!?u_h)eg+=Cn#1!hHew9YN+=-rW$F`e_K|N*uyzSx64F`l7Uj&gwxdiXL{)G4${d zG$F`hdWd3Nnv3H1i5@sUDOY;cJ{56^o*Wir*S~VE-VX{<#NcI`u_l5LFO_3 z!MBX+Wn^gdFtDE?>X4Tk?={R=YJ@^9`R@Vvkl_=c8t;T@FN;$>iy5RU2ZqQb99`tmMb z1jb9ecxhN62F-HuD<50eVhz%C>W*Jsu#ik&k54mj1n)NmxmL@`?As!&km4n12F^_2 zD90XN#HN4p$d_WC7kH!6(Q9XCy=g~B_S-SBcqSbQGS}+JI*v%Bq2fpR`Rh%J|NHt~ z{z3Hkw|f367HhU+YY;=U#5lhob1nao&tLJxP1cQae|oOseeI4L8!yR=*1T$~^*>^9 zOm}u9**oa z^e`OjPXt*^578W7DMgcPe*Suk(!+IFO&>iySdFiUMbX2s-G(06KL|2U=%LPzugp{B ze_@NfbL^DA{kTXhDgfbx+lMz0UkftVmcMmeg!(6O5vTK2zE573?=b&jF-*MLVE)-3 z3o@_qU!?ONuLWr!x-V1dN_1`TvRxX54o#l^#tdiHoh7C8d~7M=A@P3|??n2)1yV40 zTLpjOo8UkF?|!!KzO>-T$)`_2KBLeNihNB+hZ=pO4tSSD%|2WQ%GO`@QHXxqwE0(e z>9=H6*0Kec92hosTV8GMI9A!X68G+eH&aa23FKH~lHNPycTwOy1Rh^^rvLq_e*?J@ BhZ+C? literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx new file mode 100644 index 0000000000000000000000000000000000000000..47e2d9b3f4128741b39539624d5b799515a88bb4 GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<39tA7go+}_QvpHb4dG!3Xb`Ebnn*%H@}MMVn6nO}Of<{y*idBpCfh|~V_4iM|Gked@Y#1<3yVK14cKI!Lc3$VZ z-~H~n=RRgKsBm27gu()<`SGb8l}I&;BTCb1p7J06PCKjmjsN&2u^Yq~h%pdjAjUw9 zffxfZ24W1v7>F?tV<5&rjDZ*fKghtK!f^w}7f(bVKlC|WTFHkoC@`cx(UFzurJ=L! z|Ic=`eocFr@6aqj^nE>|6Y)gH{N^J>trCcOVHo1ae)j#qHIKt4f11H2f4))Yzoz!{ zz9rZmoJsjs|;+`+nxDTJ>#OFd8&@maS0@rQZqD&Kc zj3@Nb=B^q0+MFsaRnsV0yKD4Pzg)@NAHID@&ZcpPdiHuXx5ZlIgwN`iPLE-eGsvHp zlH+L*-9iOaOl9~z8{fdq>fol-c&eZxD#SsSP`uWa#^baynnagVNBk?LvDj09bMmm= z0qF$nnM@`4RYK!%W(WK(!Tydk1;>h!UP7JluM4(1QFr`b5H?>L@yn-GSD!>#Nx7Ab z3Q!JB#huG^ix7Cf>gt~Ymz3z=rX|ow-TE!Cm5;L~<7hX0GewM7-sh)mfGxs7qF|7; zz!;^6HjVu>n9B7laVV8iLS<>C$eFEA~H~+125MNg^G6w<3MQ=V@W!gs5CnkCzj%$LXkiT0d}oiw0HDK z0K?-Iw?aTLkrLvxG+j>YjQMjrBsu_R=0QlsI&LnsG}8Q9b+t|aPUM2?S)8B~RRk$8 zxKLg3#cNIJT0qFA_Nbzrp_KlpuvtiZARPcMIzSMGbQ3P%Qtp85641zs=d$Pz4C17h zbx1&QbFq~Jd5B`7^KeE${Pno309}JTvvrm4WNH}a52jN~KQ+Lqkf#2HlF^`ra+yGl zDS^^)6jcCQ{7s-F{XBgq{>#L#G)l!+qp5K%vB%f#*L*{KT2$UYJLEV0DB?=ow2?Z3 z>R!`#ZH|+yxsN0-0KJZWkK7iSDgFibW|5U3#B#*o7~RwXW(rtDRI{W^&-f_e)fce zkaD}r%KA--AKr-zh>u=?Z-6~uycX2m!(?DAz(Jv2JfbfJgmW=orta0oxH2u`%7I{m zoj&K+xEgr*YQBn*oNHX27;$wDuFEH1ijNxd`IoBmBXH(`)0^mKT|Wj=xiT(vWmk2j z?q)(cOhx%vU1^|%px7!0GmP?L17&)RYprt`AG*F4sI$P*FYqmfxH-Rpkn`-UET3;! zPSKq}$Q2bL&s;uPV2K+$UrN0*TIAM@y%M{}a@Z;}l}JM9O3owawV7d&T``x!5M_m3 z>r~iE#1(#2CN!(4I?4DprH1-feslHnVL$)ol${6Tyb-9m=`V*%=?sx}M$O5B{}=>x zqX_K_f8rbCzZ+I11*lcmMdJ=0f9_g1qthKbsS&QtNB&r6AvPxKvSzgAySHA6+u+mw z3~1WxXXx=$1Ohu&U}-+$u*y}X-z-KNs?a^Armg4r%gS$IH+)pcZ>3?orr%0g2BJ6Cp`iPPG6xuIa4qom0wTh?WP z?)f;_E5yIabFS;$d*Slz#dlr0ckrk!`L(&@DCJ47L2c-$#~^%nc2c1hn%j_Mt>W(d zg$`QI4;5B~f)Zs>B{W{sonHt6a`pa7bt4$MT#b2D4W#IoF#sBOH zc^^cN{~mfh9uKjxQ_(+t#bN_W(WRcN4m1Myeeo4!uH`?lwSLy6Dy-%0?6EUPt$wq` z#^ZZ}&3LzpE;*v^&(%HDe&QFG3)hb{)RTFNm97&n`PxqT)XvYYu<)~DQR>I)lo7h0 z?F7J!fK`yWwtUQfb`pfie)iOMp~ERYEeF0V)CP0kauT+=Z^h#`+<_bd{~LGss2*;hpYq9!+fQOFBS}RSPx=R^sv~Zhgpcg1X)ZEQPcyMz9xELx4A&+ zVRY^TQPjhO7XCpjiXMuCk^VuDc|s5QKf*tRM!&e@UySdW?OqXy6C6D>Z-X_Z!n5t~=QyC8Ed?{0{TXj;aG>&@-peM%1#cif*DJv~^p zgJMzi(C3{)HkTC!2@D*epZB^Z$^__vo?Hf4RX%|IB{-D;C4Vs}1I#`)7j8+x$PQa(#S%@eF7A7mHT>`_cXi zGVk)w;}lC(_V4}uu{U0fn*OcEg~X!x|K%5J`uM~Lm}6=I{soz9`HvhI!nz3axX>d~ z+soUY{l{PZ`1xe}<3eT1V$&Y9>JAb>ixt;R2AD4*+v!f&XepDw?U+{G0t~U7c^_=Vnft`}N*kf%_Ye zD?J>zMSC@Rda&weibc^w-X9D-uzwI_p3p;G>Sq?4`1@H5iSGTEQuZPq+KsbVJs&F;MgNW8HT2K?3o_U8Z|)y>?fF=!#!oWN!s*jWN4GWK z?XZr-qUdPRp-3GGvY3warvd-B<8?Kkv)11WVAj!ErK7lp3m7s3FR8@U zg3M$5qqdv*U#GG?e8hPTRyyi`#G>#nsr2gwnYa00ud=;l)sj!07s3FRAEXka>)MyeQ7h|BEWyZ@us+J>jVT5sSjR zq{6=-^BDhlpP`xmmsGZU1!qlM<0$`P5mSg{<^Khl$M{EH&HQgv{FgNuvHe*``4@{# z@M=)*|K=(rtp64nM1ss?{Nw#vX8t#+TtD$Z_M^`^%D-4t0Ky6LKdUj3AoCdicq5vb z|39dFFTG^lK4d8PD$U z^E-mfwfsjuSBdB7%+FPBRoSi{JXfn9{(C32f8TcP=8vr2uOk-A`%IdfG>7Q*VVqWJ zS>XIJd_mgRdZS ztsboBflSX)@w($}ivQV%KeNTZ{rV^tr9NIf(x{JPu>N0=xt4!7)JOgO|FZs^yMwPN zJ@jas;}?>zUVwM4nr__rR8z*BftF zuWxf!^mJskPD?C`j=JX=I{G>MxFGY4 zj=Z)`E4*%$oMj1 z*QD9#FWcu|EH=kVVmOrWJc0C&1ewS9|KMjS!av8wyA}U?_fK1!ZiD~YwZ~TD6=E@E z$H)2U7_T^ffYT~%8MOZj`bUDywfvjg#0|d@gmrJdh@OV7K_1(!=6@!=tDNtNyZB6g~XrO+ydt9|V~v^iY@j z%MH!_<-Mx>=Wd_qR^`75$`oX-Er09yXxNsS(mr##Px1e|hd1Bcz()IQ zpMSA_}3!WvAnKwJ>&I>(;GU3;?q*Rr!+_65l;6jJuJFw`WMdX zK`e?M&eJ{#_g9V~9uZ_QJw!1+Wjzcq>*0XX!~AK>9M*$a6g^Cfi`0W4i|HYXdO+#p zuaLtp$lo`5Q|Y0}w8}4?^$%iE^zdyPI;yMVr2Mz4OU&)e+e!~Bm+olqtRBRo=;3Ipp$G043bL3UqS(%yqKAV@4>xSP zwS%*I5R0ORLurwE5M(huL{SeBe}A6ajdzqDx*glpF?xEiiaW%j=%GOaLl4|u2r^IT z!HaQ6czpt|D}Pt%=z`ZamfF!#?Z$tt*71wQG`v~D4-_L6lJ7Cr(GCwc3NqK~C~_Tt zF?BYt<9|=(c6y7_x9#w5Ki(6I4JJMIU?a?ncbm>>mG)2y{uU1EuOM?R?`{}()Yq9x zyvOrlhm;-)JFh$vJv~^>gNjAb!#`^1L6CVu4|QoCH2in7c|PK>D*wYXZ#`!Tp^82^aD#UFC|fy(vZ)}O6+mVdEm#s50+FUUN` zf3fj?EAA&8RoQRS=+3XA$G=s-Of1&qe-ru!-4PE6GS~7S*)PKcpSfT5p~`mY<^xym zwBdK`#{pt-^!AG~cA{T4c^{`$T3_^qzef*2khzw3H^c!&c!%_4bHD7*N)OL|w>3L@ zda&x3iAB*vm)9fpAjmwShdS9WV;y{?%74qh{ussbw|ag-EK2!5wcjZJ{6qtpC(6IB z&dX5%{blh792b48^sx8plOyf;1N;2~v8Vuq6K)^AiZhV8Ru9(wf+195j!QpL`EF5I zaJ94ii^T_t9)u9W@BI}11)0bAFQfLtKi7l5DE`OI+IZD2N8=;0DE{#64`X7tbks$Mgj_PdO zos04pzryjyXG#w}9=bbgw~e^Ne%vh<6@YNUao^o|mx3U3tsbo7Zsb$qK2ASZ`M&p~ zR&jeAgmwVx3KK% zS6zKBV4Qwo{mhb^T1$@Cc3i!491cyia zu+tZ;Pkujc%sal(cfh^+HJ`qtDOmFbeSC?g@93lN(D;maeaAR`M?5w50~CWi)QCChv&Xn$op2l(MNksO?N6s6U9#LfQlA0J<6lF@*~0CQzNH z7fT_EWh}M}N%AodH`4R*EH;A4)G*E;OsAH9opBIA`~@@WOIZ2V7~gbCBm46PqRd_| zCT8!!yg{E`oK|Uz5{SlwKT)u2>!%y~#f6ltjb(qq&xxUU={OSpjDBSHE2sJm7X5!i z4_5OAVo~()ml}EyWS-DNU79z@<8qhh1i#WtpJ?XTe@3zVt@;9ufrPXDg>@6)8(VgAKp z0@Z`hH|7nveJ;d$3PI*={!b|WTb(s8@wIUOQR3(yZV&D2Uo39u@S7)_zItNt(>rhY z=Z*8GY!&_mnK$`I2aQGNhxl@Qtt+uPA>6O$@!FfETvpV3xo~im{+v;=_TT<{0#@U- zt(3*qKWmg%I2bUea$2RWL$6{(eFK?m%Z20Cvr);xGI?>lHcy^kX8$@->8RdQ=fxG- z(2@Q6Efy7kaKbv;1sw@8*XoGdw?n7ax#nTLp;(`r1rnQwzPAx4c*)C_lw2lPtEvg5&UP{7dfrc zD!_ZEdImDr@^1E@bv4e{8&{d9;Ivrjq3P@{U7Xc}SQI_n@&`i?O`!=v7Slr%=fg*~ zgD)06aLZq!^w9jzmqk$zR^vcoQS`94hJO%bp3p;G8VBOxU40yg@qw4 zz0MHs0UWUl4EMqFAD5ts6mBYz%l zG4}4&j>e^8@%{4ht5+i~-7|yJDs3S51>koCnQM7>LtN^ofs`k42&ZKsInauW(&jm< z2eBx6*g4bC!(-5dAdBfCig9Tkir*)C;P|9m>EZj_%c7_UtGHAwiXJL{ZRmmhgCO&S z9_mtD8lIozxabyD{x5E>T4=`~*pExaBHn0x)o3VD;!tTH1et5g|1@!FNkm*aMe+Yh zMbG=453JLSiYw84<*Z41u z(En7G>o+IAmA%GBd}`nSh(&3CE?OGd{s=OU@qhoapR?{|eafwh|0njZS@g6G{_T%j zi^a8#U(R?6{ez+woK|U@p#OI0mkBc0^6!TJ0nPu|7^md8aGKJ?zgh+tJF5q=D0&!j zzM+RKtfmxXF+D`Fe}HAIMG@oH)0G~&?(7pqJy`V*#G>dSwWXm4_78&06MCpi{R4fa z0=Ey`PW(!hf2XUjTVlr_*l(Z3q5=?3q5TLJhg$qDBM32{sozL`R8?AGZp{Uv)XL7 z!+-7i2YUA~^w!zg@7mFk{dP<&o=!)C%(XhQjw2Fj zkoZxaf4yDt|4{F%K8hayR`ai7v1U8A3Nb_rjPnaJ*YY1Z|B4wmd2W>Z)3X%stGC_O zXkmV|)>T_Q|05RHZ^&-BAfIUY4o<7IG2lEI@6QxuuI1hAKkMqcKz>3rV*d3GrH6+% zUXbCe9>k*P;oz%=9){rg6G0Z!Lo~-%O3@^n=U?wsdbkNs(??GaR^uyTQS>l)r=bV- z4}#1SdZ@GGE3;MkU)VhV96RN2KQ0oB3P3pF_Te4G*MiKoDqq5er+#OWNB@8ee% zILyCT3=^+5n1A-ig3N3D7wP=RYeDLV?#m>)23;GxY?p?kLzAz+F~gbX&XQ8PKe-6; zkodof_apt^T~aW3TLpjO8{$N`sh%pdjAjUw9ffxfZ24W2SC<8+ZCJdTbG#P#T(C1WXB_GD1KuxAPt<5w|Fz?mKKyBPaB(Nr8OLfVx&<6k#yb*7&9KR;}~G~$;}tFAtQvXXKu z9vz?@nua@<=@udI0oB!41DBNO-=`A~d^1Fhm)+y1Y=AAqL84%g zw7^)Uhqg`plu70Kl{l12sc{41Xar8XS)K7sZaouO!)P#$wZS*QlH=R7eK(0N$1QR} z*(79tk`95X3;HSG3&v5vuhplYVTUOFjKq30Mx8bZOcmjnFIb=aew1+w{1A!f?Te=@ zoXBOx_0Sh2KFLST@S~a1>5%Du8m*VbWc?H$8`P*JesC4w&yy_zG!g~K#ljTvoix5v zJhjFTsW~^kmOz)`@HCWLF?h@a?|f=JHSvS?QTVYy-Ld!G^&Iph5>;t{Vy!?@-2p(j>-`bTCnAc05ij#Xp52ff54jTDfR% z>y-e8Cn|1*fM6me#A#`|oY)!j=T=B`5YEhnkcxENTxe;e`L*h5odBH31=qVMK_{vZ zQebeQy5fu1n$cB&kWC#>MY}*L15shKkoH142wZf8APVRPT)?H=5!=O}krmHnF%THU zNiXl1fa2z2D+lrr#YE@ejDYy-30VQU5_x9pD&NV}D9#^jK&|}L5T`<#`WH$@gBHqV z0yUuoYJj7t0@&hj0ww9^={xaX27aYcD!v-!#PA)iwLwZlny>HtlY<2dJ#&-^8wckk@c6{8mqTlr$&-fW7>Kt5`N4^vvHRAIxQs+nD%mJr2(2cr&45V^pTPp?sgmRdQ^0B(oKnX#y)n4k_3k{SFYFulb%lOdswLqN(mVSwE5yZ{;4TPL$7iIZe z!*Yu51VXN;0D0!}$pTB<*!fcGoz^0^X6%*NJ(j~(nW;n)LRWGgxkQ>97TFbZDGXIs z*tJfBtwdbmM`c2@imH>0Z!>D7f8{qJZfQQ^u*y}X-!4HKs?fcrrLE`q%gS$IH+)pcZ>3?orr%0gTKd#CI;9jCSNa>KwnM@dsqwyev1 z-ScsUh{ zg^iFI&Y_>`QI4-oB~f(`s>B|Se}{s~yHqY`EjXmJ@l*Lvtrh=&2LFEQo8H&NzgS$q zA-mOrJfd~SIIYrze?fLyP1lC4{}un^A8Oa?)K(3w%SNyR?8EQC>B*!M=w* z57++!)PIgYSSi=TD@~>D_|*kbNmrav0WXt}ebYcL*Xx?y1^c$BMoZlh-X~Z0h}=ox zkN%tW!#ZL;{Z8LaG;UB*;yozEpQHO{h zTvvjkjqKT+>@RhH$T|=`%vXB&V!>dC^&l2S4@*pXn2iWbkj3;6MLlroYoZ5sn+ud4 z#*Di!ih8);!as;b(L+%%(mx0?Pv{}t{1tgF$K^ln6FP9YOZ>D@ zmH#tazWUBi`(QtQ5{qZ+ol!({3JJFl$!H%0nQP16I)2jnhvTOTw9|`JuD?pz8FydQ z;@4D*_(?2QetmzRawuZ%H_wm#0%+0@JFSC17G$pF-yAtp+iW;)BiShV8bkM>uP zd6$14r&y-4zvvG~Uwxy0HoLTX+tyzbZO!DgO1m@_V?y9vkhzw3H;fDMe8{V$AIRx) zrH6*czCYVpJ%~lo!=~Ye9!fAqE68Gch~o3I2tDv~lZTZaR?TbQEP8sd8YdKsqKBfP zh91~I2r^ITp)QRRjyFFqTcOH-=kK<*uv7l_<5IDx0E826AJ`uVGS`;B^|%n)XLG;c z4=UdW_YXhES^mXh2BxMXKnu@T5dH<3$M}c%g@2xR_lV;E-PhwQ?C@W^_~?kmd;zg2 z{x5a3;s4%7zf6$1mVa}6#Pc?PhOhm(l&7CJ5bb%Jp+#I}n9IcTN(*$+{I>101sELJ|Vch0hzm;ttl(<*H)rtI_h zx*&5c|7Jg0SD!cXx|tK^e&#Brha;D)+2yPr#G>e7#}-2m?V$-l7Slr%`>mV~C-hL4`k6)Me&*w<{7-z^ez%?Sx8FXC#Z#5P zAaiZ`TgOK=<{zw9{P)T{vd3Be#bR$P@izA}rF|A;9^;=5KP~-CPS+^@_aB{6{g93L z$iDu?qUe9vPQ(AT#5ju}^BDi_BIh4Gq4=*n-n`9nNBI|v3P3nv{c}7b$UMfsY5oEC zlb=-iF8=P~{&x7U-8hTY`dG0j`fu`%p?~IIkhzwBbN|3=>tmrBzrMbj=Mk}vo>Drx zrNwTCbtD!=M~e?d>PV2qbfm8a{NIk()m&$-zZXEp>o{GjbQITU;RBD@Xb)=VkF3Uh z#iHowz0V?bB*;9YBd?A7mWYlxu6tVP=!x-f-@4LBJu^EUs_sci4>|CH}BNA(}JNO(aRP>fSZ#Qz8~kMWPV-t2##SGn#yV0V_Y{EI~e zAUuCX^e@Of#y{TsXy$)|%Kkk&Hf(m5f3Yb1ODg&oWFF%mFN!ns|ANZ)o6kQ?k2~sr z#G>#nsqinzJjOrXXK3dCMV0M7!P%47ILg0ROacNc|1Zcq#y|3E=6|E&zpUxV?aw&M zzgTRFSA%l@cbr1P`fr&|B*;9*Ki;op=6{pQ_2c(tKm4qt{EI~eAe=D&vzrhJGLP|( zH=>#O|D($Hvaaj)Im^FT3=^+5gnvQiG5)oN^UVBjR=KYD$D(hYq|v5wBXu5zo&c6H{RTK(|fJE{HqwrltN$m;z%VzInm$(>1aiC!Dd zX_b}*&L6>7khzw3^YiSwI^Q*79Ua%lKPf#tTDmLFjvnkk2NH`ze3XeL&EY4TtcS7q z3NqK~!TLFnX&n{MJKm=FpL6&#Tm0Lvk77~k(i z>fgp|jrun@XdrVf|7L&ewfTPf-?NhWHJt8LIy&>(wr507M^^K+#G>e^XRe{6U%-zG zGSBG9YxA_i^F}#7-=%c4b$NCRJ36x89*D(oL!dUeJz#$%$Xu%<>-GS-lyM49Us1Up zTRw12nvMRleg4H_3(O>jLkT}8kp7V%^BDgh{5(bY=eT&c;(zb{>1!L<;J|-iT^+BWLH*uImHrW@dz2mye9(NIvw9GV zqKEgZ3_YxYCIneb4^dp7OFb_Mq=_EbExxMsuw=l9DC)tgzbqC-55IlG&;$DiLFNfP z)TRD%BXfUwuPXmLx6gUrjz6&9K8r=G^4|ny3NqK0zjb^xe9J6ppE=#9`2YQbn{RAr zqkXo|zgRpFq{C+bNoR$G+h_L2g3M$5YmxIp?7v9;U}d>Oqjj^bkco zp!D%q$l({{?;E|L^w4yA<(JO-2eBx6_&CAP!&kwxffydJv1Eha;(m9=Km9$YOekVmot^9u6u! zT(|A!j?U^qEQ%furA6vNkj3;6MLk6P{dsOT-d1|(adcCs=;^^K?huQjhlULeJ#c#= z$ULD3FUB3=`3XF){2isE^IqLpYDY)48~?SM$1fJs@MZ}=P>fPYe!y5qdn|4gWUkdw zSCV9|E|jIjFzQu+2P%OyeAeLmOOHQV>}n{F@w`8?ST~hEgaNeLFQWC-7xN` z&oh;HkDrGfQhF%p^5}cf(}UG>P_Za__(u&r2r^ITp)NfK4gcM2ejagHmH**cHy^Q6 z{G*pfJ{p!jJRK%OpZ;Res{HvmxFB7|==iYU7F+z=_s3#U z`0qT+@W&hAlLeV;`FDdq#@kJd{x|F5J*9`=9B()yz>`~!Ljg3PtNyCDuJ#5<&?nEPdaQF?gh z`>om0(}PvNOe~5Xy1f>u2SMfuJ=Dp58SCI9RsLK4^`|J7zt#E$u_)#LfonvWv&Ajo2Rh~jhUu2e=9q6dC1{i)K! zyQS;KL{AS^&!xqp=wbcGk$Mnhp3sA*pG&iz{-$))W@t`v^mJqucZ)^Q(ZHjTIuc}_ z&{3U@yT_sY#jkMu@tM*?uLthR+HE85upf7eMFk+7aNKtn-lZVOT&oA`xEuMDxR2A% zRlXN})H-gDqx_3SsgLKM+crEd#{FPH<}v;YsZjXm@yRa~{}s~;`bLj`tMOp5DEv=s z6XL%y`kbAie?jJ2{v*eOF~48NgL`6H(wB<&FM7YX)!_Y(G0Xh7s~4^F_J?oXma}QX zq27I78P}4%Rw`C`4roArY>vRU6gLUnh>duyJ55B$REEFWbP3+*-wB7tV^2O6QZBYT zBAtXiQ%IixN)vEqNBl0v{!TO%$BK}4#ah|U)D2smsVDx=C%lvpN6K&q^Dm!PT|EQZ z`3{zS1FEaf28^>%Y7LQQ^ub0jNLpYlZ=_Oc+<-X3>&xk8{6@8+z*0Wor+_aQM*+W9 zpWyIlA9nhJ^~vwYjd{nn`VP2Pzvk0-Gy`kCppP%n^d0^59U7kzukVy z3$Q~s`64!g0csGZCFy4#)z8E>pULo>$1C_5*a+66)IcF`q%i!@8IQ>s`}jZtB?ON1 zMj|D|X=(aRn+F(R8fkv5x_TgPn!!8bwPth`4Wn%80BXC?NE!&Dvyk>eI*6`7K}@9r zx&c(@>cvukVi}L^0+M{p!;SQOJcEs3GBt|x2OCf;zs@)aApU|G^(D-FYl3eBN+bKv z4MdrJUP#Q|gXaeQc5zyzElwbs2>wLDuC1SL=oc4IvNoRm1+NoB@zOCQ{2BAmoR?4b z8!Y<&h90b*8;C{G!(VIYL6CVu4|VCeK`xiOtP}i7FMXm}u=j}97(&JXeB_}Wxrb5gip&*QZ>O1Z48_fkP-mA=j>S^IDQ zJprrn+SbZqo1Zt%Eyx7SX`EJR>(Hy%P~Sl2+H&Ez^-NT9uuNVYug#V9%j{n#D;?E) z@|?Ir8#=OIzr~^g5KdS}yPzXM=2{(b`*!H$dYl`s$2?w9pz{4}T8|OY#pe27PS3f2DC)|PfDvY~tX{eH2y;>np;7s7wG zdx6s`tpdDvu4f=~E$?RkSy$tHy>XT26r2_*Jv5ust(&uY5R0ORoBn9%p&2wG$YOek z;`8uP?cs|>58Uz>D?POM%f(UDgVi{YSQI_%t>GU8nJ4s6m&Sp3cvl|>;<%_pm4BP( zn_q0lAJ~tJ#G(QaPPlzwe;~+QTmGkri}J&95%d2mm2YiQvBUg}#co918Ue+8g+%xl zWM1Rncy7#b=@gagZ6AD^89n`5#ie3#WE^GT85J#8NRsh5=mLz?3o_U8Un4HfkBCe8 zkt2T|Y&rg})sDucV)6a*@+(#&F5NSe(<*H+_XXg01et4jcSBt2r@@pfaR{enAvw^> z3)1E}s|T?tde}M3(8D9pgdmIQA&PNnE{fkLdf@n^TE&o%*rNt3( z=~Tu4Cl$T#b(Vjzr~rf$;a`w>jejF9W&KyEeBbr|mB*dsUo6f(j~-_Ik5fpPf1Xn( z$h^jXX@vf#sa(G?<<0ChHsVwJ{zoiI`*Xpv$o5B&d5r&im;ZuwFY{AwR{TG{f6d~j zZ18V?+*&NIZSqq3ljt85w&b)*+XVf$N54#vxt4!7^bctM$Hq7%$A#0C9{$xTxWrjK zh(*!E&~ptvWMMX?AdBfCiv0sjV=asrx1OQ&(0ymWDC)tge;^h`52>vTJ+OZeWS-DN zUFsj`GZnaf;CABIs{A`&am`XY{=k0wEEW}ja3bx4AaiZ`pQ3+YJkMwTXR3U^``*I+ zYi+d8_W2i!QvXJ^H|ihzV?pLI{;`BY;v-Ifqxe6(H);FRj`A-SSMS|;$>(F99=?2j z-qqjCS@|>8|3~-=GLP{OzRmnsD*m6+{`SJNj`A-S8)4N30;6#MO!yaM-sPX?bmU3X?<4h7-}Jtw_mPT4@ju&dHvA9kUy!+$e{=tU=LNRFH?*`1@1VpM zF9Vx|a7=#}6@E?9mv`|ZFka%tOT!8=eShF2lg&3kG#`y)AYx$3S{)#7VvTl_7)3X)t ztGC_Kcwt_&=2cs*{}GGpH)OY3kVmv)2d7oqSa6<<_h$++*Ya-mpLKO!Ag>UOc>a2u z(!+xr&r5e!4`NaDaPSpF4@0s3M3BYw5Y6$GQZ&it=dZUbJ=}oR^wHCU)%c276g_0_ zH1xp!L6CVu4|R5YWsWNU^IPPdWvBe@$3?iT9CQ6{H^06)IW)fIGwBV zeeAM)hxr$aVdB*W^UwZRka>;&LY@D3El2~mXy-- ziN%PA#Q#;iAL;+@kb=S6D) literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx new file mode 100644 index 0000000000000000000000000000000000000000..db249481555e46bf54078ca741cf72b2fd8a8615 GIT binary patch literal 69632 zcmeI$YiQMV9LMqR|J-(V=FYanh*Gn(Ok-2iSvI@aE*UMewyfyp^lUmk+f27|*#oJh z8w5s05Jg2%J}8O^!uBAD9t37WSWrFcNj)pOkPm{>=lj2Owv}BW5Z?dsKmW_`_Wiwn zm!qe%JkT{*?zibjDt@t7*TB+djluLR|M|J`w91kHTnQB*fB*srAb&1&TrnUYXPjt+Gcg35B9y%H{1cA*6 z9^UX=CMoInUwyi-XJX)swo5+TIPVSh#B;4_vX^x09rWYijI4FqUDj{IHmc_bb>_Ck zi4zT3+igQuR^l!tWP?`Qs%)dS!!EWZ`rBoj^`>8W`gGr->!9B3v=Kdx*no1j=y^o% zm)PA(8`kv#TdKbmx?5@&>9ha0=66kbN(Gh5j~c6F+(vqH)??$Uc{FTM6MRjjaVGmnx<$mkH|Z zY`sWk`f0T_wjs_oD5+tkrHXZy$!Lt{>LHoprNde4Rz@GIa+t|HQ_5!RVRk%EJNIO) zHyn%YVV0CP7}z{L_!98r^|?8_Rs-n6;zZtD;5B7!fgX~Tv+d)&U9IGCjoXMEOLF(D zS(}v+`+7a>k85mutWJ#%hNkVx+OGh7h)T*6^7tz9IkkFEVaf<5g~XGyrgTuyY^m-g zUFrHs+SjW>57{G$YCU0v}CFB~h_8r3+e zzt zx=Pn}S+rp=_$asNengBu<9#fyPz=c?{d`Ma!|lU1rpO~=von<=m+aRA-8s8K zefHMle$TL(=}fW7&dS&+%Brauo|?(}LW_Etw^^3ACZ%c#=+4i)6~cVsOMP_dsnHsA z26kuqEWJsseB3M4F>mksf#t9HzM0Vw?^UH8af+7v^bM?89=>sv)X%#WYV+^<)T}u% zrgZP2=iFlFJoP~D?%pS^dimg`ZRzvgub-|EZP&HWE;#C&x*vYu`op8Qb$-2n@%ZX9 zKDk%R#dB%YcIei>XZ`57&!<$fU3Y{-(5Lsl6L#wA-@87u9vR7Kck%)9)N^#^d8NCDTr%8dq8>JAeEz6pHA+n=Z*^5%_WWv; zP1DN$aWAt``M(i$x0JT%9MEb$ERCL{$-b{ulds! z{oBlUCEp&$)Yj;v5y?j-y^lU3bE+-+R_vp&Hg3hY)^W8}s}dP4CbLtubY|$BZ8O93 z^!VAAUrP6$?$=($>T%wosQs&dOk2uwt(tD_9i57-*Yw@uM|PGzZhy6qvjweB41D(O zTQ_SXI#Jq>fvIdsee*dMN$d=#v`0F*_Jyyg8Xe6ih@?484gcK~-SLS40w=S8FZhYY z3++3*<%J1t6v=g?UHYCsCs#XC3ZHG>rzdlFi5&q15I_I{1Q0*~0R#|0009ILKmY** z5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0 z009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{ z1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009IL zKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~ z0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY** V5I_I{1Q0*~0R#|00D*rb@GBIUkbnRH literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx new file mode 100644 index 0000000000000000000000000000000000000000..4efe97cbf151c8bec09d965bf670c625892c6301 GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<39tA7go+}_TR;$bLwFbh8l-5eCX!H)JSa&d2&F+$uv!sB z#iEEPe^F3TK~X4(2tg1OG@?RPtXixOY{6=)zkm9j*?V?o!+>$xoo42@%Wt`}^E%)C z?sv~U_s+eOp@kDOCl?k_?T=6Gs6?t!98sE9`;`CqciL$+Z~VtMiQOQ^K#YMH12G0- z48$0SF%V-Q#z2gL7y~f|VhqF>_)!Li7ET;Isdx(d_@U3q(n>yzL4hs}iKc9=*%mt6 z{{L(z>*0GAoA1yfK=eZcqGRzyNBrg^L~Rm?`eGR3r+)VS$Tg3_CVyJMCV#$F=f9@* z^S-6nH?bC;{`mc!8YDTRmW?8HFTVCMwLJ>wX5yYN*18X$TnT|}MnuaqWWPXW%! z!*(a6ld)$SmEcziO~jd<@Vf;2JJWO=D@NLly5L`TY;~bt_`e`*zBJ;OPphdpjx_Pkb{)jF;T)r)+>N!a<^7 zkhH*frH6J+{WOfq^(%2Gl~Usd#?dI8c7rbP9GUHNAY+r^OGGs;)V%`@_q9n$0GcFQ`u;T9x zX|R48<0#aT2(7=wd6}82h9~_ki3Z}1WdP1 z_f7!AlN7f?KroRK;NgHU0!koHD87+iFMAPVVPT)?H=3EL&0krmHnF$fsM zNiXk|fa2z2D+lrr#YAV}jDYy-iCF=<9C>EzD&NV}IL;qTr`CRIgi|3+{R<_dK?~(F zftpeRrQ;~70Jiv>KuP*}`cC|piC<}yimyg_ajmh(*YhsEAwI1tv#UaW(~lyq#7#%3 zBdG4R9au;3!Hz2*`J4`@9Z$$pM`)rP$2o_5=CA0Sd*+U<7`u4H$`||fi92swN^KTG z?mF>-Hr4FZ`NP{ij@@?E(7!BfKjY#v-<*Z&!e^n>rec%ZS^f;UktHSWdWc>GdDzdM za41r4cUf7#EAhiSaRKqsbMOtY2aMN(x_g)gj0HF-)Qd;-rGRiQ#tYTG+8I}-MO--q zY_QYk{2EsSFJH}9F_JTls}m!x&cSv0ssqv#)q!21L`cW^ecReA#ToZAmlu|D$8dZ zmQ!>m5OPI@$TOEu7FgoO&X>~Qloq))W3R;Su^hI_OeK;Kx{~wACDOvM$gY@6VYsrw zu5|`%CE^M{DifMjRGnmen^R-`E5Et=`LJKUV}X@%UIWzJ^q0e>TmX@FL(R#8{}>8% zV+rjGf8v|szpGaz1*lDr#S;%4efA1Cqmvywt`V-yNB&r6AvUJzvSzgAySIH5x51~Q z{!icJI4P=@aQn(trQa@rolu4DJtJ*B$6r={3%lW?LVha^+qL}`lgyt%AeQ~saHJX3 z8YGX%7?}YcLZ1O_adCcic!wMqk4XPwRNvcV$Ei52iPQ-uKgCR$X;^m1$%~#-I8CIJC0SJ^m5dO&Uy^OcV{ORYN5FeN!BWE&tKFSnc*Dz zsR8Bq+ExVaQf5tVeq85Qs{1=u$O`A*#!f~53=oTrC`Ffgt~$^J+z-H4khzxsz}ALY7pSn7x3eeA8N2$;RvVA*4z}Rk zD!Sx|dJtFlQ2U8rTrONc(ojzpC{}t*>GqAC@~NAjU1{NG#iG=Y)hVNOKidU>7Xzyx zb8Y#U{p?f-ll|<8?Lwy$d|D2CS*Q)>zU5SGbKi=`Z@2?F9R4>Hi=E2v4#ag+QM8dg zn-l$|?hjc9qK7+`9==>S#9=*%MbX0&lOE6^mf!*dprH663_eN0< z_gVM{u_$^d4o3P1LFNfPx-UXR!d3QrxL^CrsTxD(t?^gA2%8q+7qo)U}c2F#e9{Rr% zsRu#k2|d)Oc2FN75r1%xD*rpyFNtFLTlJH~qLlw_?-}L4Dw#--d7}L5Yd=YU;4S{3 z679sjN)O*B9vETAAJ~tJ#G;iRD$zy=GS}+CIxa%5mwA`Cbcy0Wx9`T$&hjr76@YNU z?K9U$LFO_3>8^*&{NJbYy>Qx*Mb7ds7JbPSycCMaRY;isb@&Q0kMZ9=G@dQ`|AWf) zIZNB^c9ws!DE{ZBqmk{AAoCdinC@iO|5C+&@67&RILp6SQ~<(>=wFa|jDL)Yn)$z9 z<$K(OS-;+3qkm?<{S}L0;?)N8&;2t&=578TP`N(3uXwhz{EI~^{{3iw1(|pG=W&W< zD*JameB_N6qNabVaUroN{(r^!nm#`9A)Ya{0{?={wfskp3t?V_d0gm0sqN+MPk;G0 zKmB>K{c)i(WwH6iHQToShG^?BPOG(xQ!yq4-UXR!d3VFO5YLDFx%2}$U9R-d=;-%n zI;#h#0|yevWw{M_UrrH54uIy8@-9<0U*#iHn;c(|bl_78&0 z6MCpm)Mh+p{Ud3TQ}{@;5ezQPXwb&HP_i{k%M#~S|c z9rVitnQQqs$45MG^Jn~d&w;5W*Rff4tJg>A+7fpeA-sVcBqnwE?zqg|! z`+ig`Dgfbx>v1l=g3Pr#s*@l6Kb7w%?$~wqb{qX1`}~W=m;9}V1mICNeD&Zrp8*Z? zpO3E~^BDgoKg#`zM-~5#-tD<<*=#5KnPRc>nLYEC&BhF{O`KM1^D$+g$JYg!Yxy_( z(fazlk=M-}H}^AFDLov%Xw6P%^&l2S4?DIPdguU62(p+SqS()j&;$239#eYQf4%l< z^z>lW&lHQIhrB-;dSL$`$ULEk`qa-XHup0hSLJ{FvktrLl)wGCn^C&*XHC;(yz^+Uo49L zM^qX9uNB5w1ewS9Zy!1T;0eWl<*^oRmpjV8SX2PQ3G1KZ5kclL{!Q}_xS#x_%6G|k z7Y?w)f8EAetk%bhMbUrLcMbhB|ANf5{G0m+URxgv)%f-G)jW@gb@Y_d(Ty#4IjkeG zC^}kvFj7Z?ET$uUHQ@htysq{-YyG_dGG52&TBW17#*6NM#728iH-BU`?kg5WNAG_g zsUtz=86A0T+;^(zh~v7am5!d6@Xk#uZRp5;TqhRO@fHsVT3f4nHp%>N52+iyMp5Iydw{}GGAyQIRu zAoCdic%Pw}{})xZ`v&JuS>q`GVlfE_to*+q^BDigtC|0eivO}^qqjffDF0%y8D0&_ z{oh=Lg!SJlgGi8hjDNge%gp~KmFvgv&3@=vNBI|v3P3nv{^vF&5@a6ZA8$l6^Z!Sc z?`7TA?RA!au^1*^Z3zE@%wzm(jTV^s->h<7@sGQ{b(VjzcryM4naB7?cFp{6QQ1Ft zXx~Ze9Q8k9(Te|_&4>h<$M`>d%R=Fw*ZIAqvcKieiFZbif2(zsVzD;=$ymF?>vsg1 zYx$2{SBZ6W=5>`@Rkmw}-KI4R|GksCzi+#4&yTF$uOk-A`%k?sX+F{GBRQ?svcUNx z_zE)D@@{^fU0>(BMy#Xb`uMWa!=t4;6CL?(*Hh0Ai9EM%?}05b&o|z#%74h> zfeq}GzkPo!78QVSBJHyvb8Y!s`(xAlZg_sg4wY|zkIqf)@L#w3XEonXEK2>`c$HEA zh6D{{uI1nCkG(eEPyc&XGQWn?Dy5^-uWEN%^mJr3PfIL{j(X)8I{GF2xFGY4j=VNc zD?D$M+$7-)}-0! zFWcu|EVjftNyZB6g~XzO+ydt9|V~v^iZGr%Z<(b zk~E>aJIET)Gj>H(#Xzd{bb zAb;QJO{IrsGb_Jx)<1|v(ZeSRh91_U%@$-aJw#CtSFcJ6g!RDB3EonAIRC-DUq??5 zR?i8^e9U#gXkrY0Tl(8NYRzEY^aH*|7V z4`NaDa4;=W4}vVFhbZbH;_uIMyYY_FL(e0dI!8|rR&j?|6g@O*Waxq03qj@yJ$Nzh z2+vR8dFAga9i8*q#!@>vs@wRl)jWQ&n1(k?_<>@KLh=K~Iyzu+qabswjw0vr7gJaB zJpT7oZfCVBecKN2_TxRV*l6k__cg(D@t(6dt=8^O!Qa9`{S{=c<=qYAj`}=PiTC(< z*g>U-!mf|LA3Z%-JqHzwqKALf(t{xLgdXbCbI|bL&F1G3hgA6=nsdWpJLO+DKb(QT z2jZg<86z`bGV~cB7Ol#kpMwiB*OtHabI|ED!~7iRPl}F@3U9Qz(CaEL!ou4*Ux;kMUn@ zyx)rZ35Qkon>D%R>*(=s)h`o^wfWzKzCka<1A@%8{73f7@PNpa}1fo@VZs{aNYZneVq|M^6t{ z{W7sAdg%Uoq#gvBC-hJ+`(>f536kCrS@{E;~NPjz6&9FA$3gKse#{;p;d9nQQf6-7gqUCFZ#FQkLW%KA^hG?;a`w>jQ=v~DExCh_>1Cy;@pjw?sPOh5{u#w-~K4l9||(p^6!TD zNM9!{{*conN)Hzu|1`&0J%~lo!<8RL>Oqjj^bp18(%q3Mmhxba?jfoN(NCJKm)r$Xu%j>$n^Fl(>)6FI2wo`nXNp zZb$hSi&7uYJ-c0aT#Wm{g3M$57g3S$&*PI{D*h{G6!wcA|5oF{Vo~^?)HcL_6ZAQ| zK>vcwwfskp2V;J}j0g9^w4|>T?_c(Lf2+a!t>c#YZ&5E==k1T)zBy;p#DjhMzM9*L zy;dq#c@9h`KQ>3TYU%It6%f!JDP(vU(m;wX!?%+`VNiHh}U;a)OW;FQ$Ij4n1$G(n|u)) z!2qSlX-WE-NAxqX&1W+F7V!#xCN_c%C^b;T8z~GwbjD+H#$G;gg@gRocGF!euG8--_V2A za|5v`diYB%JqR*S=%GG6H^}31mvw?)>!nXLXTm?DSpHW17qKYiU$HyV9|$r}lz)Bg zzpy_DkBe{|_cx`7CO7Y{vf~fz_g}=~$@Cz|T&oA`{tNh*_?gqcEB^a8t8tirv6w&& z;PZ{=2HZXuVm^f+^EUs-6#s2bTafr#xc?||^pCfP_Vq6oH+1^l6U|>eHteaYtN(e; zg6Ug@e?jI={?S2W(fJ|19ADc?Y)%gM>v_EPIw_Zx4PGi7R;{lyO4k0{e^0<_yta+9 z*!CAq@(PCm<_u1&wRPxKY-ng8b8WeB+9C{+1=Hm&EV=<#ngJ|q^U9uK`fRF4mV z`{5`9LFQWid3uXE97TeIh{eHh#T=C@WD~jMh+rPkRwN?S% zyEHJ6xt4dc|E#ZZzTUXXa|%w2l^&YU>)zd2J%~lo!}WhO^w1od5M(huMDcm}m=5s8 zq6cpIOOzg3{`tZv>cMIpNGysT_SEtZg3J?os88cSJiM!q194n5Rh56+=UZH8#~;{_ zi^QS=5Kg##V1FRUTwDGpiHi!taS`+XYn5+pa*4zIi^c9l-5UeNoeGKYFUY*czwz9d zTp>xu+lb0>$-w|Z4<=qW&sh@^Wp2Q)XmWAX%E6+s9%`u(^7X9e-dyE)|P-qw%HVphSs7rF{@&t}XwQ#HA$>ap`o$|ECpw z?s1lXv8Vuq6X9Qwd5wP~E@k~!sC?i4|CPs_YF1vE69e-fIeHM!fKsb^1L6Et&{7=$9FrMc#|Fc!T-+O=2zO^>mXZ!q% zMX7&dIvDkj{jnhP82?y8A@LEXzg7Gn+LN^XX-D}Ni>vo+yy%N@Pmf%FXZ{u6%vtB$$mVa~qfae9a#5c6G3-6%B7B2&vjBreU z7ZrX@)|YqjA~0U!#Y@8qF=&>DUj^8@25XR}QxE*=iiKqQdVHFJBY3|l$hBHdX5SWJ zg%mGAGjL`BM>+QJA~yY#PrelMyucfkj@~*w`&~Oavfqx0#gpkskhxYz)^S844HZAi z&tGp+{NLa2(vPFZzt!_su~@quTZI^+6~_4mnQQrveEy0jZnAEa`_pq3@2j`n*kno;V#UYJj`Vh5+y+IVoDjQ3{>GS~8M_Mi22ULda!jd=cgv(m!@8_&sb zRu5uP^l;!+Ll48T{zQ<)^bpPQl~Odx=I5`sC_P+@)%4NRgVp$oSQI@Bt1|S!{y~s= zLJ#$Jd}W?0|8raBpJAu`?Z-u8Q2_`i+&;X6_*#&;w*0N*BGf;Li#VOH@_qD@0*Cn* zi(%r`2J_GUSde**|013Lcr8c+(S4apm!oTgm+jIhbZGMRH)c4q?kp*#*At5o4~hS) z_#o2%-6{oxw^i^bzA66G|L$j-9*ZX)IQr~y$Y&J#L6NWN=vb?7)DiEJsNIL_NICk; zJ_^xqn>PQ-uKgCR$X;^m1$%~#-I8CIJC0R0F2}t)`CSxv4}r(m Jo#}tS>fbarfr|hD literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx new file mode 100644 index 0000000000000000000000000000000000000000..eb53aad92c81cd2722ab1e4f4e45ffe27a52997c GIT binary patch literal 69632 zcmeHQ3wRXO+5Tp;S(1=!!Zlt1p`r+K7Z6155H5y*1S#68M3NLF7n+L%p)@E8Rw{x~ zu_z*yUldeSP!tLxLJ$N6ji^u*s}}18ELio|=geZl2AVotd5Q zJ@0wXcfNDxoY`S{xoK1La;WCZqjr=d)hLE2MXPzrzx_Gotm-%a?TbV&5M?0BK$L+f z15pN|3`7}-G7x1T%0QHXC<9Rjq73{b1H{Q~lPj+Y zoNfO<+gW(B*+=FpwDb}E*nsF{EYUHq`3OUOp zSNnP2GVIH(foA|df2RgX&Z%J|UtNp8`?%U3jdRm*&6jFihtK&>y{f=nZLbRz)|$sV zbU>NL^B7Oyl~LLEmDd+kX~~*KiP{|#mV4!!y#3KTw`Fe5J=C|~Ym-{9Lr(atL5=89 zY;p$q^-^Li4WpYVhYF|!pXcN4yHOq7oE%GKluvm$Sd0U)T2GpS(@JPMT}EB-S4@+! zCkN+bVY@TZsn}CQh4@rRxj3^kJ{Mwt7n*@%1xUM7SN!$BR#)nc|2aYP#UY+53F@?|V5$JeJpP8{^`eYh;e$v# zdtWT2<3uj2JpCl%lRVS{A6h7#4x8nr@p@TI(@*iRL5*7D16KilJ=MxbV^DxxEKCub z)A&lU)D|D4=G^#399@CKGf{4Z;4vG#^Qp1a%nRDb;=^Kf#lCkngwd%wr$caR4ghcw zW#b&39j0&5Mv=7oD;G#1Gkw-V+3tY;bv0VrnS@B#J zgMmSu^oq`LC~hvcQXmgdOmrU3@QJ_9P504N$TM44`A(!JF=-%v6d zv_LN7s2RmkBOFB)z!tybC_z6@--&-|_>@A)cxzM{(*}Dyy(;*Ec(pD+vGV99_M2W5 zaXBuUu8yF(*K}Z=zy~|7Y~*tWpmsVfPo1ENQXJnX3y6=l#M{RnFcwv8G|0}^%daTt2|Y<5nv1W!y2iQ2H{wIS zk%=5;lP5`|CVc)S>ii3g^ZmL5Dgp~RFfWBGKG&1v30S&ReUmLJY$+k%916a%Jpz?q3syMb=h6>1=rZ^j0`*;C=v9a(_GWGKMun+8f>0A(Nb-HVMp zHmdPm>s&SneBYAYP}}KX={I;6p!#sRplWcrbW@hkH!LUVZYJRD@{ngPpLDRx&8a6T z9u~c*LTJZOVOmfVItOW@+BSdY%7-$9FUX*NP<}Q_iOVQ(r6OH)?4~=aGeiN!*fSLS z`i1xp*=KkWv_t%gZH9l>txoV!+nyD<2ai8@N+allU1SMe5A+;ll)`ykg6hy6bu=BG zY8dd0r`oP?HQZip$N1{C=f!;Wc8}pQcy;1`<*SRo<#;Smq5I5C*}(CamEXc{_^5#2 zO2Kwbzr_^uYcQx~zcm7BDzyRCBU4AE0$t!WkS$hZR|R*-fr*IpFGn@LQ+Avwr*-ji zBT=p#B^7~jR!xrX`8e3i!(Y*YYr6GcvNB`o9hdAKK7MODr!dGV} z6=7G^JLg3NFZz0`m*J?+Ygs(Vp6_Hg_=0#q(kxtzQBkj}=>V~MKJI*LWpp}DtGeItUj+)&C`?jb? zOWhehAqzgD05+!Rg3&*-eppAWr#~tkO&XFAe=kb$=jzCQJr;{rI!Z)67G#dqk##*r zy_R~s0{q{l_@6&D>%;Kz-$$>G&RhOWv)bOOB`qb9E22YWT$E!u2Bs^<-cPSOuA5%g5|zr$dJ@Ry=;g z9mo;zzkvwpOn!F|zBe638``ru-CyedkaZw>xLfJr%f&+@tOv0udRS`G!#qS_f-I_s zFzSIzUlTpB+gz;lFk#aDVbsF|7XCpjiXIC5q5eUTxk3-wKf^x+M!&e@Ux4?S-b3<7>u9F z&`#f@a(yDHGUooU#jnX0@sn6A|K|h!N}-4a-@GvKOQ1 ztMo8!=Y476(}PtzC>BKz1KthQgCKK-9_mv&sE?3{Ke$ho|6LoFhOzvu`blC@%Ky&y zjq+ceNF>NyQU3L{pQPXL7JpEVcH(}ehach(jy`3dJ@ThB@{79 zAz}X4<1NTs#(#&vc(&;OPb$|JENj0fviyrh@jtg74{eVGnalXcbSJa^mnr`Hqz(8Y zviyrh1t6G+{so!K_{W&2ng0h>z9&qc{o9Q;`e*jrU$Gb@UTrY{+&>d!?&kj?mFwgC z3+6lPm!wU{p;7RCQ1k2n0^yXcn*GRN|7j*ocW<}dKJKbP{%^9I5_Z!@rns|0hI zcwT9qE}9(kyv`+ig`DgeQR>+vMK1({=YR3|_BKPul(-nIMu9X9$o z_W2i!FMHbz^}(ZT{OaLvJ_8!&KO1jB<}&_Gew6zak175ezt?N~@;Q<0XNtx0XZOxu zJ_j?vHgj5~Ex?q09$yz^j^*F%N9*hTMtwbuxu3aO>EY;QYj;If4`NaDuyd=ShmO#M zAdBiDjQz|IJ#c^Haixa?H)*ehPY+i8OtC0>$oh++2lfww%oTd5PyNgSb3gM5RsN?w z>$uxa`P*-w#bRycFUTBQ{?_qPjrj*_6#spOAKepK{>5TnEb%t?Go^hNWG>^M4nHIP zOitG-{`Vi7UH!0)_{hHg#iHncWToN%T4S6=khzTi4x#f8o>csopKRG~MMU`*iwZz6 zVf}MFBFJ3EziIvf_miJe`7ZqK(t&pPuiH3_)%sYmDEe>qo}qu{UywPLe{=u9ZR=y9 z8n3>-n&%O*j-FOJx~0|b2FCMH@7}t~hK}sVbz-p* zp5g&P>&s^u49684n;OU*t0U`v4W7?oj;o(l{O=yT>fXrmFBTPm)A$!;F5@51y)pCu zoXURJBj1r{G+y;`CqTHJ$lS}jUS7s{}GGAyQI>u7i8|{e}l^Q zvenBzi!A?QQFxb>`JWB{FUZ`@|MM!_`v*Slc|4-}4_YKVsthP5DJ0^51eweDM_h0A zKQE|UcOA4lJ+l0ZMFk)@e?{~!$Xv!hp8II#f1}F&y*oE4*c!ZvasQ(d*!n>rxzaVoN|9GCEng5qmw)^?#O5Sf5Lo$tLFO|4 zkykVSn-u>g&ByF`HlqBC#pZZODEEISDI~1_)~Q5-%w_!J`C4ZFH>+Gfaeu}m&qb7f zv8Vt96Xt(jGa^CeGXC*IG&BEyQTblpef_@3@-G&H#H$VAUy!+sf35K%GyhvuuFL*) z&$p4~Uo6(fzaVoN|H!VH|E((f7Y^$;Wqm~bk65(ge^+xNLFO|4kKVpm_~&(gFRSct z{agIq;p5+GU8Pv8$$ui&?(q5@LFQQgL)TSe9i4eyfv{44THaTQupU=*X{n1 z)$?`4V(EbCcP1<#dSeu)Ra!bYe-v*)=2+g%_p|HkeAke5bX*@_QF?f+cvp-aJ=nhw zBo>ExXgHQM2k&gM9wy=~$Q-K&>-#{abyPg>c)Q|%{^8GU@o&FAibbi97mqdS<3!B= z7i5m*-wE|mfBwJBKj-e?t4a@jIwX1R)W^E%!D_y-SQI_vryF`;|18K{p@(d$`*Wg0 zpY3|)`5~d_*6lg4h35IjJ5>1(tr*n6PWjvS$6`?d2qw}#3o^%+zqLO$J@1C+N93)(K;~Hf&HmVJ^ZoSSvy%BWoK`9woqcWlv%;q% zt9e>tQFPQh%h1uU;l~A;Yjotcd0N4Fqa2^_QaakUBBPZZ9ocUW#A2`^P#fGHus;%H zj@6NMdw^WZI0dJ#sa#Ji9lSQhMt|8p|6;KfW)j1p1n(0_|45LzjQ=$ChhzryAj4KjvwH(N?QT#zl#2mAagAL=JvS0j#to-0q-SC z|A^B)N)HDcOhN zEEYu%e|XE#1N#R-<_bO3r~YyibANfSD*roo%zwd-Kd|3Ei$$yQ-wb66GRKy`b$m2x z>s)D{Io+rD|I^sGi8eYxgB~_<$K=Nlb_q+-+p{57RCQ8`aZP%5oC_#-wE+) zF`iSJDe(xW`;{Il?wI{$Wc45xMGxm`p9cFY#}JPQvZx-y7@x8phM4tmKA~tgfmjqh{5c_14}#1UdT`@&JPYN16Z@AcrK9Ny zr#d#Z(GRd6hl)kf(E-1qBkqR@GFRxRzK)afZ&eqX+nINi9v)l1vr}aCAQnXrN0SXb zaKBKHMfDKIcIGra98`L^Zu`xhBdZ6oD0(=Q5~>G57S%%-^$_y=^W1K{tMt(8*yb+b z(}PvqAr?gsjT;+!;Pyh0xk3+aj5~t!6L?Pb@Z`{^$cuabLXGY)-4R z2b1tyIHu_NKrgVlXdu_$`@R}DP~GFRxKKHUcm z{%$tkk2tK#|M1+KkJ>5!y7}Q${2qvhMy8HRg~`Bcpjfmjf4&bc$Q)b#*7reY&`k4v zpuZ|QKFYhr7XSABu~-!TyUsQI@kaP$LFQQgo#2o0bQ7ch&AK?E^zg^*v@e?37>}`E zAH|{q5KN?f7G#dqgLQp0&EseOKT!Fu+_LhD)QIvg7K6mA4d$Qgqabq`|A@iGA9DJk z%JuMepKpjP|6zvAzftdm;FuY;n^RyWrR-;R{b)uD0=AeMyMVHnJe^AFZ*SzgO64DZ~fm_!dU)R z>lehLl>bxvjq=ZqH;}oa{Ojv|Ir5>uEdGGwqED0__KrI>){Z~0-!Bl03P3R7_TfZ~ zfy}Xbu%5$Ck>y`3K0x#Ugb;l0r|>VxT*iM1brSx$9{gSLpF3~U zmAfJuABjcrhwpq8>JJ5(WBGSNe59|F7Jta;F{OvgPJNmgSv`nF(Ze+#hw4F)MfDKI z`_kR1gvvw@d|&!ArHA*6*G~wa9<1(5i$&4HhEGEEAjn*y2Up*hW8Ra^%);>L z$SUp@i=v~!$3k@^$XubLdK-67Livkd;rQcorH4KbE==ETBkr&tcZ)>@AeeC6w-C=# z5M++kgLT}Ed`jHM=@%;B_k7$oW=}-<7mHFKFFe0}a9oW0!Gg?X{O41?@XzCuUn>5~ zX6E$|AOBY4!D3PPpVBVCe^c~1yF&kh%(483jt66Yzl;a>#ex&0Z@Rt2_raA}=;a<6Vr4_-@2Ttk#pJAY>}RuQpwV zC;E56p~={jL-~}2?aoN2Vowq26F?~!XLiQtLhSECGjOZ`X?LuZ?Mgkc)s=eVe-7cH zgg8=yE0{ldwCd{F(9U={&DeJ)^}gHmgZG_4;t{C?7W6L}+cwYSq<)anUs15v#SJU(!g*piZE+8;zmC zAUYjsAEZNQ913Cv<JQT}hZ0C{WV-YT-=i^yy_!Fr~jMv|Y+IV%wK>+a^ z%&0eE=36to8&L|`zi%MQ?Dt}P#va@^7_f`eDy<@pXbSif1v|EWI-y^jM~T{G_7}WP z48=>wk??E6!}DJ~-EXky{}Xz!x^EyBMGt?kp$9?c3O&@P`vzHD?y^qsgkJhYb0>cv z#`3r7zlcRC|FS)y{y>nqqWtS?|AqZQa9o7rxUZESn%=gj(vCl{-+vK{wdp~SIaUwW z{TJ{r@iV9YRQwNUUL9fn#bO*afX_GX8*uxahxrtO%-#H-RQ$I+Yf=2`!TzJf(LdcD z+Sk8W+}QaKPqujNd*YkMojZ!YF z8oZo0yh>kZl&Jlue^0<_ytb{f*zQ+Nv+{-m=1fkjwDss!Y;0&Cb8NYA+&CT`w=JuLFQQgd3`|E#ZZzTUXXeF{zslpb2l@6jW&dJv1E zhnxOl=%EEPA;_Y72;=?mu^r)yMGxHa7b-op`rD;p)PvPHkXRHw?5*J+1eq)JP@l$u zcz9PI2jaMBx+?#6FSNYWjz6#;7l}m$AeeCb!2UpxIkx<3iHmZAaS`+XTa|BZYGH)= z7mGcJdNcuwyA=}QUy!+tf8)L}$E8Io*V{k*YQqUfP=uAzrVp$S12)k7HL(kv9eNA$q)NvYDqkCQG9 zqaLi{Qn4s{DEqyk2lfww%oTd5PjPAR{v^jmH>vV}aZA+_JO03aTq+jvMB^(bK#3BE zO8X$l99#ai#HEEHap?@j|EFbr?~5$|Vo?DICc?iUa~uCgT*~?{Q~6%_f8{45%fDEh zcL6=Z`k$nbF#kNKPLR2c|Kbq+&s4d7tLW{FwKn2Y`~F8PO8axs^3e82khzTi`&Rs# zbuaT%ZdUw1v43sF(>D0GKW;4+*EM@N^(piZ@>_FSrEP}(JEC7E$Q;YR6Z!{q_b0|U zCC7!clpg-Kjelum^&l2S4qSU{!9gX_O{#cN?jDIYlkobtx-z)wP?@ie8Ohow? zi);37y6lSy&x~4eclOoa%wP2j*8j(N3o@7S55CR(mn;6C*8cJ0a}niVEH=Ta4FpEP z{+aME$lS|6&+D42_^+PVev2Lc>()Q`E1pN{rT(e?P0u40i{gKF+-&$C*1sTgEdS>I z0nZC;g?C_S7oI_hEnWsT72%lvEGm4OsxR;2MPR(dia#(Q>j zWWOB~i?!)UkU3UI)^S8U4HG}g_g`;S{6E{fQup>LHxtE5&G%&G%n#S9-Vs ztLek12dnWFu_$^NUTNro{evKLg&ykd_{w}${uj2&KF3b^+mDOHq5=?1xP5pR@wFgx zZ24QqMW}xg7je2k<@@**IT7YxECz{J8_YlZV?pLN{_}PIV>LewLic4lU4^a<9=1!P z(V@xKpO_Jub!Q1ly`QW=JS6_F?1NDMcZU=Vo>sxH*k<^r|L$koo)x(Vk3V+`@)?bO zQ0QYiI@RbKb;7eGYWCqeQKtT|k396-iWXect^bmh8B6cDWbg3tTeItO#qr9S+13s$ZE{^@sS@7b9R1IB50nwj4&zva%(&d&Mn zcfWh?xv$Bfg8Yn$1$k8c6 z|7_=#woMAncW4?Q`l$}lv3Q~*e)Bg(Efa`(VHo0+netoB|e_fsD zbBl2<#$`diHv4T=Uh)318K(9zBXf z&LF>DN{**NbR*?a5tZTd9J~WJs4q99##1>JQUSg!#TW5fSDJv!%4jlOOdasAl*Z#s z9-UrB zGTb5ulubnTC+ZNGx}cu|zF-^${90W)8z)5RrzO^*G3v63V5$h;`GR%H??)Lo!v~Rg z?w)wc#D!c|1^PwA7x}0OJ~UA}9W>ofqxG_wq+jA=gBmr*2d)DAda7A~MxX$>SePO< zr}3TQsU<#0&AH)?1iBPoPeZvCgU4L(&X>khBR^;#i4XJD9edtY7e*)QoDRUHc>usg zl#6S0dbk#`rY@PD6j6fmBhV9|dU0A3)MEIOjJOmN+oNzphRjGp%=>~#l*CwW#gD`x zEc-`Y8lYdsI0|$mLhIGIE+a$L@T6~&s2}cF2H>ogGUPOL-(Vd|4X{(-V(+@O9Dh*X>@uAzsZZuG`u3751Bc z6mbP^nx(!$b+7Kg+JO&tT)D{SR6uQaLY~?|6I1X#=a8@bHJy9k?9t_;7Y<$iQtzH| z=Wj`=&O*pt_Z-zAUK#;De){vuYcjt%*yM*zhyGrI>cUr{)ber2?JU0r-prB`cRf%q zf*hP@PuL47x4W#Y-xvGgow$Jb+opI2*aOC+iVX+Zg?jmwggv1z1w?c4wO02y)A&VV z#4oau!(8&EXw-nOzffI&u5o=(cR(dzArI!IaK-2PQhXsx7pY&eMTIRb;+F%#H#aNH zsPXH#Q{ZIBCw2v={}ed0QEJ!I4Z1=Nr1H!7&@a0xoVp_mahM7PSpCvK83>{5p?-UT zk;i(~eruh}I-%cNvKwhT6D<82?;=zmE*De{E|*Tq@;Qd(6y42)oLvF(%;l2_cDXtA zr6j_lA5{qL7%EH?YCvZoO;*R|&s_OXhVTVh)C3|! z6P{`i@QkLD-Qh~Oy_0>%cRzVv%y)0~7;b}CJN~a?Md^1OkA*69k7;RZIsUTpTR06L z74lnYIIixum|}kQ2es_Ch9FI+7NB})`ml7M3%&ZX#f7<*;S=)3SVa1lpc>yHCr*{q zns~XPC|8b>O29a)CQtW#9PAa~U&-97I`v+#ENjv27w#TBdQ)yq?l@X`(#xUM4tfm2 zcV{ORYN5FeN!H5m%w5m`nc*DzsSaiPT2&BLb)yQL;rMq5sJv6FN?q}(6QYvNxS||^Rvykx1G(%us&^Oc z+oEbMb$j@P9QcSL*qERTM*qzEVI8ra{-AU;Za`Avy(qixwkhxYz z*7X?mTI%sq@PC)$f6m0552MF_54|2wfY{in=&!zFu|B2fQXi+jXbA56;w{Kr%YR^V z-OLMBSj)#*<7bUt`BwAwM|TCA@@W-aazx#qt9z(b!zV5mt{-WrC-W35T_<(^)=v4< z%+D^j@Uvo3>c`5I5xSr42*3-0Rgk&1e9V4!GK9%~_QZCf{RuuT8@?>m26NwXGLE@# z#p5^JfgA$=8;X!l<#+qxcau@Hkv*Fe{iW^?SqGwryOkckoIlWEJ%~lo!y=O&W+MU< zWHCKNQ4d`Dn&^Su=6t1xG2`x!q8=Ww@DE~9^iULx^bdl}6MD$~1^yv4`o$gpBD_x> ze??x)arw{tgmzr+5?esk=*I%b>kGnr=@oTC@{3I4D{_#MsDNw}RZ(kVuCD5cHc3J~}EXZ8Tzd3$_ z;E9-TX$Kc7-k%@lANaft-tEUlVzKcas{ed0W`p)~TB(&K5xolD1(|DkcSBr6)6>^o zV{QlUReG4T?Y@lY>A|WU6pNyVKJP~AL6CVu54EWs)JI6fAKa(P|E{%*qFDY`{Uos{ z<$uTfM)|KuCK6~>XN&&-sB(So;?}#I7paKsXWo3o?)Kk1ECKxNGyu~Uv`0}k57DvIi}{| zUy!+$|HyG6tcx&@3q35geM+0tU-|7XpHH?wE>xy0Ho2r~%jVw_Z63^NrFKaw#)QDT zAagD6ZWtHh^^jLcKakU55qjWxlSh;u zR?KVLBzk(V8YdKsqKBd(h91~I2r^ITp*D>ZjyKPjEmP&c{STX)*(rbfaj95T0Ky5k z59|*FnQP16dRz$Yv$*i2WBfz>!auLOdsOlN z{+sdTcKEMZe011iy?|I0|Cc)2@PF^3Una<0%fC53;&q#6<86N}<*C;VM0?$4XcJc% z)-v(B(gIyHdFFMS%ax9@^PBx>M@RPks9010!U@;oad-wKfWAI99zT%q)E_~KPNoYjL^6g_O)WayzS zG$F`hdWd2_GeQsC-*{Za+ZIw*b`g4&HYSip9Pu6_@{%< zNI#R)Rf_+;M`lz#Y$HChuYa*9`X9R8@PExQ&LYS>#($g0^#@NX{wt0(ZMD=<{>7pK z5KdVC9FGVxkMVC>f583Zr&PX+zrU!j9sX-J&SJGcRxFDC8@*@fpZOPLuI1m{Kk(ZA zSg6LY@2}={M69Eym5y$1w$ou9iAB-T!UK^y5@azQ>AL~{x8rry_gU-D1(5MNPFE`( z#Wh&);G;I$gPQpxt8rhkC^|ayd8Cd6nP+t5wQ=9cq9cy$o>4k_a{RluEVrQ}`*EFE ztcRy~K+yX3Sq8&##kz(DGS}+Jx?h9mbC~1mXBGcD`!B!OS^mYM0&oKVg3M$5`Hvel? zwimBh{F$@-i$&pGQs#dK{J$XcHviA7Z13&+wC{08^&hrKcvKlsj8jO&{|GXV@sGIP z?0;TRx$f9+XQs3Ki$w(>ynaRWFUUN`Kc4$&=6{{a{=M7QZFH7@u_*jYD*6{>9^)Sm ziZk>7qRRH$FFZm|IO>1IqVO)M@Grgm zi$w(>oG|~h8xaXIkMWNuqM7;sv'&TIBK%fDC*6R!@0e?jIk{NOYzgRpO|ANe8{3E+&{x_-YpEs!2gf))(AF*h~|Bl8)g3M$5AHHqA@X!1FURK%P z^w-3@qsPD1zDluJo&RL)-QoQ^g3Pu2NA9b{K05Qh%FQaW2T`NzI?PU95e!%dayqa zBo+txXfU=khi5if4`cBbWUkeN^*oSi9~G}V-lF)QbMSLp{M)aOVo~bj1tX36I2P;w z1(|F4cSC*DpZ_oG&$&DJs?tM`HYt8P^|5Apuv%{{7DW$*nT8(NKMOKX=pmPC{+#H@ zXS<$yeMscBHG2+hv3b4mR#pB37xt@Tr~K{vW3i|JgcE6>1(|Eh-`XFWo_E9RBeto0 z`@42%WQYHn)jzBCeqvGT-}-Be`Zq9WAagDMW`FFp^?v%_vy$~SoNiY-I{li~r$tXk zR_nCHqUfl5j-jKg;l~A;XLRJXbz0$dqa2^_P&(SYG^?2%9ocUW#A3K1PzT%|us;%H zuGNusdw^WZI0dJ#sa%hp(tlN&jsCKI{>5T5tR#j*3C|Nq|45K|jQ=$rfmBpw;skTj_%{MQdZin7f`JTP$*yncmw;!L1Me#rLeu!*;1et63cSC$y ziszJOOFY8qUZsbHx6k;}Sv`nF(ZgBVr{Vs}5yT^cET)Gj#;2@@0cJhyQ+l|2`cjAW zAQnXr)8iubAjo2Rh@u`)`uHp4@C)+yjowmvXgs~*D`)+KSQI^cl3?gzHQH=J7Slr% z^>FQqq(E2?JWuep(!&K0@A*1o_U@t?FWPJM)gx!(&UfwR2VvVo~&PIMvVt z_X`DCOb=0PXHL+=ex-+Nx7^g;Sv`nF(ZhkXNIeL$m>#02hlsyF&+W#$N)O$RZ0Ha@ zJy^vZVo~%^zrLXdZZ8CxC-mUOxFftif!CG4r*w4g>+4JH=%{AnzgFw`#bO$sEa3-= zkqXIA80%<@&5eT0wK|Gi$6rL9%)M#Ngr&IsH)O zdT^`H*E-9;ShV7Q4fq#i9^=2rc)k_)6Ar8FH*R>_*U{tOs$V7+tMk7BeS_|Z2LzdG z`H$?EVS>-xFZ)PkyL98eOSjwbJNDxMu{dVy`RUuyFDu!@X{FW|ec_+bLl9)H<=qW& zKp~zXU1IK+{Z;AV*&jD&MNbb_{W7sAdg$^-q#gvBC-hJ&`(>>)e^lCcoN-Y;DaX0cQaUZ8&sC?h^am%<}j`A-Sr9Pf_PV4Zv825t(naB7qq(b4J$0xs3{FhHF z=p8-&t;U1JqVPYVRfzwF=yP_2{soz9`HvhA#`=C45AKd-Nna`6zwCKvv%&lAW0v@D zQx96_-K_N=RP-O8L05Jw6xXd5{r zfyMlVp8~#M90mMZU4p}-JviwL)+N6mH|7)H=_lY`{hCid(FCmdfP4aej=V4`2mW-%*P4cKM86Wpd?mwg8n57I;2>CsQUis2kizgo zS3E9P?BOpGC?Rl+4-zRMPD|5o+BCob(@67cRaO0Q(+oZluQj17Xeeb-J5bw+Mo@nc zor$yu(g8FI1u>Nh=z36{qZdm7ie)^G3rO-Y4>!{D@hlF4$ z@zPNw{2KG{oL5iu8!Y<&h90cu4aB18;cwOSAjmwShuSo6ki+FJ`vkw%OP^@g_#dKJ z{#N}Lu_)zVzAMrn2r^HUe{Jo*us;Zoi*OwGjnYHITX$`@;}7ijU&P|c^dQJws|V}; z3;37#nbUtL{`)kpa+rUym_T*l^No1}Zl4RVolnyf%e&cs*48**Z(L=bg3}_UhbD8nba7S>Vo~&P zJMV*Y=l@~urQc9?&$ z*oCM|1E9EDArbxsnb-I?=8ZWnEm67N^5JKLqo;qXxKu2Th@(u*QPEO`BpK5|=VPQ^ zkhzxsYH?{^L|n>Kj{JJ4`S?3mIvSUX#Sf-T8MP8|>8_caR%!#eF95$I$Xv_28{$$w z4Wt~2LpUu9$$^%ipEl1~J%~lo!}eK*9v+1z1X)ZEQH)D-Q2aj81IH&*lpcN>cTp7e zU=^2&MbSg~?+iV#e-LDz&_ivCOT+V%92ecF%KycUl?&|n1N(8QSi}>JFB=0TN*pTf zgCKKl`JW^%Eslswrz-wGE$?}sv;2!i1t6RV|ANeG{2Os8>%Uy(`_BKbIOZ(>VsZAl z^a$&JoI=9<^O`zA<~9CHBlJH_<@&9Xx3gB+h)?bNAF(Ly&-qIt+aE#ZG5+scdNu1_ z)~DR0_7bdWOOEvf&KPbEGhuuMA`>I=GyWW4r~K$M^@|X8tP_|4(awfAKj-`4@`~uxkT>QMi95 z{0lPg^3UtKW-0!wX1CsGhyR-O5B`GZk@~53dT-P7NX4S~pRG3;{)hE1$Xv_6xqrax z0-NC-+S-L@P~wQUflWj>ray}cpC;gRK6S!I zGJQWjO~W^MzA4DH+D>NQ7GZ}JZ$UF~W&+0)oZ(Gu`YV@wDdu&7H!B^zeR|e=c64OF z9TSTu(~%%^t&XhYh(sDBew625Z&Ca|*!!}NqsPD1{Hs{3-j1z64AC6p{DRE2{725e zV#ZDOjdFi_w&H!|mYW+c$c@&zYODP}VsY)dtQPZgiI#2Sv{D-j&Xe){OhM*a-p&5A zwyq209ikEQueT~aJhcAYbZ7M-7DW&HUo-SD1p7|}SxgVn9A7C#lWd-Uy-n%idhDi; zo*t~mSHz;|VeocC59}WVnJ4s6YsXjSsPaFrS?(Ej%HMumBo-BbaKi1wyNIs^nQP16 zIxa%}lemb}xhmgBFU@n9f3X-QUL7$1?2iSR*Z42g`H$Cv)DPX4$#gloHh9=B4M&G2 zSASxLGyBexQo2965b==szw!?v{on0UFnC%8zv3I=KmG51w(PnvfB(_vjzd1f(GQAz zOh>zFeWP}GmPGYFTsz9vANEmzep|`ht2*^wuq7YdC)v02&F+$pjr_` z#iEE*t|+LepiwADk+-0r5f!Rp)k1w>3s!se-rRqk*=y!ZIB0s>IXCBgGkn87b6)G; z|Ni&dYwxr7$%w*&^eKh;RQKaiJF1Xs6hoAv)jj3k{+)78?Hm90O`eB&Kj`-r}8M06^a=(yK-gs5E{(EtoX{Hvb>KXT0zu*sj+u*siq)cLQe z{k(5E_7&8@GYG%GRf8nw)v-~e?#0(Wp|;21+;rUYW&T~6KbuZ$*PPd?7c#dcSu zQ?RF$O7N?M3UFpu{4T-%ZZreOijnrD?)cXWTivNI{?8AZFAMwS(Q0c?qpYOdO2+#r zn`Yw9<+?=(d`NBWwZJ7M`nOqeG)}jEGi>GItWq59gKxTs@yh$Wlm)OwI7sC8ljfVK z^w6<|molhAzY>R%DLH0H42{8Qx2Q9|&TV8MYZMK~u@3n9SaN)uj_)PVRk%eiD4T-p zPthSTb$&1TJpLH+d9}v$6YLPBpA+ARCaBY~}^Y|N+*NZZ4gC8RCyaTb6i4(c3 z3iXqSPx4SJ{Ai_gI%1ZW#_MG4Hi9X0&pT1T>s)Yov0#6fx!jp ziYHcUMLz|EEb4+P+5<`%iVB;Fv>(!8;G!!8QAju80xspQ*e(H$tavVqp}-(cdS%x* z6gL-J1&{|QCb|G;_{3iqWcuhDIkZP zT?f_$e6ZunLq2B!YL_$e)CHQTz;VtYpZN=FfB(GkmE)I=TK)3C{xKJCPpZp8z+F%H z_5vR}dUn~oJ^!tqH!Q4}yn9>u$f+sV$7i9`yx8P+mOsO9Wl4#<90kNHRlo{J?TDI`g{Tbu8=GCWujaN198nD()Z>!inu$Tj$oPABAR(V(6 zl4gx{L&V$Lwq#xV#FdLO{->tTTJ}P!_HgSz6bQJ6ur8<8)#V7>o0%%r-66M#Tnie3 zZ)6y*r4eO&I#glv9sK6_s|x9z_|2cHHD%u{&6D`6-^`SaT$#=M7Ivcm1AZ$7+jadG z7bt&*!Yuo(kw{aiEeds1>gZI4qJIX9McES}{SGwwlfO)7-X z;rN4455`xJIhKFlw#J#4s<4)~vnI_QzxK_vO(*yHTk~$! zK5|5@w~v7~8^5?*xO_MSU8Gp)J+0^0R?4S-es;BqpB0NzKh`FV)%|RD0A32Lg3Phy zWAwArAx!qOXST~-&+uv4@MVEEnERH~vCVxe9>3uZYVZes>72n~tIl@7bK` zFZFRH)`95Z9;Jsb77w>s4`NaDu*{%`dGSPoEUJeH>VZpN6FsooT&(mkA?JYz>fu2X z{~#7c55@j){~*X*p@+PG!9N5>zqsRHjPDP}U*YF+f9uD6LKiM~iJz9J@_%mYSKnG` zAFTI-#NzpS#}_>@g@oIOM6?fr%(3Nf9zSV=gYi=(+Ua{$uD?p!74tyE;@4!8_(?2Q z{r$lK6;Q;2uV0+_1<<4*cG>`cEXW+ozcGG-;E9-TX$O}o-d`B)9sYs^-mS+)VzK1` zYWhMR(Xzvw)@bDkM6ZH(LFQQAoe&q%tkmkC8{5JAlpdz-ygxm1dN6AT#iHn8&^zIJ z5M-{v54-G}A*B+6Y1BSUs4>Md7pK5KOpz z=K3heT*g1$`>2us2UWfommXhYFaKiElSuxnpokoWg!$iquOM?7|DDhSGU)$zD%b6o zcid+$|6)=6&uu5e+ap2dGX62$$;kh5#ecu_L7&^pzgScNf{Ex~khzS1jENfge@Nwf z!lc>1thUfUv)=xS#USx&gZbzFnILmF{|~ENpFCJR$6o%$q8a~Qw7-JPz5Mey#R`@E zdw+lYjh7;(f3tBRu_*q3)g_ufKJg(QDW`#dLFQQg!^ed%FTyx3^oZ2&4K$)idSYZi5G6*)bajT4GR(L?dbkRI4S2r^gb zp&^YEPBK0(Tcyf>*KfDAu~Pol<5IDx00a|mAJ`uVGRKy``M40;XJfzM_bT6q501XT zUjD^mI;N&0Knu=S5dH<3%lL=*g@2xR_n6}Uy*FYjt?*yJ_~@9)d;zg2{x5la$p5{A zewiS1EdR#%i05to1YhfODSvq0K&0nw1{QIZV=fcVD=pMTlW&~2xmxKcyP(Z?R&-?D zkBUVFAeeAH&cRoZIaWvY@}vKy^8M7^doSE!p`T-&f3f(Ax9xBrJWBPKk9>UsXqf*z zdrSQI_v{vo6X_78&06?$k${mf!xKl4dd{-;lL-fN}&t+&r&@oeQU$Q)b#=J8RT z`3Gwi|NSzK?X#DEvDhC=yp8=#X`cm|%lN0G&q_a&({+mfgU4srK4Kw0vaWxzDEc3@ zE9C#uFwP>#T*iN=@c9Q%DgLWYweGOeR{q7J0uW4C{~V79GMDjhn18_iOTN8q zuoeF6H_l?VK2|J>{#(2o(m(Sr$Q;YRv47yU^|4TmS6^Sv^XOPd&nO+;+GelKIueVb zqoqf}btK55I?`7I{{N2G)m>+;zZXEp>o{GnbQIHU$wQA>Xb#iHow{m;U6 zB*=u?BBPudW*gMi$&pIQqjL4a~c150icopmsGajdhtvsg1WBCtXSBZ6W#&wn3RCa4K?$jCw|K3Uc-?v@A=SODm*Aa^qgQnk^uz=|G(VW(3 znc(~}ds^UV*bA%b1eT(sE_*l|7HF;cL!fp zdg#|F$!n!P)=v*+^Nq!#=%FYxqzCrTg3J|q$fNqdCp!Gyu0K3KB>dd^y$80$INx}O zD*xe2hcvQM{?`4mSX2OliL}px%(3Nf?vD-cyW#l}J5|2Dy}Pxr!hikhpV@pru_*O# z)6YZoZ@52%%(46%{juBT`{{qrO6J#ax=ZQk+@E(mCvrM6o2MlfMMr&eLpr)1eq4~b zMn`U&rxlzx%JKPbrK4>tv)WkEk@faKECw3_wZZKH`y)Z-SRI+S2gs$2Q*gRR<$7Yp z&~+&m`pee&7mIB$lNb&q_?$rcM}o{{{D1hfB;lXq;=PLh{Rd~QZ(@P}`nAVq;}v2t zY3C<-O)y?@@(`yr+Dd5uRrHSpnPd4kw#N;1yn==edN*16N1X0cdN}l9>kanmK`e?M zKBx)lVI4Ff$fA0P;QCzZd$}(~^uTWMHKm7TL&ii<4`%&ku_$`@&6^=TuzwI_uFyk6 z>Mu7l_Lujo^1pM({1>hG1MBUxSTrmD%}}Nwb8PvW$48^L&Xx9=(*uhC-#xr#YEujC zvvvN(;vqjBJqJj-D+z{r6#uj6pW*F~AagALPKZy-@Sf6aiAOj+sPwRO;p{K$ z)q_|RJzSuD8tkteM?50PqI!s6e9C$lX4JzWrH6ZFt+ZJWVo~%kD<)hIf-I_s2L^l-@| z2fm7&9?YH-h(*!E?-RoHAjn*y2RFXQvqYXZv45#iI+~tvx^r_2{Q&E6s8|#o9rA~C z#QiWq<_aA()NxY&Th%4TcIIuRhsRg!>|(DT#G>foSaL`Y+%FVlQ9VSkojF4fhm{^~ z*nUe_d-Wg|MGr?(!u24?qI!s+9>V_qJhvO~C_VH!zPVfE^k5cuh(*yu)21OkaC;%h zT%iXy#vQ@=2|Ta-U8SS;uWc%`qNDna|C-I?7mF!)vxFBY#wjGnq$Lc72 z9)B_QFwWzDPvv%YTG`uHc()$!iN&VVAA7Jlo{RUH&1sGHP!j$Y4(hKUb1d&p77ph{~N%+ zAafc2#i93GaX;ah%6`k{cYGB&{>}PjVzDm&o6$Gui+DhgIhOzMeiT1#|W0c+4=>sDCPh3!BF|<#fOl& zqWl}`b2;*%zbyWM zQG<=Ub5Q=`S2+IoOzENDLw9BFwGek$kGsX90uW3%?z;=`QV?X0)q{E5jeJVn$LZ%P z-}ippE@q#t{EJ1Yj~89oF*q*9{a``nGX9IGNciXR$uAWDl`{(mMvi~8@nEqi{7>!> z;J-QgoZX>+LFQQg!^eX$zhB0K`(j$smx}i<`oF&|#QVYtE4+887p?R5M{nPry}95> z{{ee)(%5SyW0mKSCgjED7<|ic6W>&9#A>~1GD4-$dR>rsS9*F@)Eb(=GUoYDK=~e85XSk3WWdUac{~ z;n4x?^!OW-*NYqTj&JlGaIap?qwi=1);xX>U!v(d2I)IAJ|kA&QK0XLr50X*Vla!b zLpS*{HvB$n5~C&PXCBwj#5SMF@LR_!`03d2H=<-;5pN_h{JhT`b}H=7+?x%UahuvC~lh0J7Tp~^ivu|S=0s8_Move6hvnt?T2(2U5$d6L4|Y^ zsLs`kr4Yq33EPDv`B;P->G^mL8~#LU7UT6dp|)O~aS%ZK1vBbPnEBQM-zJno)}I@Q zG6%dApS2Iq4F>Jzv_@MRM>HAyiGm$lKb_DoE~G?l68j5YCx+sslSue8;gR{Tp6NGO z^#2Jxm_0WTi=v0W)X{?=bA=un(sP4cE_Ycc_?2GzL~|$oGlJ!B)_)O;QvQ|u!u^3D zb4B?#)cyLjm z?7HEfH!hm7P52jN?&KdGG!~r~;>-4QsKVxyV85QnYo|)NtZwv5VMdL<&L~m)Pyamu zv+>$?%3_C~HP0=~0L+=3)@U2htEg@qLgv_V;kfl&RC2IPZXB=8mG#T)U#BS@HG2Aj zm?8^0vR=Q%q5=?1SVy~|BSGd^9dY}1{d`KFF_GinY^(1ak1>LG&9 z!^d@oFBUy;%U`1O(B{vVMNkiB<3M6j^sv8Bb|6i(nYg0;W=3gxKBI?x)DDF{6gnvQi zHvU7;jX5qYRk_~&;fajM>EA3a6^mnIC=<`9Xr)4uh{r(}W29b?IhOxAacO>7T*{9e z`SWnvq`TJI8kdU24=O6IUW>SN-yBYBwBg(rfZq{hj^*76ajBPvQ?A4zoR$aVK&vlK zS!Ays#G>e7*W8dE9)l(XSyT@Zj7xJ-{2tK*$0rp^58vlp7C}9j#ie3V^icWhkRI4S z2r^gbp&`Yk!RM147u~GN|D`Q8ORV?<>v5@A#2byTngAtA94hUDAaiW_pCv9W35!c- zDE>dK?0>(#{EI~eAeadMg3N9FhvHJ!f2GRzUH@Bk%3l7(;=K0sDC<8*Az}V`PMsig z8~ztQ*KfGKY4K7(q}C2 zZ++ZaEUs_yO6t?-9~7l=TBB`-{yU>zCdeGizZ3cgbk8TDaY~L0XDL1WcU%85d-Wg| zMGqq{4Cx^gvnd5xR1XpCA7C15QP{ZkY^8_Zy9Py24`%%Xu_$^-ZX41A`v*bh3OzKW z{((MIf!haeCw`^Mzx&nKEw|zithdi%Q2_`h(mn_>$Cm$D`Uj!s`ONMk z+OOxY{t4^OjN$NX4S~pB=Y^{15A2kU5rrWB-8X1-8LAu(S*Bpu`q0 z1Dk?yOn(;@eofJrckv=HUgE_|!wNBImWyBc*t!vGkY-SC{OW;)Wcqr1nu#NLzbVKy zTTW)(7GZ@HFF_08%mj`K?BPXh`X`S(Nyd4Bw<;aIb#B(XR&->&9TSUZ(~%%^td7j% zhJM~;89=dWV1ZacOHF+>{1`30F{`44~oiYIQeZj}4e^AzuE zx8K@)NnWJpRhzB<5sMqEv)V4sBU-hS(;96eI8Vg;GXO|tR%>m5oDH(@n>QVC zd1b!M{ENjP@oIzlXMZfn+{S;A&VQ`try=OROs8wmwZY4FX$(3vdHNeO>{)k~kkt37 zrHF^b|5bhv?*A4_!QgEb{E2OW|Mb86*{=7}g2N}DKMnbeK|d(`H62~*^o_dUT@rQs za9t={f7wSN`fa5PuIn*y$*Qbn3oqTDF@9@aeeO73*|-Mx?uIv0OxFqISYwLbJLGp! P;5`H`Uw5Ye{i^>1E!~VX literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx new file mode 100644 index 0000000000000000000000000000000000000000..f261d5310b41c72bff6a2fd9d99b944997dec9e7 GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<;Ta!*p`r*vcnAn0Z%6<`K!Zqat3(nCl2`MPAe070!D{7U zR4j^!@)rda6%++QiaZ2CK_e^-})VbD13&ObB1U4F}*o!9y9 zcfWh?xp(fJ3@ezFF{L1%>V7Y)O5M?0Bz>hL8tYFfR$wgDq#}9l?msas%3<@l0OqBiDs^fvP zt^dz|7I{!7b zpZ6`nzDafP48ZSi)gZ}Pb!-%>d-1i8sqIlXHv{*4vCe(?96LVe%YcqDRs){-)3GDU zG@i$J0-t}6^!@R*c{N(Hrct7H+qk7(xsta(eEXK1jgt=c?f2@0v^B^HpEalnJ%UZn zAb(y=jHO|81Lac@mE-qZe0|regBz1$sgeq*00+x(AXe*1lW|%(mCz;B1^>!uBKG9t zoLp?DBb|ahrBsYx#WV?LrsH=p_IIIaI97zTJ9Wjs9@y$iz43p3(0p0gFOODRdlF?O z#YdcP`g0Lg0gHYkv-0QlfvK5l3Tm>o>qw9?mMo(O&pwh!`)s+e_I1TZn^1 zem`lx@k$RJT6igwD)cLHD4CLD2F1`QoOYu+=^0#oPrlF#FhA)i-kOh3a8QTiG2jcA-YZ3>tw!ZDA(F?qcx<2Lvq63^Qk zOIbLP%c?*>iTETBwZe~9N~gnScxkL&7E|?8JZw;-H2mNyz@I1E_-Hf=kc)*WVsjeb zDVEydht!{_{K zZ|M^Uh9@g-g#dp%#l>hTx}4Y<^XFzrbO_GOg^-GL++1iWq@pfx6;})mqV2fRIg{QAN8!DT7gAvyk>dIs{y#Ll6aY9WLNfPRDjJXk^86SqugS zanj4u<51jOY!yHrpqS_!oZ%CHJt@maS0c}BUFAEGn#FkiO{lGxn&MPQQ~yHAXwU+= zjH4D5M@?`PRRCN3jiUtpJbfqr%fPP`O2${CmtxvtkEhrDd_#QFs=hj>BL3OX|z&e8uc3gSL=QKd=d`g}=LlYG^&N<{We@*AzGiPk&*y<50UhLmD=7OzB zby*0w>vQ`Y%NNJa+s|Fr`0`gO_R_b9SN$Rj)rHSOsSU&?x3l~idJ{`Z-1Shs2y(HX zJz*wNZg*K(zc2Q}J8=Q=QN0qf2aMH{;o{gmSD@I(Lh>b`Ui9*7YTc&D z^#!i=>#n5~`OC+RrP#!qdXj*aue?}Y*&%dgO4yY{VV@fe<|=fxCvY`i#kn{;bai~# z)j7B>4>)6}*=cd+Ab;1<^}xv$T#(9@-oTYTm8CFt%&!cgj18ddqprO$gt7^AVYF(V zOJCr6Q+C6z&jL%o#f?C$L!#clBEjIY|_IIL=A**A-k1}b!) z=_%_t{xb7h*bN^Q@LMVRO~U;a7YKg_qY&6{4M&*M7{fEA9CxRe9s&7O~gy#o9zop*J&{)?7pFTU-fJ(*)S=hf$q zW0fbp5{mAk#~^%nW;@VAvz8LI$~*EFHA7}NhhAz#IiB`aM76!B3VS&I9S$n*P`RAF z@Sx7dPvt)uxBhYd{|x@U)IYVqfq${MZhdy!g?U74k8xU~3IBrZ2Q^n8w*J5PpZH+M zerLl0vtU=E6x!e$2;HRxOhF^G@@X1B6F!E*GvJ zDX1s&6)QcbcK_N+`P9$Pt}yYlVo~bHs-)4npY003)xavq99up{KU)G}vY$P*T}VI0 zr-j;J?pt#F&V4H$zu^w#aQNRqtn@>EcMz^CLD7cyY)e-$RF+>1eq)JkoOb( zLtylaJO12n`{DR2{9KO9f7~Z@=5m+#X^|@bXEq=I)=K+eJ$@34XX_nTL~{xWw-1SE z9|W0W%ilbH(gp_Or%JTbcd1+-PudZ4Z^Yu)WRv(wELMGWU%v_{V&2!!kN*N_QV=_> zg+CT#j^*DNKSA(B%(t|I)r$A$MtX-nXMuO?agkVTxtE$gmq)bt0H-xtc>>WZ;9Zb8 zmUkz_MKmLI{jZGe;N40OQ@7uf5jj1WwS!_&^f2I^a6JezSLmT3wS)QyiTHziRQcbz zZgB+5->jb`7Nz`ee=k)2D-($XnJdb_q4tyX2j1cjs?bi{tMu?){DBcx{DJkjNGzJ^ zp$ct;Aakr9%;O^TdYN~LOBXBtC-mDe+Ft&}q5=?1xP9jOD9BvKKi&0^k^lQtz897r zU1Tr+V$qXG{>!0=2?`1GzZPFX<}&^}2F9~R|9@1uK5t2f-S+Y?7RCSEd@Q^@5@asp zAJd(T`d^~>?~^g$b9?z0iwZz65&a7?m+_D1l1BdTSNR?{aprHd9L6)IH1IFT9LslV2oCfMfDKD z=Vf7f;O8a}DLt&5->FsP^k6nlC>BKzMZ-gSVE-VVp05G^4O67dk6h8LFQQgjqwrB+x!{6*5^|G z@VtRY&)WAs7frr#-sTFWqnt@?zO$ku>wZ)$DgeQR>+uA91({=YR4+gJ ze=6Tk+_~%AZ5H}D*7+BUFMHb#^}(a8|MJ1FKLr}*KM!9)<}&^bew6zak1GC~zT0c- z(ph%)GsR-nGkfMPorM`-8#%4f=3&Y{kFN_d$MSFVqYd?WBd=>YY3ygNRC+ja$?Bc< z>Om}u9=2}|>7f%eA;_Y7h+sc6Ob^`OcueVG{|(x!k<)`&KT|A<9&%p_>4E)&AajKt z8d5*A$k@+(T$TUHPdn|hQvTN4XR&y?@)u-|Er0X)sLuR@Rf_*UnMZcp%fDFcizVL1 zex|g~g3M+7)1jxOpULTJ#s9veGix8T5Fc6BzgQIgkJu6Ne`y$J5o9jozhn6PgC`XK zRVP}vUuG-+Vo?DICaiysM+BM6_&3Zy;C}LxD&NK5UOdnW|MeSZFaU@#v)11W zAmeqMu2DLQX}0M8M=Z1l_47w&3yy9+q`4@`{z$yF- zGMDj>aXuse&#LTqegCX4?d4xA3jdNyTrJ34#y@Jik^i+S+oMLG)AUhW{f}4_-X)cO zy&!Wp|Lat?m#kd!slEJ*Md4ji=6@#qzaVor|Ievx?;H4(=P_ILAGC;9nen*R1cgNW zk05gy|9B2>^gqw5Tz4I`E6ZN~#i9ZboWCOa7i2EuAMbrM^1ohX|L*PUH`&X-SQP#x z75xh`m+_Am#Tog3L1p``=O3cSZS_B5QFxbB_!nd@;~(!cH1hwV%632hoT;mA_iGvX->7o^ z_`TT=J!>ofVo?DICd~hw7DR%~W&GofXh!~DQu$umeeGU*`4@{p;?;)mFUVZRzt(iV zk^fC9*OmXc>l=Id7mKIkUy!+se`MFl|7Ml_^N01Dyw+C#BNom0-`SE#khzTiBeyOT z{&}6>%PRYu{}R6-a{QaEs}zfM`A@{!9bUg9$Q;Xm__|80qcg6n+@i8wn|Zs|IQaKY z>i@p&`aM4~d%uoYtQb&od%`@T*GF<%qh*2fNAMM7j^*9>JiDRJcMV%d$Mx|~N)L~g z?ToRa2kXy)#NsdyWnxKl@X03YVLZNq%&~efe-30=N5%7ww<`YU9{S7@|JLiHSd{vB z;h0c;9FO_`g3Ph}JE1=6@Bf$i=iD89Md_hW$0V-QemV&i<{ZL0i-Ru5`qrTne?W3i|J1QThW1({>Z-`pP? z-gm?EBetu2dwX_iVTJ$t)jzZOeqvGT--cg>>fca*2$^H~H~M3@&G*y)o|Vk6;dF=6 z(V4&Ma7N^GWHwJrEQ*eL=Z19jOZag?<{BNjZJt(e-YCcCJC%;MEX!_VMMu`#1F;xv z2-F6*2kegonPYWi-X0*AGETwit18#yD+aGlvCv<(&c9e}gPFu|D8c6h(mxVpF6003 zFOr0Rj*E9G{`c&gv8IUy{_EEsn~hh9#iZ>Y=QY82#j*XI)@aM1{a4UG5@e3$-`E~E z)bR=$GT_~0=^t^rTj^o{;nr*I)q_|RJ$z6T(!*+KLXbuE5W)4i)cX=&is*se;%iC| ziwBL0pdQTn%VJUV@cTDIdSL$`$Xua^hSXnfX6!HTQRRR8wz8g-$`^^4WkhzS1Eqor! z>nhi?UY|O%nXUYbMFk+3F#oK7LFO|4(x=-n$`nH*0*sBMzD0(grh(*!E$8jM& ztU;SC$fA0PpdPMSncxfRfu9q+rSx#&gL{uhP7h|!3B;o4;o*dEJqR*a=)sNe@hq0- zP3&K4l#WUgPIhW;p&wv94i$@{qy7Gnj<_Et$XubLhB{8lf2+FK*v`DI^zi7??Vat_ zgIE+j97zu8f%}DmEUJeHwlk;b;egV^HCt~?w^t8hQS@*yC0q}JEUJeH>LKj!&vU!+ zj?zP~qZ_+KP7h{rhgcLnG;JEv1Gg7~%oTcYW84v(pTP6V-&Hy~@3jqOR&-Rq@n5rf z{9-W$Z(@b6~x^N2&L{145(@raf3ub&@I#oq(*(1_HLsW2J%3>1rI<Z z-~2h~G@5RF4)kY5$A<+sS>oTiKNgF^f7jU|f4m+(S&%uFe<%23yxk!ToZ z8UKjE#UFBdSmipi{b%d!HV}Q` z@6kgLWRB(C32{In-XUFT?3evT>EW60wq!?64`%%`u_$`z@p`x(1eq)J&>;I|tb>nK z`EUN$pCVZPX6qNkqLlxW`$FZP7av0Ait=x$&*jL6{<8Q3j*C84df0Qt$uU;^f%SfY zSX2Ol3AYc&V?xLrs|WLb!Eh=z#-*RAe5V!UUtur*V(~tr`yhnidq0JLLFO|4%c-;Q z&-LK1ivLM-He9~b*7!&)ia&h&!*G8n$Q;YR6XGL%owWEvPLC=*TypZ09DDU37DW$N ze-y3Y-*MlH)g&th}T$=Ut zH>IQY!*hxwrz5ktTP%u>1|JRAksx!0jv8#-Jptt}eud+Y&y*he+vo^|)Is zDgeQR-N>iJeVl%-@_pAw?P7M@%D-5Y`gs1i9fIRx+z%FHF5|zD z3Wa|jpZr4cUpc*?f8_W#8xIzX!vEy<0sfn#&)F6F7i5m*KYTnG^ZR8yxHqOHeW`f= zqVM}#LcHHLZmIWH^`dp&{_yQvayCvn*tg%S6VljgC1aK6peE$S<|us2a1-D4*of77 z(qx28<@l>jm*9>5U2te3_T*C`=@jfKC4B-YO~RS!_+5nj+2UhYi1lh=zI^Nw%y9dNH+&7<#V1=c)% z4_~6`I|k@GG(IC%-!Vzw5lbz+0L5SyVux<>MQr$e)Fehr(9b-opNVZgli|0HRq!*g z;crCAzCzweV)%hG9+NZn@_{&t^PS+0c#4bBQuLd)_A$T|(!5%2?O@zAgLlMgt>`Km zLD|$9)OMrMG#Er@A?<^72wj1Kn1;VEcpa$D)r+M7#WE4w1tj^Hj~nUvcm^B(L~0h} z^*5omUY&6eK>P(W>PwjU)&k!qltR{@8;COdy%3+h8_x{}?BujYtBxa@4E{vHj;)_g z=oc4IqBfEJ1+NoB@zOCQ{2BM)+*eNZ8!Y<&g&xeF8;C{G!(Z#@L6EsZ4-M(LK`xiO ztP?!0mp;+#iT{jX`J44$#G;gc`{YQzTf4n`ku79z(KK=Jkw0iYK=2JVa`RBFsr)?4b1(`efM+c2X=Y{xkJngHn zIVISy=keO>rCe4tdbuF8Mqg)?sQs`1o`BhSZ98SL{V$s57GwhEbWUruwdhr>ZyZAA z*mB{x^-NT9uuN_oug#V9%j{pLDjhX?@|>7L3p%o1zr~^g5KLG{JE0>%=2#tZ`*!fu zdYl`q$2?w9pz{4}O0Q9onG{eH2y{K;8AFNFW>_yVUjS|xbz+9-s~vAi4oXG4wi^~P16Q*c_O z^w4TDyJ#foktn|?4FBeBp4`$;)Vo~(4 zr;dLRWUkOdLmCI-;az9e_%Z>5{n8zFyZ!r{ed8JZ26xiF3Jza zMa=(iRKB$-#WwRV7JCr&Xa*Du6cXWIkhzWj&~sysOG{O*w;uj9GjjSji%Z4g=orev zGb&o9kR;-9&;=N&7i5m*zfN459~PJLBS-!`kT&s-Rkp^ZV)28DiYrzjF5Nwg(;96k z_XXg01es%bcS2n1rJc}Tok`Y z^uX~+h0??K6E2RR9?arWu_$_|{9Q;7>>mV~EA-Hi;?m&rNsfzdQ04!^rkX`o{DJkj zR4n3+#+Q$S5+x3m_Cb(2w){^MmllV`rPCDupH%j}$6o%$q5=?1gnvQiHvU6#DeJ#d z<@=6*SDmnzf3Y~{JbH-rKS3d3{&`NFAafi4WnucCu5$fm>08;WEySnR{f}6b_UD47 z;q8wga~c2lEc+$vUgoFVsQ7<;-|Fh8EbwoA+*&NIY4LLEljt85rg2)MZG`?ipkhww+4XJ;i&s5;{f!m4Ss`Br8#nnr!_yggy2KNe&z;~z^XBtGKw zcZ&Z*dlI%iZ7cs`an+s;mwZ0%>5i(-Vl%ATKwuQ?p9%kh%)R{cysp`b|JpenHd*1ne*J?#<9(!F>Yv)*@IF$pDE?>L zjUoTT`WIx5<=@yp;CX><@C_{O!aFFj#mm5^ARN=*MTK8e^yOW=2#l9_@zSsY44UQQ zS3b6`#Tuk()DyqDVIi5m9-pS;2;OfBa?O^LS+_-4A;nA3LO8R4qXK()5u5(WBTtfX zUf@kiM{k{({jL=qS#QV0;^}lG$Q-L9^Ee`&hKV2L=dU*_{_pR9`A3oC-|YFTSghNQ ztwaowhH-vD=2-s2pTFXXo2(n<{`4Hh`>L%sHD8n$sd?3A>wm=Jy7k#@7v>Qy-_B`` zHXfWO;{BO|%(1*1{bxg+7sx9_!=At1qV({Bl^(9cYWm3O!EAg*EQ%g7cZBr7{y~trLJtjgd}XdG|MT1Aon@u`t;a=T zQ2_`h+&;X6_*#%Tw*1ZGBGf;Li#VO9@_p>Ge4F_fi$UVm2J_GUSdh7m|3aPrSj|s^ z(0wVPE77&V%XVoLIy8Cu8#C-#cb1UU`-y7AL*oA`KM41Kw@Ja^Z58~9ZGr#vzx&y) zXZ555$DTb2`HVt8DEu`Yo$K_CI^$gub^CCgDMx?VM*;e6rSq=t)_>9R?8UcTv?p`y p=Dhmcajdd&CGOn?Z>A{G3FKH~irzcqcTwOy1TJ59rvLq_{{U9!ggpQN literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx new file mode 100644 index 0000000000000000000000000000000000000000..58e6e280a71b6f8a8dd41b5f8f0046aa89baa8eb GIT binary patch literal 69632 zcmeI43v?9a702)FE1M;35@~8gf<#b=3Iru0iYVkEYIw*icn&IP5)uf(l0*WQii&Ly z^(YiYv}#*U#i|^w#RpKNTD3l^NUhY0+DfYhtq%yGmICSj&U|;XiJ4+6&N;KaU(RM; z-^~5b@4MfNt4KnW-TC7=WjOQ5u_y11r(7T)7K&271e596W0s4hew-CpsG)BAt_&32aT z+qxt93V9KtmNcS0VWOR(^%=G`I+0XlagniW= z^qhn3&&@-U?j3B*HrL{F?=$P8(YFlO+|c1V+~-KN6Xk);VJ`MN@J((forEz>=Vv@l zyQUyJ`kRGYtxU_J3~T88tViX_yuNDtkEd?#dB?Ti8d==50(Zi_Mr6|xtnv+V+mI2a zQo4$&sGb_J{XM)QGtI$`nPFGf9;8Uf>O#k3hj@B!dKyhO-D*Lq9>)UlE))u3jC*23T)c8~n99+S$Ewcm zMBFJrJ+RTk_-X0YA)089#Vor^fDKyI3mZHIxINf2LSr$2JS>ce%~^bx1CEv8&RxTl69V>e*jQ$+c-Bo_V6@g|T8yq$5WquJi9R+So<;0a!>*3C z8$me&Rc8zG#%r4e`PTsNLZnGp^OJnTi!W)qusuEh7`a#B}zm)6$VupvQY z-J|Kafo5BHlWoWu-chUrqe-kK_IkSU*(=bo0Y64Xl%f$1tvs|h42^TTUTXjx>1tk%|%=)h5p2kxx;s10g1T!FlC`#FsMVUAnwO>(++5K>e-O8}V$8m#nZ7`qr zoxX`Lh}LV-UAywb936WMYkm5ug+#rF^Kz?|fq{JqMjk zPH%Vi1e{k%fvy4S#{Ew-{oCoB0H&AIOxvH@l**Yw=gcB=rX5_IJIuuRbarN&N;nu> z9cs=!xlLtuhjTl>%dm6)mrz{}N;B}PhqLqjMx2n@sp?|Ttiuma4JUQAg#kV{jj~)- zyPw;3*HNer5h@1C#T4m@R}bn&n0?3z7N(wsiN(__hlXR_iF2G_c|LGZ;PpX=i3rFX z+`>8db?MJz5$aQPOZDrYto;bS2WPgA@tpk6aitHAk41dB5J`AE)+T|+4qSoTF0(8~ z*)g@l%$$nRYby#)LzJ3|cqJn+31ct-_rXz^uooo>*H5+wx6SSLbG;WPQ5AY}P2?02 z17UL%qF;u!e`(G2nQ(HxEe=XCEKO_1KCaKc53vZab{p{C$_xJ3@>)`T_FEHkI@V{O z;%uJ!sLwvYD%WS6aP3;m`?~9LNZ`7QBMi@HuCRCr?K&z^HA#(hG>&kxWUzKE)UMiL zL|pA8sv6$GRZSpnDj43uX)X{q^$PFcdL>br@D8p_67>g*;WTEOBGcXLAqE*>(?(qjAZ-l41FxoM980v>$eGCjFB6lCRA9(pJk^F@Bi* z2lQrQa{hB%jonT1A5UOzC2&N}f8|&nP5Jh|D%&~j)pN!FF6sSXUh6f4T<^4v&@dQo z3{Xx>o~K_X8y;@PEV=dN?6hb1j9J@q*&Ba(;*{niaZUGG$hZ=X=O52Qo{tzzyX}7? zr}>NXkcXvX<#D9Qi$x=V$E({CZ0tl%&jNW-)-FOG2}<6Q=b2%e#6Mobz3g`AyuU5> zmb+Lq0ul@1F3M7qyD1pyuD{+k>gJ5(=K`E}zD|D^i`95L!Vya%%`iwhfR`vsP41Y` zcH1=arZL`f7mHc%R@}b;Gq2yrJ8mt37U3?+QjCSOn{~?Z3rS?qabs ze`oHZ%;(%){5``A#@67FX+nbN>^p?9=EIiow_&EshHTx<`WdUj*)=EH$}j z8t&t_&b#hjPyJmi=HvNoa$XhgqRi*q`PNKJ&Z`Kdc3U)f!3J-+i^al2FTPz4bt`xE zUB4e%o`k}UN_rys2>iVS{w~T=le_cOmgt(&yVrWlT`W%f^dBz_;W)GVxRv+A1BAOMOHJexT`YFS{S-Wm6lFf=j%+0@`Tc5lv-9PfUre9kDR;3b+`r#4 zuR-EWCEl!xGM{sIsb~1BBHV`DU2$#Qd0xhMvG_0RA-iUj=aD_|f%c7v@1o4-++E^3 zf5(~I!>{kS(Od3faoj=cvRTObxh-jX)PRlO zlKp)!KJ*Y}KIiUINAef{xy6F7Hh9ZjEaswOWO3722HHeqqDs6(na{bq#2NnDI=78y z#J=M#cd@wZ!($JA!u5O0jBQO&BHTq;YI5(z(9zb6cyCm_r*TFs^5@sUo`^HTy%+Y` zEoHtTnOsNao11%o#h+>)@RYk)EZo2AqRDn%{j6Xo)HEW-e2AAQOHF@2-f-ViS~=HS z?qbo6yC_Rd?!687Wt)DmZH=e?E*3B8J$&;4eC{#LC}DrU6JHh+Wj^N~G`EFCa-8X7 zc0cw^U+Y0nxr@cBJJU0sdhz)SzPqXGsnvPuZ!z~PQ3Z%HpL56ENK58^g4y}*jpszX zjrhEi7!d;Z5CijyK_uGp%Z~mdD{w@}Ud+wg+65Kap97LJVxx2)f zQw;Z)Cuc;Kd&*rbcE7d+-Ecd-~nR!!#Kj6WDI$8!QvmYUoLI@syp<-Z^7EqAf_&WSmz zF9P^=ANM^LU!5W0F3M7qd!gZ;w`KJo)_dyjV)2*`f6vF<$HCu4na{a%iELVO{XWR- zyJ~ggoBW@NoPQC-{~P4%{(Eh)_zNq)Bm#Ax?|o(O`%uGwCtnEeqRi*qUE=$xhI`ST z^mo1GE*9Omi?Y<>ZgA^D2`B+2pahhF5>Nt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW;;|04qb1`AwzJOBUy literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx new file mode 100644 index 0000000000000000000000000000000000000000..a1bfce52dcc60fbbde46e3b0b08b70e83cce1e3d GIT binary patch literal 69632 zcmeI44RjRM702)FS2iDPHexCw(L_{01p)>TMKt6?#PA&no`VXSgakscB!PgXM#a`c zJpu(0t=g7T@u(cFS``pctJaTJq*iK0ZKc(M)>;VoQ3|C0JNxct6EnqDoO5P-U(RNB zXWq>Hzu&v>-n+A#l+;z1*49-~=jJmzTClaqPZYH}clp|{qdnTTeeH|r1(bjiPy$Lo z2`B+2pahhF5>Nt4KnW;;BN8a7t1hakpN;qUvF5aG;lsEoke^QUNK5t5SnvP+H`|#% zv7kKh3OOO7))b_wfkLG6y$j2C13mP#q37;6TtCLN(~tNLSN2G!Q=xbQShgq0bCFAAoHw z_ROQXcr}-*(Q^P^&&B?Mv;fEIu^mkL_$k1%d^#JytK#MxI=u2(ZEZU+S2AyN%R@Ao z7UIf{wnaF2VO!g!&?Pgv_nI(Gu&vLBtxEKohokKLrQ(bi-x{EC5IYA4i6RlQLQ{=D z^ve#=h16u9i9?x`=`ZxtSae%tdVD$~B>~n&RE%SN@CdQX@n!n$NTZ3k#0(&-#qeuw z35+fhppY-(r%=F3r<1WmJiSM13QaNHYC))En8?-1FFL()Xd+@{%jmHG?v@jwzXYrMSbP8U`%9-_A zm@dZQg_yUw;8+Rn+%-tq0brki7c0ya&%GrbMr&=RMd(@u0X#*O=wsvIRm46u;+nJ$ zGbkqkPl&SoRvNseJ(iUEyCu+`gbT7{RuUuci=I z(66-AtnjqGX;g?SHbOXiOCv@ayKW?fGD92`c-n`&kVR}db|oH@!%5xPUE12_z=i~o z4UeT_0L`}WCfiVKdPlPk%qFpxv^P_Y&t8R&4fruC!W0g1XyvKBad;SnYYbZf5J{!5 z--_Dq#KD-`4RFyS^qc`ls<(CXq(#XJSZ!^i(1D{GPu#inVH?yOxB`odtrcI;%A^WN z7)SlFLb}PjzK8^uWtv?U@ zd_$k+3!>$=?0K>xougx~5pB;syO^l=NZxL@GBB|Pcx*y;wA)zd?ijZEg93-EO8C+O zNbmopG4_WiG~qapn0wBoQ&%r3Z!TYT(LI|+p6l=XT({0tVnKRH&ho_)*7^DJkpm_L zFDQC#`8(O6ax4<=g}EAyr<`566<^PeBtg2^cIp|}&+)GWTh6xZPfOc z4manX(XKM9)45%bG8jAmE2u65rI~ot!`XSfp;*Z5Qgsn%*5QYjMl5x;hXFn}g`$qC zozHC_br`Axgo*)a!Xl(QES2tr)rXv5Vd+^|SiH=#X(XN(LNBNAdOSGI&a<6~gKh)j z0H?+}4nRY6pNKM_Zzl7xs;Nlaea0Z24luS13p+Y=J%~{B-CfWGBKxf zefAm7=B1DN>?1to`iv8! z0o)j%Vl8p~9*q^V^ww9i>{Zx$#an;+##bTZiZ@<=ybgIiVlwS^;H~WDFRw$Mmd=&O z(IPJvjR2mn?o07vH*$Iu^S>vm${3@uDI7A(TXyUbB{0Ej&TNertG$5;h^`{x$5s?F%P#!cri+xc>^Bu9VAsz zmYm%2&fIRdz5Up3ce#tj{6mdToR0us^Jzu#ENEfwE#NN7l9PL;;XY~mg6r>f)!)Tp z9`4^J=2hV?$~?}Uhh|!0UPU0aTT8*BP403Ri}{CNdAAJe*6iuC@c^_u1Am_ie-~vQ z=k5^Svkdo*54`)dyWGX16L(RToZR_N0Jp>A3)er?)6M$?V)3%xhZ_zj+>!hR{Jj|d zF3OUVd+e?)(X}OaKk6=bu{iy+zr8$+HjQzv@#rw2z(ah1DRbmA_`l9T)KhWqpD@4c_W zRqkT3EAD6FW~3dbwPu~nM%A_6=fdh?oiM0 zS4FrDySw7Lx(nTm?_%*^)!d;XlC-)qiI?>vHPM$EwReu+Yd8i|~*h=*G0(|Hp$~?~9p^oG) z{&P$7zuw?3cd^(56(ftA&N9%-k%=nt5M>_c?ht4AYwO%LpPlwyce#tjJs+QN=pS6a zx6a(r1SP^pgPoL458p-6&yyzY|{;6J;Lf?l;52CNa*OVs=0Nd>`vUSGkMDsykCN zo_*z|G2h$LZE$r?>O0K+YE%KD%;VfK8fl5#Pc=K=zxn)-yWGWM2EOT@m{*0nDDyaX zE|E=38)NR7MP#p2bU-F{vZz)#&jbL!ur zM!1Wz(Tq2v6SicW4`{u7}e4GC>QS4s?@&5+- zrvF}BEdJceD-J>37yDn^{~^@y-^ufTP7!4u=k5^S2OI7~_NBh>E_bo$#9fpn7k7hO zH%dSWC;=s)1eAahPy$Lo2`B+2pahhF5>Nt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwN Date: Tue, 29 Oct 2019 11:34:00 +0100 Subject: [PATCH 02/11] Add Group Management Events - NewUAC Description --- .../winlogbeat/module/security/config/winlogbeat-security.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 56ceb33a6a8..68fc6e1047d 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -80,7 +80,7 @@ var security = (function () { "4781": "renamed-user-account", "4798": "group-membership-enumerated", "4799": "user-member-enumerated", - } + }; // Descriptions of failure status codes. @@ -1103,7 +1103,7 @@ var security = (function () { if (eventActionDescription) { evt.Put("event.action", eventActionDescription); } - } + }; var addLogonType = function(evt) { var code = evt.Get("winlog.event_data.LogonType"); From 618c2ec4f43f9c71d92adc59e42a5b4512169f54 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Tue, 29 Oct 2019 11:50:51 +0100 Subject: [PATCH 03/11] Add Group Management Events - NewUAC Description --- x-pack/winlogbeat/module/security/config/winlogbeat-security.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 68fc6e1047d..d00127651e8 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -1154,7 +1154,7 @@ var security = (function () { if (!code) { return; } - var uac_code=parseInt(code) + var uac_code=parseInt(code); var uac_result = []; for (var i=0; i Date: Tue, 29 Oct 2019 15:16:31 +0100 Subject: [PATCH 04/11] Add Group Management Events - NewUAC Description --- x-pack/winlogbeat/module/security/config/winlogbeat-security.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index d00127651e8..954c6c2aa1c 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -55,7 +55,7 @@ var security = (function () { "4720": "added-user-account", "4722": "enabled-user-account", "4723": "changed-password", - "4724": "reseted-password", + "4724": "reset-password", "4725": "disabled-user-account", "4726": "deleted-user-account", "4727": "added-group-account", From 620a1dd974211ab398b7eafcef35cac6ef55bcf8 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Tue, 5 Nov 2019 16:18:23 +0100 Subject: [PATCH 05/11] User and Group Management Dashboards --- .../[winlogbeat]_Group_Management_Events.json | 656 +++++++++++++ ...roup_Management_Events_Simple_Metrics.json | 722 +++++++++++++++ .../[winlogbeat]_User_Management_Events.json | 778 ++++++++++++++++ ...User_Management_Events_Simple_Metrics.json | 866 ++++++++++++++++++ 4 files changed, 3022 insertions(+) create mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json create mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json create mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json create mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json new file mode 100644 index 00000000000..5d5088b540b --- /dev/null +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json @@ -0,0 +1,656 @@ +{ + "objects": [ + { + "attributes": { + "description": "Includes Visual Builder Metric\nBucket size 90 days", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", + "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"22\",\"w\":17,\"x\":0,\"y\":0},\"panelIndex\":\"22\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":20,\"i\":\"23\",\"w\":21,\"x\":17,\"y\":0},\"panelIndex\":\"23\",\"title\":\"Group Managment Actions\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"25\",\"w\":10,\"x\":38,\"y\":0},\"panelIndex\":\"25\",\"title\":\"Event Codes\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"29\",\"w\":16,\"x\":0,\"y\":61},\"panelIndex\":\"29\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"30\",\"w\":9,\"x\":18,\"y\":41},\"panelIndex\":\"30\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"31\",\"w\":9,\"x\":0,\"y\":41},\"panelIndex\":\"31\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"32\",\"w\":9,\"x\":9,\"y\":41},\"panelIndex\":\"32\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"33\",\"w\":17,\"x\":16,\"y\":61},\"panelIndex\":\"33\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"34\",\"w\":15,\"x\":33,\"y\":61},\"panelIndex\":\"34\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"},\"legendOpen\":false}},\"gridData\":{\"h\":21,\"i\":\"35\",\"w\":27,\"x\":0,\"y\":20},\"panelIndex\":\"35\",\"title\":\"Actions performed over Groups\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"36\",\"w\":9,\"x\":0,\"y\":48},\"panelIndex\":\"36\",\"title\":\"Group Creation Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"37\",\"w\":9,\"x\":9,\"y\":48},\"panelIndex\":\"37\",\"title\":\"Group Changes Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"38\",\"w\":9,\"x\":18,\"y\":48},\"panelIndex\":\"38\",\"title\":\"Group Deletion Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"39\",\"w\":16,\"x\":0,\"y\":68},\"panelIndex\":\"39\",\"title\":\"Users Added to Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"40\",\"w\":17,\"x\":16,\"y\":68},\"panelIndex\":\"40\",\"title\":\"Users Removed From Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"42\",\"w\":15,\"x\":33,\"y\":68},\"panelIndex\":\"42\",\"title\":\"Group Enumeration - Table\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"43\",\"w\":21,\"x\":27,\"y\":41},\"panelIndex\":\"43\",\"title\":\"Logon Details \",\"version\":\"7.3.1\",\"panelRefName\":\"panel_16\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":21,\"i\":\"44\",\"w\":21,\"x\":27,\"y\":20},\"panelIndex\":\"44\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_17\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":22,\"i\":\"45\",\"w\":48,\"x\":0,\"y\":82},\"panelIndex\":\"45\",\"title\":\"Group Management Operations Details\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_18\"}]", + "timeRestore": false, + "title": "[winlogbeat] Group Management Events", + "version": 1 + }, + "id": "bb858830-f412-11e9-8405-516218e3d268", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "ffebe440-f419-11e9-8405-516218e3d268", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "e22c6f40-f498-11e9-8405-516218e3d268", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "ee292bc0-f499-11e9-8405-516218e3d268", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "400b63e0-f49a-11e9-8405-516218e3d268", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "a5f664c0-f49a-11e9-8405-516218e3d268", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "546febc0-f49b-11e9-8405-516218e3d268", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "98884120-f49d-11e9-8405-516218e3d268", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_16", + "type": "search" + }, + { + "id": "24954800-fef0-11e9-8405-516218e3d268", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "name": "panel_18", + "type": "search" + } + ], + "type": "dashboard", + "updated_at": "2019-11-04T14:33:22.241Z", + "version": "WzQ4MiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "Group Management Events - Description", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" + }, + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T08:28:57.594Z", + "version": "WzM0MywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4764\",\"4799\",\"4727\",\"4737\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Events - Event Actions - Donut", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:29:51.022Z", + "version": "WzM0NCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Events - Event Actions - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Action\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" + }, + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:51:18.570Z", + "version": "WzQ0OSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}" + }, + "title": "Users Added - Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Added - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(128,137,0,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\",\"value\":1},{\"background_color\":\"rgba(211,49,21,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gte\",\"value\":3}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"language\":\"kuery\",\"query\":\"event.code:4732 OR event.code:4728 OR event.code:4756\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Users Added to Group\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" + }, + "id": "ffebe440-f419-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:06:18.059Z", + "version": "WzM2NCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "Groups Deleted - Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Groups Deleted - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(153,172,99,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4734 OR event.code:4730 OR event.code:4758\",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Deleted\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" + }, + "id": "e22c6f40-f498-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T08:35:35.777Z", + "version": "WzM1MywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "Groups Created - Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Groups Created - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(244,78,59,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4731 OR event.code:4727 OR event.code:\\\"4754\\\" \",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Created\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" + }, + "id": "ee292bc0-f499-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:26:31.457Z", + "version": "WzM3NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "Groups Changed - Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Groups Changed - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(252,196,0,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4735 OR event.code:4737 OR event.code:\\\"4755\\\" OR event.code:\\\"4764\\\" \",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"60d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Changed\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" + }, + "id": "400b63e0-f49a-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:21:17.132Z", + "version": "WzM3MSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}" + }, + "title": "Users Removed - Table", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Removed - Table\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Removed from Group\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\",\"background_color\":\"rgba(176,188,0,1)\"}],\"filter\":{\"query\":\"event.code:4733 OR event.code:4727 OR event.code:4729\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "a5f664c0-f49a-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:06:43.461Z", + "version": "WzM2NSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "Groups Enumeration - Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Groups Enumeration - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"value\":0,\"background_color\":\"rgba(159,5,0,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4799\",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Group Membership Enumeration\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" + }, + "id": "546febc0-f49b-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:08:11.959Z", + "version": "WzM2NiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Events - Groups vs Actions - Heatmap", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"}}}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Groups vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":15,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:32:05.540Z", + "version": "WzM0NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Groups Created - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Groups Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "98884120-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:31:28.971Z", + "version": "WzQ3OSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755\",\"params\":[\"4735\",\"4737\",\"4755\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Changes - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Group Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:06.806Z", + "version": "WzQ4MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4734, 4730, 4758\",\"params\":[\"4734\",\"4730\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Groups Deleted - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Groups Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:43.899Z", + "version": "WzQ4MSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Added - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Added - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" + }, + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:09:21.781Z", + "version": "WzM2NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4729, 4757\",\"params\":[\"4733\",\"4729\",\"4757\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4757\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Removed from Group - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Removed from Group - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" + }, + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:11:21.532Z", + "version": "WzM2OCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":[\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "5_Group_Enum", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"5_Group_Enum\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator LogonID\"}}]}" + }, + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-10-22T10:43:29.024Z", + "version": "WzI2MiwxXQ==" + }, + { + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Action Distribution over Time", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Group Management Action Distribution over Time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-10-05T09:56:42.142Z\",\"max\":\"2019-11-04T10:56:42.142Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "24954800-fef0-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:56:51.856Z", + "version": "WzQ1MiwxXQ==" + }, + { + "attributes": { + "columns": [ + "event.action", + "group.name", + "group.domain", + "user.name", + "user.domain", + "host.name" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Group Management Details - Search View", + "version": 1 + }, + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T11:02:16.971Z", + "version": "WzQ2MCwxXQ==" + } + ], + "version": "7.3.1" +} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json new file mode 100644 index 00000000000..f4d6eeb8c65 --- /dev/null +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json @@ -0,0 +1,722 @@ +{ + "objects": [ + { + "attributes": { + "description": "Uses Simple Metric Visualizations", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", + "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":17,\"h\":22,\"i\":\"22\"},\"panelIndex\":\"22\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":17,\"y\":0,\"w\":22,\"h\":22,\"i\":\"23\"},\"panelIndex\":\"23\",\"title\":\"Group Management Actions\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":39,\"y\":0,\"w\":9,\"h\":22,\"i\":\"25\"},\"panelIndex\":\"25\",\"title\":\"Event Codes\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"},\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":22,\"w\":26,\"h\":21,\"i\":\"35\"},\"panelIndex\":\"35\",\"title\":\"Actions performed over Groups\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":52,\"w\":9,\"h\":13,\"i\":\"36\"},\"panelIndex\":\"36\",\"title\":\"Group Creation Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":52,\"w\":9,\"h\":13,\"i\":\"37\"},\"panelIndex\":\"37\",\"title\":\"Group Changes Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":52,\"w\":9,\"h\":13,\"i\":\"38\"},\"panelIndex\":\"38\",\"title\":\"Group Deletion Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":72,\"w\":16,\"h\":14,\"i\":\"39\"},\"panelIndex\":\"39\",\"title\":\"Users Added to Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":16,\"y\":72,\"w\":17,\"h\":14,\"i\":\"40\"},\"panelIndex\":\"40\",\"title\":\"Users Removed From Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":33,\"y\":72,\"w\":15,\"h\":14,\"i\":\"42\"},\"panelIndex\":\"42\",\"title\":\"Group Membership Enumeration Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":43,\"w\":21,\"h\":22,\"i\":\"43\"},\"panelIndex\":\"43\",\"title\":\"Logon Details \",\"version\":\"7.3.1\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":65,\"w\":16,\"h\":7,\"i\":\"44\"},\"panelIndex\":\"44\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":43,\"w\":9,\"h\":9,\"i\":\"45\"},\"panelIndex\":\"45\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":43,\"w\":9,\"h\":9,\"i\":\"46\"},\"panelIndex\":\"46\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":43,\"w\":9,\"h\":9,\"i\":\"47\"},\"panelIndex\":\"47\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":16,\"y\":65,\"w\":17,\"h\":7,\"i\":\"48\"},\"panelIndex\":\"48\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":33,\"y\":65,\"w\":15,\"h\":7,\"i\":\"49\"},\"panelIndex\":\"49\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_16\"},{\"gridData\":{\"x\":26,\"y\":22,\"w\":22,\"h\":21,\"i\":\"50\"},\"version\":\"7.3.1\",\"panelIndex\":\"50\",\"embeddableConfig\":{},\"panelRefName\":\"panel_17\"},{\"gridData\":{\"x\":0,\"y\":86,\"w\":48,\"h\":21,\"i\":\"51\"},\"version\":\"7.3.1\",\"panelIndex\":\"51\",\"embeddableConfig\":{},\"panelRefName\":\"panel_18\"}]", + "timeRestore": false, + "title": "[winlogbeat] Group Management Events - Simple Metrics", + "version": 1 + }, + "id": "01c54730-fee6-11e9-8405-516218e3d268", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "98884120-f49d-11e9-8405-516218e3d268", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_10", + "type": "search" + }, + { + "id": "a13bf640-fee8-11e9-8405-516218e3d268", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "f42f3b20-fee6-11e9-8405-516218e3d268", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "b5f38780-fee6-11e9-8405-516218e3d268", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "1b5f17d0-feea-11e9-8405-516218e3d268", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "0f2f5280-feeb-11e9-8405-516218e3d268", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "24954800-fef0-11e9-8405-516218e3d268", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "name": "panel_18", + "type": "search" + } + ], + "type": "dashboard", + "updated_at": "2019-11-04T15:38:34.464Z", + "version": "WzUyMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "Group Management Events - Description", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" + }, + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T08:28:57.594Z", + "version": "WzM0MywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4764\",\"4799\",\"4727\",\"4737\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Events - Event Actions - Donut", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:29:51.022Z", + "version": "WzM0NCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Events - Event Actions - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Action\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" + }, + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:51:18.570Z", + "version": "WzQ0OSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Events - Groups vs Actions - Heatmap", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"}}}", + "version": 1, + "visState": "{\"title\":\"Group Management Events - Groups vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":15,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:32:05.540Z", + "version": "WzM0NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Groups Created - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Groups Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "98884120-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:31:28.971Z", + "version": "WzQ3OSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755\",\"params\":[\"4735\",\"4737\",\"4755\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Changes - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Group Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:06.806Z", + "version": "WzQ4MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4734, 4730, 4758\",\"params\":[\"4734\",\"4730\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Groups Deleted - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Groups Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:43.899Z", + "version": "WzQ4MSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Added - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Added - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" + }, + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:09:21.781Z", + "version": "WzM2NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4729, 4757\",\"params\":[\"4733\",\"4729\",\"4757\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4757\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Removed from Group - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Removed from Group - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" + }, + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:11:21.532Z", + "version": "WzM2OCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":[\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "5_Group_Enum", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"5_Group_Enum\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator LogonID\"}}]}" + }, + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-10-22T10:43:29.024Z", + "version": "WzI2MiwxXQ==" + }, + { + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Added - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Added - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Reds\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Added to Groups\"}}]}" + }, + "id": "a13bf640-fee8-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:29:24.078Z", + "version": "WzQzMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"event.code\",\"negate\":false,\"params\":[\"4734\",\"4730\",\"4758\"],\"type\":\"phrases\",\"value\":\"4734, 4730, 4758\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}]}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Groups Deleted- Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Groups Deleted- Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greens\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Deleted\"}}]}" + }, + "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:28:52.621Z", + "version": "WzQzMCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Groups Created - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Groups Created - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Reds\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Created\"}}]}" + }, + "id": "f42f3b20-fee6-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:28:05.274Z", + "version": "WzQyOCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755, 4764\",\"params\":[\"4735\",\"4737\",\"4755\",\"4764\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4764\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Groups Changes - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Groups Changes - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greys\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Changed\"}}]}" + }, + "id": "b5f38780-fee6-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:28:25.310Z", + "version": "WzQyOSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4727, 4729\",\"params\":[\"4733\",\"4727\",\"4729\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4729\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Removed from Group - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Removed from Group - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greens\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Removed from Groups\"}}]}" + }, + "id": "1b5f17d0-feea-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:29:51.186Z", + "version": "WzQzMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":{\"query\":\"4799\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4799\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Membership Enumeration - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Group Membership Enumeration - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Blues\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":true,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Group Membership Enumerated\"}}]}" + }, + "id": "0f2f5280-feeb-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:30:31.143Z", + "version": "WzQzMywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Group Management Action Distribution over Time", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Group Management Action Distribution over Time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-10-05T09:56:42.142Z\",\"max\":\"2019-11-04T10:56:42.142Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "24954800-fef0-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:56:51.856Z", + "version": "WzQ1MiwxXQ==" + }, + { + "attributes": { + "columns": [ + "event.action", + "group.name", + "group.domain", + "user.name", + "user.domain", + "host.name" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Group Management Details - Search View", + "version": 1 + }, + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T11:02:16.971Z", + "version": "WzQ2MCwxXQ==" + } + ], + "version": "7.3.1" +} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json new file mode 100644 index 00000000000..74cc89af66c --- /dev/null +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json @@ -0,0 +1,778 @@ +{ + "objects": [ + { + "attributes": { + "description": "Uses Simple Metric Visualizations", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", + "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":17,\"h\":19,\"i\":\"1\"},\"panelIndex\":\"1\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":17,\"y\":0,\"w\":18,\"h\":19,\"i\":\"2\"},\"panelIndex\":\"2\",\"title\":\"User Management Actions\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":46,\"w\":9,\"h\":16,\"i\":\"3\"},\"panelIndex\":\"3\",\"title\":\"Created Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":35,\"y\":0,\"w\":13,\"h\":19,\"i\":\"4\"},\"panelIndex\":\"4\",\"title\":\"Event Codes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":46,\"w\":9,\"h\":16,\"i\":\"5\"},\"panelIndex\":\"5\",\"title\":\"Enabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":69,\"w\":9,\"h\":16,\"i\":\"6\"},\"panelIndex\":\"6\",\"title\":\"Disabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":46,\"w\":9,\"h\":16,\"i\":\"7\"},\"panelIndex\":\"7\",\"title\":\"Deleted Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 4\":\"rgb(247,252,245)\",\"12 - 16\":\"rgb(35,139,69)\",\"4 - 8\":\"rgb(199,233,192)\",\"8 - 12\":\"rgb(116,196,118)\"},\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":19,\"w\":27,\"h\":20,\"i\":\"8\"},\"panelIndex\":\"8\",\"title\":\"Actions performed over Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":69,\"w\":9,\"h\":16,\"i\":\"9\"},\"panelIndex\":\"9\",\"title\":\"Passwords Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":69,\"w\":9,\"h\":16,\"i\":\"15\"},\"panelIndex\":\"15\",\"title\":\"Unlocked Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":36,\"y\":69,\"w\":12,\"h\":16,\"i\":\"16\"},\"panelIndex\":\"16\",\"title\":\"Users Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":69,\"w\":9,\"h\":16,\"i\":\"20\"},\"panelIndex\":\"20\",\"title\":\"Locked-out Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":19,\"w\":21,\"h\":20,\"i\":\"21\"},\"panelIndex\":\"21\",\"title\":\"User Management Actions Distributions over Time\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":39,\"w\":21,\"h\":23,\"i\":\"22\"},\"panelIndex\":\"22\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":85,\"w\":48,\"h\":19,\"i\":\"23\"},\"panelIndex\":\"23\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"gridData\":{\"x\":0,\"y\":62,\"w\":9,\"h\":7,\"i\":\"24\"},\"version\":\"7.3.1\",\"panelIndex\":\"24\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_15\"},{\"gridData\":{\"x\":9,\"y\":39,\"w\":9,\"h\":7,\"i\":\"25\"},\"version\":\"7.3.1\",\"panelIndex\":\"25\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_16\"},{\"gridData\":{\"x\":18,\"y\":39,\"w\":9,\"h\":7,\"i\":\"26\"},\"version\":\"7.3.1\",\"panelIndex\":\"26\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_17\"},{\"gridData\":{\"x\":0,\"y\":39,\"w\":9,\"h\":7,\"i\":\"27\"},\"version\":\"7.3.1\",\"panelIndex\":\"27\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_18\"},{\"gridData\":{\"x\":9,\"y\":62,\"w\":9,\"h\":7,\"i\":\"28\"},\"version\":\"7.3.1\",\"panelIndex\":\"28\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_19\"},{\"gridData\":{\"x\":18,\"y\":62,\"w\":9,\"h\":7,\"i\":\"29\"},\"version\":\"7.3.1\",\"panelIndex\":\"29\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_20\"},{\"gridData\":{\"x\":27,\"y\":62,\"w\":9,\"h\":7,\"i\":\"30\"},\"version\":\"7.3.1\",\"panelIndex\":\"30\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_21\"},{\"gridData\":{\"x\":36,\"y\":62,\"w\":12,\"h\":7,\"i\":\"31\"},\"version\":\"7.3.1\",\"panelIndex\":\"31\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_22\"}]", + "timeRestore": false, + "title": "[winlogbeat] User Management Events", + "version": 1 + }, + "id": "71f720f0-ff18-11e9-8405-516218e3d268", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_13", + "type": "search" + }, + { + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "name": "panel_14", + "type": "search" + }, + { + "id": "97c70300-ff1c-11e9-8405-516218e3d268", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", + "name": "panel_18", + "type": "visualization" + }, + { + "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", + "name": "panel_19", + "type": "visualization" + }, + { + "id": "60301890-ff1d-11e9-8405-516218e3d268", + "name": "panel_20", + "type": "visualization" + }, + { + "id": "9dd22440-ff1d-11e9-8405-516218e3d268", + "name": "panel_21", + "type": "visualization" + }, + { + "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", + "name": "panel_22", + "type": "visualization" + } + ], + "type": "dashboard", + "updated_at": "2019-11-04T16:20:39.430Z", + "version": "WzUzOSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "User Management Events - Description", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **User Management Events**\\n\\n#### This dashboard shows information about User Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description\\n-- | --\\n4720 | A user account was created\\n4722 | A user account was enabled\\n4723 | An attempt was made to change an account's password\\n4724 | An attempt was made to reset an account's password\\n4725 | An user account was disabled\\n4726 | An user account was deleted\\n4738 | An user account was changed\\n4740 | An user account was locked out\\n4767 | An account was unlocked\\n4781 | The name of an account was changed\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" + }, + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T10:20:41.549Z", + "version": "WzQxNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "User Management Events - Event Actions - Donut", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T11:13:23.297Z", + "version": "WzQ2NiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Created - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Created User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:35:21.465Z", + "version": "WzQ4NSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "User Management Events - Event Actions - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}},{\"accessor\":1,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}}],\"metrics\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"perPage\":10,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Short Description\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" + }, + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:23:43.282Z", + "version": "WzQyMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Enabled - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Enabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Enabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:37:53.874Z", + "version": "WzQ4NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Disabled - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Disabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Disabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:15:00.943Z", + "version": "WzUwNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Deleted - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Deleted User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed LogonId\"}}]}" + }, + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:44:25.678Z", + "version": "WzQ5MywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "User Management Events - Affected Users vs Actions - Heatmap", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 14\":\"rgb(247,251,255)\",\"14 - 28\":\"rgb(198,219,239)\",\"28 - 42\":\"rgb(107,174,214)\",\"42 - 55\":\"rgb(33,113,181)\"}}}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Affected Users vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Operation\"}}]}" + }, + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:24:35.247Z", + "version": "WzQyNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Password Changes - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Password Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Password Change to\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:21:59.683Z", + "version": "WzUxMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":{\"query\":\"4767\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4767\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Unlocked Users - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Unlocked Users - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Unlocked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer Logonid\"}}]}" + }, + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:25:13.281Z", + "version": "WzUxNSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":{\"query\":\"4738\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4738\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Changes Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Changes Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Changed User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:26:15.729Z", + "version": "WzUxNiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":{\"query\":\"4740\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4740\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Locked Out - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Locked Out - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Locked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:24:32.268Z", + "version": "WzUxNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\",\"4798\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4798\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "4_Event_Distribution in time", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"4_Event_Distribution in time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-09-20T13:10:39.628Z\",\"max\":\"2019-11-04T14:10:39.628Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-45d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:12:00.548Z", + "version": "WzQ3NiwxXQ==" + }, + { + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, + { + "attributes": { + "columns": [ + "event.action", + "user.name", + "user.domain", + "winlog.event_data.SubjectUserName", + "winlog.event_data.SubjectDomainName", + "winlog.logon.id" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "User management Details - Search", + "version": 1 + }, + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T12:04:57.352Z", + "version": "WzQ3NSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users Disabled - VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Disabled - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Disabled\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(219,223,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4725\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "97c70300-ff1c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:06:23.209Z", + "version": "WzUyOSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users Enabled - VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Enabled - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Enabled\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(251,158,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4722\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:01:43.218Z", + "version": "WzUyNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users Deleted - VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Deleted - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Deleted\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(176,188,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4726\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:02:50.506Z", + "version": "WzUyNiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users Created - VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Created - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Created\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(159,5,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4720\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T15:49:13.249Z", + "version": "WzUyMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users Unlocks - VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Unlocks - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Unlocks\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(254,146,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4767\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:08:21.249Z", + "version": "WzUzMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users Password Changes - VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Password Changes - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Password Changes/Reset\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(22,165,165,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4723\\\" OR event.code: \\\"4724\\\"\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "60301890-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:10:09.726Z", + "version": "WzUzNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users locked Out - VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users locked Out - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Locked Out\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(51,51,51,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4740\\\"\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "9dd22440-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:24:47.051Z", + "version": "WzU0MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" + }, + "title": "Users Changes VB Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Changes VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Changes\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(179,179,179,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4738\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" + }, + "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:12:34.736Z", + "version": "WzUzOCwxXQ==" + } + ], + "version": "7.3.1" +} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json new file mode 100644 index 00000000000..d484f3d1634 --- /dev/null +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json @@ -0,0 +1,866 @@ +{ + "objects": [ + { + "attributes": { + "description": "Uses Simple Metric Visualizations", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", + "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"1\",\"w\":17,\"x\":0,\"y\":0},\"panelIndex\":\"1\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":19,\"i\":\"2\",\"w\":18,\"x\":17,\"y\":0},\"panelIndex\":\"2\",\"title\":\"User Management Actions\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"3\",\"w\":9,\"x\":0,\"y\":44},\"panelIndex\":\"3\",\"title\":\"Created Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"4\",\"w\":13,\"x\":35,\"y\":0},\"panelIndex\":\"4\",\"title\":\"Event Codes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"5\",\"w\":9,\"x\":9,\"y\":44},\"panelIndex\":\"5\",\"title\":\"Enabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"6\",\"w\":9,\"x\":0,\"y\":66},\"panelIndex\":\"6\",\"title\":\"Disabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"7\",\"w\":9,\"x\":18,\"y\":44},\"panelIndex\":\"7\",\"title\":\"Deleted Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 4\":\"rgb(247,252,245)\",\"12 - 16\":\"rgb(35,139,69)\",\"4 - 8\":\"rgb(199,233,192)\",\"8 - 12\":\"rgb(116,196,118)\"},\"legendOpen\":false}},\"gridData\":{\"h\":20,\"i\":\"8\",\"w\":27,\"x\":0,\"y\":19},\"panelIndex\":\"8\",\"title\":\"Actions performed over Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"9\",\"w\":9,\"x\":18,\"y\":66},\"panelIndex\":\"9\",\"title\":\"Passwords Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"10\",\"w\":9,\"x\":0,\"y\":39},\"panelIndex\":\"10\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"11\",\"w\":9,\"x\":9,\"y\":39},\"panelIndex\":\"11\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"12\",\"w\":9,\"x\":18,\"y\":39},\"panelIndex\":\"12\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"13\",\"w\":9,\"x\":0,\"y\":60},\"panelIndex\":\"13\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"14\",\"w\":9,\"x\":18,\"y\":60},\"panelIndex\":\"14\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"15\",\"w\":9,\"x\":9,\"y\":66},\"panelIndex\":\"15\",\"title\":\"Unlocked Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"16\",\"w\":12,\"x\":36,\"y\":66},\"panelIndex\":\"16\",\"title\":\"Users Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"17\",\"w\":9,\"x\":27,\"y\":60},\"panelIndex\":\"17\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_16\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"18\",\"w\":9,\"x\":9,\"y\":60},\"panelIndex\":\"18\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_17\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"19\",\"w\":12,\"x\":36,\"y\":60},\"panelIndex\":\"19\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_18\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"20\",\"w\":9,\"x\":27,\"y\":66},\"panelIndex\":\"20\",\"title\":\"Locked-out Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_19\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"21\",\"w\":21,\"x\":27,\"y\":19},\"panelIndex\":\"21\",\"title\":\"User Management Actions Distributions over Time\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_20\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":21,\"i\":\"22\",\"w\":21,\"x\":27,\"y\":39},\"panelIndex\":\"22\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_21\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"23\",\"w\":48,\"x\":0,\"y\":82},\"panelIndex\":\"23\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_22\"}]", + "timeRestore": false, + "title": "[winlogbeat] User Management Events - Simple Metric", + "version": 1 + }, + "id": "8223bed0-b9e9-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", + "name": "panel_18", + "type": "visualization" + }, + { + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "name": "panel_19", + "type": "visualization" + }, + { + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "name": "panel_20", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_21", + "type": "search" + }, + { + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "name": "panel_22", + "type": "search" + } + ], + "type": "dashboard", + "updated_at": "2019-11-04T15:28:21.018Z", + "version": "WzUxNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" + }, + "title": "User Management Events - Description", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **User Management Events**\\n\\n#### This dashboard shows information about User Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description\\n-- | --\\n4720 | A user account was created\\n4722 | A user account was enabled\\n4723 | An attempt was made to change an account's password\\n4724 | An attempt was made to reset an account's password\\n4725 | An user account was disabled\\n4726 | An user account was deleted\\n4738 | An user account was changed\\n4740 | An user account was locked out\\n4767 | An account was unlocked\\n4781 | The name of an account was changed\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" + }, + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T10:20:41.549Z", + "version": "WzQxNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "User Management Events - Event Actions - Donut", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T11:13:23.297Z", + "version": "WzQ2NiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Created - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Created User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" + }, + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:35:21.465Z", + "version": "WzQ4NSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "User Management Events - Event Actions - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}},{\"accessor\":1,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}}],\"metrics\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"perPage\":10,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Short Description\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" + }, + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:23:43.282Z", + "version": "WzQyMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Enabled - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Enabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Enabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:37:53.874Z", + "version": "WzQ4NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Disabled - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Disabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Disabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:15:00.943Z", + "version": "WzUwNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Deleted - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Deleted User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed LogonId\"}}]}" + }, + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:44:25.678Z", + "version": "WzQ5MywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "User Management Events - Affected Users vs Actions - Heatmap", + "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 14\":\"rgb(247,251,255)\",\"14 - 28\":\"rgb(198,219,239)\",\"28 - 42\":\"rgb(107,174,214)\",\"42 - 55\":\"rgb(33,113,181)\"}}}", + "version": 1, + "visState": "{\"title\":\"User Management Events - Affected Users vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Operation\"}}]}" + }, + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:24:35.247Z", + "version": "WzQyNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Password Changes - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Password Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Password Change to\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:21:59.683Z", + "version": "WzUxMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Created - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Created - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Created\"}}]}" + }, + "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:39:07.209Z", + "version": "WzQ5MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Enabled - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Enabled - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"user.name\",\"customLabel\":\"Users Enabled\"}}]}" + }, + "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:38:36.233Z", + "version": "WzQ4OCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Deleted - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Deleted - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Deleted Users\"}}]}" + }, + "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:39:59.945Z", + "version": "WzQ5MSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Disabled - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Disabled - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"user.name\",\"customLabel\":\"Disabled Users\"}}]}" + }, + "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:00:11.591Z", + "version": "WzQ5NCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Password Reset / Changes", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Password Reset / Changes\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Password Changes\"}}]}" + }, + "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:01:45.486Z", + "version": "WzQ5OCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":{\"query\":\"4767\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4767\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Unlocked Users - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Unlocked Users - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Unlocked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer Logonid\"}}]}" + }, + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:25:13.281Z", + "version": "WzUxNSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":{\"query\":\"4738\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4738\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Changes Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Changes Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Changed User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:26:15.729Z", + "version": "WzUxNiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":[\"4740\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4740\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Unlocks - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Unlocks - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Locked Out\"}}]}" + }, + "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:06:22.616Z", + "version": "WzUwMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":[\"4767\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4767\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Unlocked Users - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Unlocked Users - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Unlocks\"}}]}" + }, + "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:01:01.325Z", + "version": "WzQ5NiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":[\"4738\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4738\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Changes - Simple Metric", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Users Changes - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Changes in Users\"}}]}" + }, + "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:03:27.480Z", + "version": "WzUwMCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":{\"query\":\"4740\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4740\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "Users Locked Out - Table", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "visState": "{\"title\":\"Users Locked Out - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Locked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" + }, + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:24:32.268Z", + "version": "WzUxNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\",\"4798\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4798\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "title": "4_Event_Distribution in time", + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"4_Event_Distribution in time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-09-20T13:10:39.628Z\",\"max\":\"2019-11-04T14:10:39.628Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-45d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" + }, + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:12:00.548Z", + "version": "WzQ3NiwxXQ==" + }, + { + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, + { + "attributes": { + "columns": [ + "event.action", + "user.name", + "user.domain", + "winlog.event_data.SubjectUserName", + "winlog.event_data.SubjectDomainName", + "winlog.logon.id" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "User management Details - Search", + "version": 1 + }, + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T12:04:57.352Z", + "version": "WzQ3NSwxXQ==" + } + ], + "version": "7.3.1" +} From 8232e98ea25a149e0688222ba58f81974ec9be39 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Tue, 5 Nov 2019 16:52:27 +0100 Subject: [PATCH 06/11] Fixed Dashboard Description --- .../7/dashboard/[winlogbeat]_Group_Management_Events.json | 6 +++--- .../7/dashboard/[winlogbeat]_User_Management_Events.json | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json index 5d5088b540b..febb0ee2ef3 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json @@ -2,7 +2,7 @@ "objects": [ { "attributes": { - "description": "Includes Visual Builder Metric\nBucket size 90 days", + "description": "Includes Visual Builder Metric\nInterval size 90 days", "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" @@ -115,8 +115,8 @@ } ], "type": "dashboard", - "updated_at": "2019-11-04T14:33:22.241Z", - "version": "WzQ4MiwxXQ==" + "updated_at": "2019-11-05T15:39:38.478Z", + "version": "WzU2MSwxXQ==" }, { "attributes": { diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json index 74cc89af66c..fa95d5ac824 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json @@ -2,7 +2,7 @@ "objects": [ { "attributes": { - "description": "Uses Simple Metric Visualizations", + "description": "Includes Visual Builder Metric Interval size 90 days", "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" @@ -135,8 +135,8 @@ } ], "type": "dashboard", - "updated_at": "2019-11-04T16:20:39.430Z", - "version": "WzUzOSwxXQ==" + "updated_at": "2019-11-05T15:40:21.391Z", + "version": "WzU2MiwxXQ==" }, { "attributes": { From c6162669ebccf5e0df274351b68fea8c9f365322 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Fri, 22 Nov 2019 11:01:10 +0100 Subject: [PATCH 07/11] Spacing errors fixed --- .../security/config/winlogbeat-security.js | 146 +++++++++--------- 1 file changed, 72 insertions(+), 74 deletions(-) diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 954c6c2aa1c..b952c13dbbd 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -1101,7 +1101,7 @@ var security = (function () { } var eventActionDescription = eventActionTypes[code]; if (eventActionDescription) { - evt.Put("event.action", eventActionDescription); + evt.Put("event.action", eventActionDescription); } }; @@ -1203,7 +1203,6 @@ var security = (function () { }) .Build(); - var copySubjectUser = new processor.Chain() .Convert({ fields: [ @@ -1214,7 +1213,7 @@ var security = (function () { ignore_missing: true, }) .Build(); - + var copyOldTargetUser = new processor.Chain() .Convert({ fields: [ @@ -1233,7 +1232,6 @@ var security = (function () { }) .Build(); - var renameCommonAuthFields = new processor.Chain() .Convert({ fields: [ @@ -1342,107 +1340,107 @@ var security = (function () { return { - // 4624 - An account was successfully logged on. - 4624: logonSuccess.Run, + // 4624 - An account was successfully logged on. + 4624: logonSuccess.Run, - // 4625 - An account failed to log on. - 4625: event4625.Run, - - // 4634 - An account was logged off. - 4634: logoff.Run, + // 4625 - An account failed to log on. + 4625: event4625.Run, - // 4647 - User initiated logoff. - 4647: logoff.Run, + // 4634 - An account was logged off. + 4634: logoff.Run, - // 4648 - A logon was attempted using explicit credentials. - 4648: logonSuccess.Run, + // 4647 - User initiated logoff. + 4647: logoff.Run, - // 4672 - Special privileges assigned to new logon. - 4672: event4672.Run, + // 4648 - A logon was attempted using explicit credentials. + 4648: logonSuccess.Run, - // 4720 - A user account was created - 4720: userMgmtEvts.Run, + // 4672 - Special privileges assigned to new logon. + 4672: event4672.Run, - // 4722 - A user account was enabled - 4722: userMgmtEvts.Run, + // 4720 - A user account was created + 4720: userMgmtEvts.Run, - // 4723 - An attempt was made to change an account's password - 4723: userMgmtEvts.Run, + // 4722 - A user account was enabled + 4722: userMgmtEvts.Run, - // 4724 - An attempt was made to reset an account's password - 4724: userMgmtEvts.Run, + // 4723 - An attempt was made to change an account's password + 4723: userMgmtEvts.Run, - // 4725 - A user account was disabled. - 4725: userMgmtEvts.Run, + // 4724 - An attempt was made to reset an account's password + 4724: userMgmtEvts.Run, - // 4726 - An user account was deleted. - 4726: userMgmtEvts.Run, + // 4725 - A user account was disabled. + 4725: userMgmtEvts.Run, - // 4727 - A security-enabled global group was created. - 4727: groupMgmtEvts.Run, + // 4726 - An user account was deleted. + 4726: userMgmtEvts.Run, - // 4728 - A member was added to a security-enabled global group. - 4728: groupMgmtEvts.Run, + // 4727 - A security-enabled global group was created. + 4727: groupMgmtEvts.Run, - // 4729 - A member was removed from a security-enabled global group. - 4729: groupMgmtEvts.Run, - - // 4730 - A security-enabled global group was deleted. - 4730: groupMgmtEvts.Run, + // 4728 - A member was added to a security-enabled global group. + 4728: groupMgmtEvts.Run, + + // 4729 - A member was removed from a security-enabled global group. + 4729: groupMgmtEvts.Run, + + // 4730 - A security-enabled global group was deleted. + 4730: groupMgmtEvts.Run, - // 4731 - A security-enabled local group was created. - 4731: groupMgmtEvts.Run, + // 4731 - A security-enabled local group was created. + 4731: groupMgmtEvts.Run, - // 4732 - A member was added to a security-enabled local group. - 4732: groupMgmtEvts.Run, + // 4732 - A member was added to a security-enabled local group. + 4732: groupMgmtEvts.Run, - // 4733 - A member was removed from a security-enabled local group. - 4733: groupMgmtEvts.Run, + // 4733 - A member was removed from a security-enabled local group. + 4733: groupMgmtEvts.Run, - // 4734 - A security-enabled local group was deleted. - 4734: groupMgmtEvts.Run, + // 4734 - A security-enabled local group was deleted. + 4734: groupMgmtEvts.Run, - // 4735 - A security-enabled local group was changed. - 4735: groupMgmtEvts.Run, + // 4735 - A security-enabled local group was changed. + 4735: groupMgmtEvts.Run, - // 4737 - A security-enabled global group was changed. - 4737: groupMgmtEvts.Run, + // 4737 - A security-enabled global group was changed. + 4737: groupMgmtEvts.Run, - // 4738 - An user account was changed. - 4738: userMgmtEvts.Run, + // 4738 - An user account was changed. + 4738: userMgmtEvts.Run, - // 4740 - An account was locked out - 4740: userMgmtEvts.Run, + // 4740 - An account was locked out + 4740: userMgmtEvts.Run, - // 4754 - A security-enabled universal group was created. - 4754: groupMgmtEvts.Run, + // 4754 - A security-enabled universal group was created. + 4754: groupMgmtEvts.Run, - // 4755 - A security-enabled universal group was changed. - 4755: groupMgmtEvts.Run, + // 4755 - A security-enabled universal group was changed. + 4755: groupMgmtEvts.Run, - // 4756 - A member was added to a security-enabled universal group. - 4756: groupMgmtEvts.Run, + // 4756 - A member was added to a security-enabled universal group. + 4756: groupMgmtEvts.Run, - // 4757 - A member was removed from a security-enabled universal group. - 4757: groupMgmtEvts.Run, + // 4757 - A member was removed from a security-enabled universal group. + 4757: groupMgmtEvts.Run, - // 4758 - A security-enabled universal group was deleted. - 4758: groupMgmtEvts.Run, + // 4758 - A security-enabled universal group was deleted. + 4758: groupMgmtEvts.Run, - // 4764 - A group\'s type was changed. - 4764: groupMgmtEvts.Run, + // 4764 - A group\'s type was changed. + 4764: groupMgmtEvts.Run, - // 4767 - A user account was unlocked. - 4767: userMgmtEvts.Run, + // 4767 - A user account was unlocked. + 4767: userMgmtEvts.Run, - // 4781 - The name of an account was changed. - 4781: userRenamed.Run, + // 4781 - The name of an account was changed. + 4781: userRenamed.Run, - // 4798 - A user's local group membership was enumerated. - 4798: userMgmtEvts.Run, + // 4798 - A user's local group membership was enumerated. + 4798: userMgmtEvts.Run, - // 4799 - A security-enabled local group membership was enumerated. - 4799: groupMgmtEvts.Run, + // 4799 - A security-enabled local group membership was enumerated. + 4799: groupMgmtEvts.Run, process: function(evt) { From 096f7ea1eb6c6ac7c6abf54fd5cf3c32fe5d9c2f Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Tue, 26 Nov 2019 14:10:48 -0600 Subject: [PATCH 08/11] Add golden files - fix whitespace in winlogbeat-security.js to make diffs cleaner --- .../security/config/winlogbeat-security.js | 60 +++++++++--------- ...2016_4720_Account_Created.evtx.golden.json | 20 +++++- ...security-windows2016_4727.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4728.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4729.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4730.evtx.golden.json | 61 ++++++++++++++++++ ...security-windows2016_4731.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4732.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4733.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4734.evtx.golden.json | 61 ++++++++++++++++++ ...security-windows2016_4735.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4737.evtx.golden.json | 63 +++++++++++++++++++ ...2016_4738_Account_Changed.evtx.golden.json | 16 ++++- ...security-windows2016_4754.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4755.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4756.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4757.evtx.golden.json | 63 +++++++++++++++++++ ...security-windows2016_4758.evtx.golden.json | 61 ++++++++++++++++++ ...security-windows2016_4764.evtx.golden.json | 62 ++++++++++++++++++ ...security-windows2016_4798.evtx.golden.json | 58 +++++++++++++++++ ...security-windows2016_4799.evtx.golden.json | 63 +++++++++++++++++++ 21 files changed, 1182 insertions(+), 36 deletions(-) create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4730.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4731.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4732.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4757.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx.golden.json diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index b952c13dbbd..2dabf06d753 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -18,7 +18,7 @@ var security = (function () { "10": "RemoteInteractive", "11": "CachedInteractive", }; - + // User Account Control Attributes Table // https://support.microsoft.com/es-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties var uac_flags = [ @@ -45,7 +45,7 @@ var security = (function () { [0x1000000, 'TRUSTED_TO_AUTH_FOR_DELEGATION'], [0x04000000, 'PARTIAL_SECRETS_ACCOUNT'], ]; - + // event.action Description Table var eventActionTypes = { "4624": "logged-in", @@ -79,10 +79,9 @@ var security = (function () { "4767": "unlocked-user-account", "4781": "renamed-user-account", "4798": "group-membership-enumerated", - "4799": "user-member-enumerated", + "4799": "user-member-enumerated", }; - - + // Descriptions of failure status codes. // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 var logonFailureStatus = { @@ -1148,7 +1147,7 @@ var security = (function () { } evt.Put("winlog.logon.failure.sub_status", descriptiveFailureStatus); }; - + var addUACDescription = function(evt) { var code = evt.Get("winlog.event_data.NewUacValue"); if (!code) { @@ -1163,7 +1162,7 @@ var security = (function () { } if (uac_result) { evt.Put("winlog.event_data.NewUACList",uac_result); - } + } var uac_list=evt.Get("winlog.event_data.UserAccountControl").replace(/\s/g,'').split("%%").filter(String); if (! uac_list) { return; @@ -1171,7 +1170,6 @@ var security = (function () { evt.Put("winlog.event_data.UserAccountControl",uac_list); }; - var copyTargetUser = new processor.Chain() .Convert({ fields: [ @@ -1182,7 +1180,7 @@ var security = (function () { ignore_missing: true, }) .Build(); - + var copyTargetUserToGroup = new processor.Chain() .Convert({ fields: [ @@ -1193,7 +1191,7 @@ var security = (function () { ignore_missing: true, }) .Build(); - + var copyTargetUserLogonId = new processor.Chain() .Convert({ fields: [ @@ -1315,7 +1313,7 @@ var security = (function () { }) .Add(addActionDesc) .Build(); - + var userMgmtEvts = new processor.Chain() .Add(copyTargetUser) .Add(copySubjectUserLogonId) @@ -1328,7 +1326,7 @@ var security = (function () { .Add(copyOldTargetUser) .Add(copySubjectUserLogonId) .Add(addActionDesc) - .Build(); + .Build(); var groupMgmtEvts = new processor.Chain() .Add(copySubjectUser) @@ -1339,7 +1337,6 @@ var security = (function () { .Build(); return { - // 4624 - An account was successfully logged on. 4624: logonSuccess.Run, @@ -1376,16 +1373,16 @@ var security = (function () { // 4726 - An user account was deleted. 4726: userMgmtEvts.Run, - // 4727 - A security-enabled global group was created. + // 4727 - A security-enabled global group was created. 4727: groupMgmtEvts.Run, - // 4728 - A member was added to a security-enabled global group. + // 4728 - A member was added to a security-enabled global group. 4728: groupMgmtEvts.Run, - // 4729 - A member was removed from a security-enabled global group. + // 4729 - A member was removed from a security-enabled global group. 4729: groupMgmtEvts.Run, - // 4730 - A security-enabled global group was deleted. + // 4730 - A security-enabled global group was deleted. 4730: groupMgmtEvts.Run, // 4731 - A security-enabled local group was created. @@ -1412,19 +1409,19 @@ var security = (function () { // 4740 - An account was locked out 4740: userMgmtEvts.Run, - // 4754 - A security-enabled universal group was created. + // 4754 - A security-enabled universal group was created. 4754: groupMgmtEvts.Run, - // 4755 - A security-enabled universal group was changed. + // 4755 - A security-enabled universal group was changed. 4755: groupMgmtEvts.Run, - // 4756 - A member was added to a security-enabled universal group. + // 4756 - A member was added to a security-enabled universal group. 4756: groupMgmtEvts.Run, - // 4757 - A member was removed from a security-enabled universal group. + // 4757 - A member was removed from a security-enabled universal group. 4757: groupMgmtEvts.Run, - // 4758 - A security-enabled universal group was deleted. + // 4758 - A security-enabled universal group was deleted. 4758: groupMgmtEvts.Run, // 4764 - A group\'s type was changed. @@ -1441,17 +1438,16 @@ var security = (function () { // 4799 - A security-enabled local group membership was enumerated. 4799: groupMgmtEvts.Run, - - process: function(evt) { - var event_id = evt.Get("winlog.event_id"); - var processor = this[event_id]; - if (processor === undefined) { - return; - } - evt.Put("event.module", "security"); - processor(evt); - }, + process: function(evt) { + var event_id = evt.Get("winlog.event_id"); + var processor = this[event_id]; + if (processor === undefined) { + return; + } + evt.Put("event.module", "security"); + processor(evt); + }, }; })(); diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4720_Account_Created.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4720_Account_Created.evtx.golden.json index eb5794a01e1..0e3fd3f3a15 100644 --- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4720_Account_Created.evtx.golden.json +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4720_Account_Created.evtx.golden.json @@ -31,6 +31,10 @@ "HomeDirectory": "%%1793", "HomePath": "%%1793", "LogonHours": "%%1797", + "NewUACList": [ + "SCRIPT", + "LOCKOUT" + ], "NewUacValue": "0x15", "OldUacValue": "0x0", "PasswordLastSet": "%%1794", @@ -47,7 +51,11 @@ "TargetDomainName": "WIN-41OB2LO92CR", "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1005", "TargetUserName": "elastictest1", - "UserAccountControl": "\n\t\t%%2080\n\t\t%%2082\n\t\t%%2084", + "UserAccountControl": [ + "2080", + "2082", + "2084" + ], "UserParameters": "%%1793", "UserPrincipalName": "-", "UserWorkstations": "%%1793" @@ -104,6 +112,10 @@ "HomeDirectory": "%%1793", "HomePath": "%%1793", "LogonHours": "%%1797", + "NewUACList": [ + "SCRIPT", + "LOCKOUT" + ], "NewUacValue": "0x15", "OldUacValue": "0x0", "PasswordLastSet": "%%1794", @@ -120,7 +132,11 @@ "TargetDomainName": "WIN-41OB2LO92CR", "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1006", "TargetUserName": "audittest0609", - "UserAccountControl": "\n\t\t%%2080\n\t\t%%2082\n\t\t%%2084", + "UserAccountControl": [ + "2080", + "2082", + "2084" + ], "UserParameters": "%%1793", "UserPrincipalName": "-", "UserWorkstations": "%%1793" diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx.golden.json new file mode 100644 index 00000000000..1a769e759c5 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:26:12.4955445Z", + "event": { + "action": "added-group-account", + "code": 4727, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "DnsUpdateProxy" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled global group was created.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-41OB2LO92CR$\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x27438\n\nNew Group:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1110\n\tGroup Name:\t\tDnsUpdateProxy\n\tGroup Domain:\t\tWLBEAT\n\nAttributes:\n\tSAM Account Name:\tDnsUpdateProxy\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-18", + "name": "WIN-41OB2LO92CR$" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "DnsUpdateProxy", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x27438", + "SubjectUserName": "WIN-41OB2LO92CR$", + "SubjectUserSid": "S-1-5-18", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1110", + "TargetUserName": "DnsUpdateProxy" + }, + "event_id": 4727, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x27438" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4105, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json new file mode 100644 index 00000000000..15df9e67183 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:33:26.8613751Z", + "event": { + "action": "added-group-account-to", + "code": 4728, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2" + }, + "log": { + "level": "information" + }, + "message": "A member was added to a security-enabled global group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2" + }, + "event_id": 4728, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4657, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx.golden.json new file mode 100644 index 00000000000..02fa62e43a9 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:33:45.5433159Z", + "event": { + "action": "deleted-group-account-from", + "code": 4729, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2v2" + }, + "log": { + "level": "information" + }, + "message": "A member was removed from a security-enabled global group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2v2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2v2" + }, + "event_id": 4729, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4665, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4730.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4730.evtx.golden.json new file mode 100644 index 00000000000..c08bd704ccb --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4730.evtx.golden.json @@ -0,0 +1,61 @@ +[ + { + "@timestamp": "2019-10-22T11:34:01.6107262Z", + "event": { + "action": "deleted-group-account", + "code": 4730, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2v2" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled global group was deleted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nDeleted Group:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2v2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2v2" + }, + "event_id": 4730, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4670, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4731.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4731.evtx.golden.json new file mode 100644 index 00000000000..6a960e13377 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4731.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:29:49.3586766Z", + "event": { + "action": "added-group-account", + "code": 4731, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group1" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled local group was created.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nNew Group:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1111\n\tGroup Name:\t\ttest_group1\n\tGroup Domain:\t\tWLBEAT\n\nAttributes:\n\tSAM Account Name:\ttest_group1\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "test_group1", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1111", + "TargetUserName": "test_group1" + }, + "event_id": 4731, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4569, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4732.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4732.evtx.golden.json new file mode 100644 index 00000000000..0423fc5379e --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4732.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:31:58.0398598Z", + "event": { + "action": "added-group-account-to", + "code": 4732, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group1" + }, + "log": { + "level": "information" + }, + "message": "A member was added to a security-enabled local group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1111\n\tGroup Name:\t\ttest_group1\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1111", + "TargetUserName": "test_group1" + }, + "event_id": 4732, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4625, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json new file mode 100644 index 00000000000..ca75b7d5c50 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:32:14.8941288Z", + "event": { + "action": "deleted-group-account-from", + "code": 4733, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group1" + }, + "log": { + "level": "information" + }, + "message": "A member was removed from a security-enabled local group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1111\n\tGroup Name:\t\ttest_group1\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1111", + "TargetUserName": "test_group1" + }, + "event_id": 4733, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4627, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json new file mode 100644 index 00000000000..237347ad76d --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json @@ -0,0 +1,61 @@ +[ + { + "@timestamp": "2019-10-22T11:32:35.1274042Z", + "event": { + "action": "deleted-group-account", + "code": 4734, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group1v1" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled local group was deleted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1111\n\tGroup Name:\t\ttest_group1v1\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1111", + "TargetUserName": "test_group1v1" + }, + "event_id": 4734, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4630, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx.golden.json new file mode 100644 index 00000000000..30109fcd090 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:32:30.425487Z", + "event": { + "action": "modified-group-account", + "code": 4735, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group1v1" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled local group was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1111\n\tGroup Name:\t\ttest_group1v1\n\tGroup Domain:\t\tWLBEAT\n\nChanged Attributes:\n\tSAM Account Name:\ttest_group1v1\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "test_group1v1", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1111", + "TargetUserName": "test_group1v1" + }, + "event_id": 4735, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4628, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json new file mode 100644 index 00000000000..dab1408d799 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:33:57.2710608Z", + "event": { + "action": "modified-group-account", + "code": 4737, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2v2" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled global group was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2v2\n\tGroup Domain:\t\tWLBEAT\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "-", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2v2" + }, + "event_id": 4737, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4668, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json index 536370d050b..bb3567f8ccb 100644 --- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json @@ -32,6 +32,10 @@ "HomeDirectory": "%%1793", "HomePath": "%%1793", "LogonHours": "%%1797", + "NewUACList": [ + "LOCKOUT", + "NORMAL_ACCOUNT" + ], "NewUacValue": "0x210", "OldUacValue": "0x210", "PasswordLastSet": "6/9/2019 10:30:28", @@ -48,7 +52,9 @@ "TargetDomainName": "WIN-41OB2LO92CR", "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1005", "TargetUserName": "elastictest1", - "UserAccountControl": "-", + "UserAccountControl": [ + "-" + ], "UserParameters": "%%1793", "UserPrincipalName": "-", "UserWorkstations": "%%1793" @@ -106,6 +112,10 @@ "HomeDirectory": "%%1793", "HomePath": "%%1793", "LogonHours": "%%1797", + "NewUACList": [ + "LOCKOUT", + "NORMAL_ACCOUNT" + ], "NewUacValue": "0x210", "OldUacValue": "0x10", "PasswordLastSet": "6/9/2019 10:25:21", @@ -122,7 +132,9 @@ "TargetDomainName": "WIN-41OB2LO92CR", "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1006", "TargetUserName": "audittest0609", - "UserAccountControl": "\n\t\t%%2089", + "UserAccountControl": [ + "2089" + ], "UserParameters": "%%1793", "UserPrincipalName": "-", "UserWorkstations": "%%1793" diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json new file mode 100644 index 00000000000..daa5826eccd --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:34:33.783048Z", + "event": { + "action": "added-group-account", + "code": 4754, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled universal group was created.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tGroup Name:\t\tTest_group3\n\tGroup Domain:\t\tWLBEAT\n\nAttributes:\n\tSAM Account Name:\tTest_group3\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "Test_group3", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3" + }, + "event_id": 4754, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4676, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json new file mode 100644 index 00000000000..02cc1f19bfa --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:35:09.0701134Z", + "event": { + "action": "modified-group-account", + "code": 4755, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3v2" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled universal group was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tGroup Name:\t\tTest_group3v2\n\tGroup Domain:\t\tWLBEAT\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "-", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3v2" + }, + "event_id": 4755, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4685, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx.golden.json new file mode 100644 index 00000000000..f6fbfb1cc13 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:34:58.4130288Z", + "event": { + "action": "added-group-account-to", + "code": 4756, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3v2" + }, + "log": { + "level": "information" + }, + "message": "A member was added to a security-enabled universal group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tAccount Name:\t\tTest_group3v2\n\tAccount Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3v2" + }, + "event_id": 4756, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4684, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4757.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4757.evtx.golden.json new file mode 100644 index 00000000000..bf000399f21 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4757.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:35:09.0701919Z", + "event": { + "action": "deleted-group-account-from", + "code": 4757, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3v2" + }, + "log": { + "level": "information" + }, + "message": "A member was removed from a security-enabled universal group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tGroup Name:\t\tTest_group3v2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3v2" + }, + "event_id": 4757, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4686, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json new file mode 100644 index 00000000000..e199f55ad76 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json @@ -0,0 +1,61 @@ +[ + { + "@timestamp": "2019-10-22T11:35:13.5502867Z", + "event": { + "action": "deleted-group-account", + "code": 4758, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3v2" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled universal group was deleted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tGroup Name:\t\tTest_group3v2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3v2" + }, + "event_id": 4758, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4687, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json new file mode 100644 index 00000000000..a36c3a620ad --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json @@ -0,0 +1,62 @@ +[ + { + "@timestamp": "2019-10-22T11:33:57.271141Z", + "event": { + "action": "type-changed-group-account", + "code": 4764, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2v2" + }, + "log": { + "level": "information" + }, + "message": "A group’s type was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nChange Type:\t\t\tSecurity Enabled Universal Group Changed to Security Enabled Global Group.\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2v2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "GroupTypeChange": "Security Enabled Universal Group Changed to Security Enabled Global Group.", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2v2" + }, + "event_id": 4764, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4669, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json new file mode 100644 index 00000000000..bb021b9d8a3 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json @@ -0,0 +1,58 @@ +[ + { + "@timestamp": "2019-10-08T10:20:34.0535453Z", + "event": { + "action": "group-membership-enumerated", + "code": 4798, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "log": { + "level": "information" + }, + "message": "A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-41OB2LO92CR$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1005\n\tAccount Name:\t\telastictest1\n\tAccount Domain:\t\tWIN-41OB2LO92CR\n\nProcess Information:\n\tProcess ID:\t\t0x3f0\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe", + "process": { + "name": "null" + }, + "user": { + "domain": "WIN-41OB2LO92CR", + "name": "elastictest1" + }, + "winlog": { + "activity_id": "{c3ff3c1c-7dc1-0000-233e-ffc3c17dd501}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR", + "event_data": { + "CallerProcessId": "0x3f0", + "CallerProcessName": "C:\\Windows\\System32\\LogonUI.exe", + "SubjectDomainName": "WORKGROUP", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-41OB2LO92CR$", + "SubjectUserSid": "S-1-5-18", + "TargetDomainName": "WIN-41OB2LO92CR", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1005", + "TargetUserName": "elastictest1" + }, + "event_id": 4798, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 780, + "thread": { + "id": 1740 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 2996, + "task": "User Account Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx.golden.json new file mode 100644 index 00000000000..036cfebb5ef --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-08T10:20:44.4724208Z", + "event": { + "action": "user-member-enumerated", + "code": 4799, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "Builtin", + "name": "Administrators" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-41OB2LO92CR$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\tAdministrators\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x494\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe", + "process": { + "name": "null" + }, + "user": { + "domain": "WORKGROUP", + "id": "S-1-5-18", + "name": "WIN-41OB2LO92CR$" + }, + "winlog": { + "activity_id": "{c3ff3c1c-7dc1-0000-233e-ffc3c17dd501}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR", + "event_data": { + "CallerProcessId": "0x494", + "CallerProcessName": "C:\\Windows\\System32\\svchost.exe", + "SubjectDomainName": "WORKGROUP", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-41OB2LO92CR$", + "SubjectUserSid": "S-1-5-18", + "TargetDomainName": "Builtin", + "TargetSid": "S-1-5-32-544", + "TargetUserName": "Administrators" + }, + "event_id": 4799, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 780, + "thread": { + "id": 820 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 3002, + "task": "Security Group Management" + } + } +] \ No newline at end of file From a6a13ba523dd2e2426205109e8b09e8ec2e59275 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Tue, 26 Nov 2019 16:06:25 -0600 Subject: [PATCH 09/11] decode dashboards - used libbeat/scripts/unpack_dashboards.py --transform decode --- .../[winlogbeat]_Group_Management_Events.json | 4465 ++++++++++++-- ...roup_Management_Events_Simple_Metrics.json | 4832 ++++++++++++--- .../[winlogbeat]_User_Management_Events.json | 4799 ++++++++++++--- ...User_Management_Events_Simple_Metrics.json | 5191 ++++++++++++++--- 4 files changed, 16361 insertions(+), 2926 deletions(-) diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json index febb0ee2ef3..a703cdb8a17 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json @@ -1,656 +1,3853 @@ { - "objects": [ - { - "attributes": { - "description": "Includes Visual Builder Metric\nInterval size 90 days", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"22\",\"w\":17,\"x\":0,\"y\":0},\"panelIndex\":\"22\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":20,\"i\":\"23\",\"w\":21,\"x\":17,\"y\":0},\"panelIndex\":\"23\",\"title\":\"Group Managment Actions\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"25\",\"w\":10,\"x\":38,\"y\":0},\"panelIndex\":\"25\",\"title\":\"Event Codes\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"29\",\"w\":16,\"x\":0,\"y\":61},\"panelIndex\":\"29\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"30\",\"w\":9,\"x\":18,\"y\":41},\"panelIndex\":\"30\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"31\",\"w\":9,\"x\":0,\"y\":41},\"panelIndex\":\"31\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"32\",\"w\":9,\"x\":9,\"y\":41},\"panelIndex\":\"32\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"33\",\"w\":17,\"x\":16,\"y\":61},\"panelIndex\":\"33\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"34\",\"w\":15,\"x\":33,\"y\":61},\"panelIndex\":\"34\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"},\"legendOpen\":false}},\"gridData\":{\"h\":21,\"i\":\"35\",\"w\":27,\"x\":0,\"y\":20},\"panelIndex\":\"35\",\"title\":\"Actions performed over Groups\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"36\",\"w\":9,\"x\":0,\"y\":48},\"panelIndex\":\"36\",\"title\":\"Group Creation Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"37\",\"w\":9,\"x\":9,\"y\":48},\"panelIndex\":\"37\",\"title\":\"Group Changes Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"38\",\"w\":9,\"x\":18,\"y\":48},\"panelIndex\":\"38\",\"title\":\"Group Deletion Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"39\",\"w\":16,\"x\":0,\"y\":68},\"panelIndex\":\"39\",\"title\":\"Users Added to Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"40\",\"w\":17,\"x\":16,\"y\":68},\"panelIndex\":\"40\",\"title\":\"Users Removed From Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"42\",\"w\":15,\"x\":33,\"y\":68},\"panelIndex\":\"42\",\"title\":\"Group Enumeration - Table\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"43\",\"w\":21,\"x\":27,\"y\":41},\"panelIndex\":\"43\",\"title\":\"Logon Details \",\"version\":\"7.3.1\",\"panelRefName\":\"panel_16\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":21,\"i\":\"44\",\"w\":21,\"x\":27,\"y\":20},\"panelIndex\":\"44\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_17\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":22,\"i\":\"45\",\"w\":48,\"x\":0,\"y\":82},\"panelIndex\":\"45\",\"title\":\"Group Management Operations Details\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_18\"}]", - "timeRestore": false, - "title": "[winlogbeat] Group Management Events", - "version": 1 - }, - "id": "bb858830-f412-11e9-8405-516218e3d268", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ + "objects": [ { - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "name": "panel_0", - "type": "visualization" - }, + "attributes": { + "description": "Includes Visual Builder Metric\nInterval size 90 days", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": {}, + "gridData": { + "h": 20, + "i": "22", + "w": 17, + "x": 0, + "y": 0 + }, + "panelIndex": "22", + "panelRefName": "panel_0", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": { + "vis": { + "legendOpen": false + } + }, + "gridData": { + "h": 20, + "i": "23", + "w": 21, + "x": 17, + "y": 0 + }, + "panelIndex": "23", + "panelRefName": "panel_1", + "title": "Group Managment Actions", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 20, + "i": "25", + "w": 10, + "x": 38, + "y": 0 + }, + "panelIndex": "25", + "panelRefName": "panel_2", + "title": "Event Codes", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "29", + "w": 16, + "x": 0, + "y": 61 + }, + "panelIndex": "29", + "panelRefName": "panel_3", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "30", + "w": 9, + "x": 18, + "y": 41 + }, + "panelIndex": "30", + "panelRefName": "panel_4", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "31", + "w": 9, + "x": 0, + "y": 41 + }, + "panelIndex": "31", + "panelRefName": "panel_5", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "32", + "w": 9, + "x": 9, + "y": 41 + }, + "panelIndex": "32", + "panelRefName": "panel_6", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "33", + "w": 17, + "x": 16, + "y": 61 + }, + "panelIndex": "33", + "panelRefName": "panel_7", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "34", + "w": 15, + "x": 33, + "y": 61 + }, + "panelIndex": "34", + "panelRefName": "panel_8", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": { + "vis": { + "defaultColors": { + "0 - 1": "rgb(247,251,255)", + "1 - 2": "rgb(198,219,239)", + "2 - 3": "rgb(107,174,214)", + "3 - 4": "rgb(33,113,181)" + }, + "legendOpen": false + } + }, + "gridData": { + "h": 21, + "i": "35", + "w": 27, + "x": 0, + "y": 20 + }, + "panelIndex": "35", + "panelRefName": "panel_9", + "title": "Actions performed over Groups", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 13, + "i": "36", + "w": 9, + "x": 0, + "y": 48 + }, + "panelIndex": "36", + "panelRefName": "panel_10", + "title": "Group Creation Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 13, + "i": "37", + "w": 9, + "x": 9, + "y": 48 + }, + "panelIndex": "37", + "panelRefName": "panel_11", + "title": "Group Changes Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 13, + "i": "38", + "w": 9, + "x": 18, + "y": 48 + }, + "panelIndex": "38", + "panelRefName": "panel_12", + "title": "Group Deletion Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 14, + "i": "39", + "w": 16, + "x": 0, + "y": 68 + }, + "panelIndex": "39", + "panelRefName": "panel_13", + "title": "Users Added to Group Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 14, + "i": "40", + "w": 17, + "x": 16, + "y": 68 + }, + "panelIndex": "40", + "panelRefName": "panel_14", + "title": "Users Removed From Group Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 14, + "i": "42", + "w": 15, + "x": 33, + "y": 68 + }, + "panelIndex": "42", + "panelRefName": "panel_15", + "title": "Group Enumeration - Table", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 20, + "i": "43", + "w": 21, + "x": 27, + "y": 41 + }, + "panelIndex": "43", + "panelRefName": "panel_16", + "title": "Logon Details ", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 21, + "i": "44", + "w": 21, + "x": 27, + "y": 20 + }, + "panelIndex": "44", + "panelRefName": "panel_17", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 22, + "i": "45", + "w": 48, + "x": 0, + "y": 82 + }, + "panelIndex": "45", + "panelRefName": "panel_18", + "title": "Group Management Operations Details", + "version": "7.3.1" + } + ], + "timeRestore": false, + "title": "[winlogbeat] Group Management Events", + "version": 1 + }, + "id": "bb858830-f412-11e9-8405-516218e3d268", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "ffebe440-f419-11e9-8405-516218e3d268", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "e22c6f40-f498-11e9-8405-516218e3d268", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "ee292bc0-f499-11e9-8405-516218e3d268", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "400b63e0-f49a-11e9-8405-516218e3d268", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "a5f664c0-f49a-11e9-8405-516218e3d268", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "546febc0-f49b-11e9-8405-516218e3d268", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "98884120-f49d-11e9-8405-516218e3d268", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_16", + "type": "search" + }, + { + "id": "24954800-fef0-11e9-8405-516218e3d268", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "name": "panel_18", + "type": "search" + } + ], + "type": "dashboard", + "updated_at": "2019-11-05T15:39:38.478Z", + "version": "WzU2MSwxXQ==" + }, { - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "name": "panel_1", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Description", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 10, + "markdown": "# **Group Management Events**\n\n#### This dashboard shows information about Group Management Events collected by winlogbeat\n#\n#\n#\nEvent | Description|Event | Description\n-- | --|--|--\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \n|4758|A security-enabled universal group was deleted.| 4764|A group\\'s type was changed.|\n|4799|A security-enabled local group membership was enumerated.|", + "openLinksInNewTab": false + }, + "title": "Group Management Events - Description", + "type": "markdown" + } + }, + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T08:28:57.594Z", + "version": "WzM0MywxXQ==" + }, { - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "name": "panel_2", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4732", + "4733", + "4734", + "4735", + "4764", + "4799", + "4727", + "4737", + "4728", + "4729", + "4730", + "4754", + "4755", + "4756", + "4757", + "4758" + ], + "type": "phrases", + "value": "4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Event Actions - Donut", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "segment", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metric": { + "accessor": 1, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + }, + "isDonut": true, + "labels": { + "last_level": true, + "show": true, + "truncate": 100, + "values": true + }, + "legendPosition": "right", + "type": "pie" + }, + "title": "Group Management Events - Event Actions - Donut", + "type": "pie" + } + }, + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:29:51.022Z", + "version": "WzM0NCwxXQ==" + }, { - "id": "ffebe440-f419-11e9-8405-516218e3d268", - "name": "panel_3", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4727", + "4728", + "4729", + "4730", + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4754", + "4755", + "4756", + "4757", + "4758", + "4764", + "4799" + ], + "type": "phrases", + "value": "4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Event Actions - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Event Action", + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Event Code", + "field": "event.code", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Group Management Events - Event Actions - Table", + "type": "table" + } + }, + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:51:18.570Z", + "version": "WzQ0OSwxXQ==" + }, { - "id": "e22c6f40-f498-11e9-8405-516218e3d268", - "name": "panel_4", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Added - Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(128,137,0,1)", + "id": "bfcaced0-f419-11e9-928e-8f5fd2b6c66e", + "operator": "gt", + "value": 1 + }, + { + "background_color": "rgba(211,49,21,1)", + "id": "a7d935e0-f497-11e9-928e-8f5fd2b6c66e", + "operator": "gte", + "value": 3 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code:4732 OR event.code:4728 OR event.code:4756" + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Added to Group", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Added - Metric", + "type": "metrics" + } + }, + "id": "ffebe440-f419-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:06:18.059Z", + "version": "WzM2NCwxXQ==" + }, { - "id": "ee292bc0-f499-11e9-8405-516218e3d268", - "name": "panel_5", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Deleted - Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(200,201,197,1)", + "id": "bfcaced0-f419-11e9-928e-8f5fd2b6c66e", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(153,172,99,1)", + "id": "a7d935e0-f497-11e9-928e-8f5fd2b6c66e", + "operator": "gt", + "value": 0 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code:4734 OR event.code:4730 OR event.code:4758" + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Groups Deleted", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Groups Deleted - Metric", + "type": "metrics" + } + }, + "id": "e22c6f40-f498-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T08:35:35.777Z", + "version": "WzM1MywxXQ==" + }, { - "id": "400b63e0-f49a-11e9-8405-516218e3d268", - "name": "panel_6", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Created - Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(200,201,197,1)", + "id": "bfcaced0-f419-11e9-928e-8f5fd2b6c66e", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "a7d935e0-f497-11e9-928e-8f5fd2b6c66e", + "operator": "gt", + "value": 0 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code:4731 OR event.code:4727 OR event.code:\"4754\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Groups Created", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Groups Created - Metric", + "type": "metrics" + } + }, + "id": "ee292bc0-f499-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:26:31.457Z", + "version": "WzM3NywxXQ==" + }, { - "id": "a5f664c0-f49a-11e9-8405-516218e3d268", - "name": "panel_7", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Changed - Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(200,201,197,1)", + "id": "bfcaced0-f419-11e9-928e-8f5fd2b6c66e", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(252,196,0,1)", + "id": "a7d935e0-f497-11e9-928e-8f5fd2b6c66e", + "operator": "gt", + "value": 0 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code:4735 OR event.code:4737 OR event.code:\"4755\" OR event.code:\"4764\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "60d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Groups Changed", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Groups Changed - Metric", + "type": "metrics" + } + }, + "id": "400b63e0-f49a-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:21:17.132Z", + "version": "WzM3MSwxXQ==" + }, { - "id": "546febc0-f49b-11e9-8405-516218e3d268", - "name": "panel_8", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Removed - Table", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(176,188,0,1)", + "id": "bfcaced0-f419-11e9-928e-8f5fd2b6c66e", + "operator": "gt", + "value": 0 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code:4733 OR event.code:4727 OR event.code:4729" + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Removed from Group", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Removed - Table", + "type": "metrics" + } + }, + "id": "a5f664c0-f49a-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:06:43.461Z", + "version": "WzM2NSwxXQ==" + }, { - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "name": "panel_9", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Enumeration - Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(159,5,0,1)", + "id": "bfcaced0-f419-11e9-928e-8f5fd2b6c66e", + "operator": "gt", + "value": 0 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code:4799" + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Group Membership Enumeration", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Groups Enumeration - Metric", + "type": "metrics" + } + }, + "id": "546febc0-f49b-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T09:08:11.959Z", + "version": "WzM2NiwxXQ==" + }, { - "id": "98884120-f49d-11e9-8405-516218e3d268", - "name": "panel_10", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4727", + "4728", + "4729", + "4730", + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4754", + "4755", + "4756", + "4757", + "4758", + "4764", + "4799" + ], + "type": "phrases", + "value": "4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Groups vs Actions - Heatmap", + "uiStateJSON": { + "vis": { + "defaultColors": { + "0 - 1": "rgb(247,251,255)", + "1 - 2": "rgb(198,219,239)", + "2 - 3": "rgb(107,174,214)", + "3 - 4": "rgb(33,113,181)" + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 15 + }, + "schema": "segment", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "colorSchema": "Blues", + "colorsNumber": 4, + "colorsRange": [], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + "y": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "enableHover": false, + "invertColors": false, + "legendPosition": "right", + "percentageMode": false, + "setColorRange": false, + "times": [], + "type": "heatmap", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "color": "black", + "overwriteColor": false, + "rotate": 0, + "show": true + }, + "scale": { + "defaultYExtents": false, + "type": "linear" + }, + "show": false, + "type": "value" + } + ] + }, + "title": "Group Management Events - Groups vs Actions - Heatmap", + "type": "heatmap" + } + }, + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:32:05.540Z", + "version": "WzM0NywxXQ==" + }, { - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "name": "panel_11", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4727", + "4754" + ], + "type": "phrases", + "value": "4731, 4727, 4754" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Created - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Groups Created - Table", + "type": "table" + } + }, + "id": "98884120-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:31:28.971Z", + "version": "WzQ3OSwxXQ==" + }, { - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "name": "panel_12", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4735", + "4737", + "4755" + ], + "type": "phrases", + "value": "4735, 4737, 4755" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Changes - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Group Changes - Table", + "type": "table" + } + }, + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:06.806Z", + "version": "WzQ4MCwxXQ==" + }, { - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "name": "panel_13", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4734", + "4730", + "4758" + ], + "type": "phrases", + "value": "4734, 4730, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Deleted - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Groups Deleted - Table", + "type": "table" + } + }, + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:43.899Z", + "version": "WzQ4MSwxXQ==" + }, { - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "name": "panel_14", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4732", + "4728", + "4756" + ], + "type": "phrases", + "value": "4732, 4728, 4756" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Added - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "User", + "field": "winlog.event_data.MemberName", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "6", + "params": { + "customLabel": "Performed by Logon ID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 4, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 5, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Added - Table", + "type": "table" + } + }, + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:09:21.781Z", + "version": "WzM2NywxXQ==" + }, { - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "name": "panel_15", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4733", + "4729", + "4757" + ], + "type": "phrases", + "value": "4733, 4729, 4757" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Removed from Group - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "User", + "field": "winlog.event_data.MemberName", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "6", + "params": { + "customLabel": "Performed by Logon ID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 4, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 5, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Removed from Group - Table", + "type": "table" + } + }, + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:11:21.532Z", + "version": "WzM2OCwxXQ==" + }, { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_16", - "type": "search" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4799" + ], + "type": "phrases", + "value": "4799" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4799" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "5_Group_Enum", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Creator", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Creator LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "5_Group_Enum", + "type": "table" + } + }, + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-10-22T10:43:29.024Z", + "version": "WzI2MiwxXQ==" + }, { - "id": "24954800-fef0-11e9-8405-516218e3d268", - "name": "panel_17", - "type": "visualization" - }, + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4624" + ], + "type": "phrases", + "value": "4624" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4624" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, { - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "name": "panel_18", - "type": "search" - } - ], - "type": "dashboard", - "updated_at": "2019-11-05T15:39:38.478Z", - "version": "WzU2MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Group Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T08:28:57.594Z", - "version": "WzM0MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4764\",\"4799\",\"4727\",\"4737\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:29:51.022Z", - "version": "WzM0NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Action\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:51:18.570Z", - "version": "WzQ0OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}" - }, - "title": "Users Added - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Added - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(128,137,0,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\",\"value\":1},{\"background_color\":\"rgba(211,49,21,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gte\",\"value\":3}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"language\":\"kuery\",\"query\":\"event.code:4732 OR event.code:4728 OR event.code:4756\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Users Added to Group\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "ffebe440-f419-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:06:18.059Z", - "version": "WzM2NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Deleted - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(153,172,99,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4734 OR event.code:4730 OR event.code:4758\",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Deleted\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "e22c6f40-f498-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T08:35:35.777Z", - "version": "WzM1MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Created - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(244,78,59,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4731 OR event.code:4727 OR event.code:\\\"4754\\\" \",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Created\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "ee292bc0-f499-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:26:31.457Z", - "version": "WzM3NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Changed - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Changed - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(252,196,0,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4735 OR event.code:4737 OR event.code:\\\"4755\\\" OR event.code:\\\"4764\\\" \",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"60d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Changed\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "400b63e0-f49a-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:21:17.132Z", - "version": "WzM3MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}" - }, - "title": "Users Removed - Table", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Removed - Table\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Removed from Group\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\",\"background_color\":\"rgba(176,188,0,1)\"}],\"filter\":{\"query\":\"event.code:4733 OR event.code:4727 OR event.code:4729\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "a5f664c0-f49a-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:06:43.461Z", - "version": "WzM2NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Enumeration - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Enumeration - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"value\":0,\"background_color\":\"rgba(159,5,0,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4799\",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Group Membership Enumeration\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "546febc0-f49b-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:08:11.959Z", - "version": "WzM2NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Groups vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Groups vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":15,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:32:05.540Z", - "version": "WzM0NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "98884120-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:31:28.971Z", - "version": "WzQ3OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755\",\"params\":[\"4735\",\"4737\",\"4755\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:06.806Z", - "version": "WzQ4MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4734, 4730, 4758\",\"params\":[\"4734\",\"4730\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:43.899Z", - "version": "WzQ4MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Added - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Added - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:09:21.781Z", - "version": "WzM2NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4729, 4757\",\"params\":[\"4733\",\"4729\",\"4757\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4757\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Removed from Group - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Removed from Group - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:11:21.532Z", - "version": "WzM2OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":[\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "5_Group_Enum", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"5_Group_Enum\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator LogonID\"}}]}" - }, - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-10-22T10:43:29.024Z", - "version": "WzI2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Action Distribution over Time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Action Distribution over Time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-10-05T09:56:42.142Z\",\"max\":\"2019-11-04T10:56:42.142Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "24954800-fef0-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:56:51.856Z", - "version": "WzQ1MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "group.name", - "group.domain", - "user.name", - "user.domain", - "host.name" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Group Management Details - Search View", - "version": 1 - }, - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4764", + "4799", + "4727", + "4728", + "4729", + "4730", + "4754", + "4755", + "4756", + "4757", + "4758" + ], + "type": "phrases", + "value": "4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Group Management Action Distribution over Time", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "drop_partials": false, + "extended_bounds": {}, + "field": "@timestamp", + "interval": "auto", + "min_doc_count": 1, + "timeRange": { + "from": "now-30d", + "to": "now" + }, + "useNormalizedEsInterval": true + }, + "schema": "segment", + "type": "date_histogram" + }, + { + "enabled": true, + "id": "3", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTimeMarker": false, + "addTooltip": true, + "categoryAxes": [ + { + "id": "CategoryAxis-1", + "labels": { + "filter": true, + "show": true, + "truncate": 100 + }, + "position": "bottom", + "scale": { + "type": "linear" + }, + "show": true, + "style": {}, + "title": {}, + "type": "category" + } + ], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "date_histogram", + "format": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm" + } + }, + "params": { + "bounds": { + "max": "2019-11-04T10:56:42.142Z", + "min": "2019-10-05T09:56:42.142Z" + }, + "date": true, + "format": "YYYY-MM-DD HH:mm", + "interval": "PT12H" + } + }, + "y": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "grid": { + "categoryLines": false + }, + "labels": { + "show": true + }, + "legendPosition": "bottom", + "seriesParams": [ + { + "data": { + "id": "1", + "label": "Count" + }, + "drawLinesBetweenPoints": true, + "mode": "stacked", + "show": "true", + "showCircles": true, + "type": "histogram", + "valueAxis": "ValueAxis-1" + } + ], + "times": [], + "type": "histogram", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "filter": false, + "rotate": 0, + "show": true, + "truncate": 100 + }, + "name": "LeftAxis-1", + "position": "left", + "scale": { + "mode": "normal", + "type": "linear" + }, + "show": true, + "style": {}, + "title": { + "text": "Count" + }, + "type": "value" + } + ] + }, + "title": "Group Management Action Distribution over Time", + "type": "histogram" + } + }, + "id": "24954800-fef0-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:56:51.856Z", + "version": "WzQ1MiwxXQ==" + }, { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" + "attributes": { + "columns": [ + "event.action", + "group.name", + "group.domain", + "user.name", + "user.domain", + "host.name" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4764", + "4799", + "4727", + "4728", + "4729", + "4730", + "4754", + "4755", + "4756", + "4757", + "4758" + ], + "type": "phrases", + "value": "4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Group Management Details - Search View", + "version": 1 + }, + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T11:02:16.971Z", + "version": "WzQ2MCwxXQ==" } - ], - "type": "search", - "updated_at": "2019-11-04T11:02:16.971Z", - "version": "WzQ2MCwxXQ==" - } - ], - "version": "7.3.1" -} + ], + "version": "7.3.1" +} \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json index f4d6eeb8c65..69d0fb635b3 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json @@ -1,722 +1,4154 @@ { - "objects": [ - { - "attributes": { - "description": "Uses Simple Metric Visualizations", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":17,\"h\":22,\"i\":\"22\"},\"panelIndex\":\"22\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":17,\"y\":0,\"w\":22,\"h\":22,\"i\":\"23\"},\"panelIndex\":\"23\",\"title\":\"Group Management Actions\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":39,\"y\":0,\"w\":9,\"h\":22,\"i\":\"25\"},\"panelIndex\":\"25\",\"title\":\"Event Codes\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"},\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":22,\"w\":26,\"h\":21,\"i\":\"35\"},\"panelIndex\":\"35\",\"title\":\"Actions performed over Groups\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":52,\"w\":9,\"h\":13,\"i\":\"36\"},\"panelIndex\":\"36\",\"title\":\"Group Creation Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":52,\"w\":9,\"h\":13,\"i\":\"37\"},\"panelIndex\":\"37\",\"title\":\"Group Changes Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":52,\"w\":9,\"h\":13,\"i\":\"38\"},\"panelIndex\":\"38\",\"title\":\"Group Deletion Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":72,\"w\":16,\"h\":14,\"i\":\"39\"},\"panelIndex\":\"39\",\"title\":\"Users Added to Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":16,\"y\":72,\"w\":17,\"h\":14,\"i\":\"40\"},\"panelIndex\":\"40\",\"title\":\"Users Removed From Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":33,\"y\":72,\"w\":15,\"h\":14,\"i\":\"42\"},\"panelIndex\":\"42\",\"title\":\"Group Membership Enumeration Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":43,\"w\":21,\"h\":22,\"i\":\"43\"},\"panelIndex\":\"43\",\"title\":\"Logon Details \",\"version\":\"7.3.1\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":65,\"w\":16,\"h\":7,\"i\":\"44\"},\"panelIndex\":\"44\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":43,\"w\":9,\"h\":9,\"i\":\"45\"},\"panelIndex\":\"45\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":43,\"w\":9,\"h\":9,\"i\":\"46\"},\"panelIndex\":\"46\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":43,\"w\":9,\"h\":9,\"i\":\"47\"},\"panelIndex\":\"47\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":16,\"y\":65,\"w\":17,\"h\":7,\"i\":\"48\"},\"panelIndex\":\"48\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":33,\"y\":65,\"w\":15,\"h\":7,\"i\":\"49\"},\"panelIndex\":\"49\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_16\"},{\"gridData\":{\"x\":26,\"y\":22,\"w\":22,\"h\":21,\"i\":\"50\"},\"version\":\"7.3.1\",\"panelIndex\":\"50\",\"embeddableConfig\":{},\"panelRefName\":\"panel_17\"},{\"gridData\":{\"x\":0,\"y\":86,\"w\":48,\"h\":21,\"i\":\"51\"},\"version\":\"7.3.1\",\"panelIndex\":\"51\",\"embeddableConfig\":{},\"panelRefName\":\"panel_18\"}]", - "timeRestore": false, - "title": "[winlogbeat] Group Management Events - Simple Metrics", - "version": 1 - }, - "id": "01c54730-fee6-11e9-8405-516218e3d268", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ + "objects": [ { - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "name": "panel_0", - "type": "visualization" - }, + "attributes": { + "description": "Uses Simple Metric Visualizations", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": {}, + "gridData": { + "h": 22, + "i": "22", + "w": 17, + "x": 0, + "y": 0 + }, + "panelIndex": "22", + "panelRefName": "panel_0", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": { + "vis": { + "legendOpen": false + } + }, + "gridData": { + "h": 22, + "i": "23", + "w": 22, + "x": 17, + "y": 0 + }, + "panelIndex": "23", + "panelRefName": "panel_1", + "title": "Group Management Actions", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 22, + "i": "25", + "w": 9, + "x": 39, + "y": 0 + }, + "panelIndex": "25", + "panelRefName": "panel_2", + "title": "Event Codes", + "version": "7.3.1" + }, + { + "embeddableConfig": { + "vis": { + "defaultColors": { + "0 - 1": "rgb(247,251,255)", + "1 - 2": "rgb(198,219,239)", + "2 - 3": "rgb(107,174,214)", + "3 - 4": "rgb(33,113,181)" + }, + "legendOpen": false + } + }, + "gridData": { + "h": 21, + "i": "35", + "w": 26, + "x": 0, + "y": 22 + }, + "panelIndex": "35", + "panelRefName": "panel_3", + "title": "Actions performed over Groups", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 13, + "i": "36", + "w": 9, + "x": 0, + "y": 52 + }, + "panelIndex": "36", + "panelRefName": "panel_4", + "title": "Group Creation Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 13, + "i": "37", + "w": 9, + "x": 9, + "y": 52 + }, + "panelIndex": "37", + "panelRefName": "panel_5", + "title": "Group Changes Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 13, + "i": "38", + "w": 9, + "x": 18, + "y": 52 + }, + "panelIndex": "38", + "panelRefName": "panel_6", + "title": "Group Deletion Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 14, + "i": "39", + "w": 16, + "x": 0, + "y": 72 + }, + "panelIndex": "39", + "panelRefName": "panel_7", + "title": "Users Added to Group Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 14, + "i": "40", + "w": 17, + "x": 16, + "y": 72 + }, + "panelIndex": "40", + "panelRefName": "panel_8", + "title": "Users Removed From Group Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 14, + "i": "42", + "w": 15, + "x": 33, + "y": 72 + }, + "panelIndex": "42", + "panelRefName": "panel_9", + "title": "Group Membership Enumeration Summary", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 22, + "i": "43", + "w": 21, + "x": 27, + "y": 43 + }, + "panelIndex": "43", + "panelRefName": "panel_10", + "title": "Logon Details ", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "44", + "w": 16, + "x": 0, + "y": 65 + }, + "panelIndex": "44", + "panelRefName": "panel_11", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 9, + "i": "45", + "w": 9, + "x": 18, + "y": 43 + }, + "panelIndex": "45", + "panelRefName": "panel_12", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 9, + "i": "46", + "w": 9, + "x": 0, + "y": 43 + }, + "panelIndex": "46", + "panelRefName": "panel_13", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 9, + "i": "47", + "w": 9, + "x": 9, + "y": 43 + }, + "panelIndex": "47", + "panelRefName": "panel_14", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "48", + "w": 17, + "x": 16, + "y": 65 + }, + "panelIndex": "48", + "panelRefName": "panel_15", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "49", + "w": 15, + "x": 33, + "y": 65 + }, + "panelIndex": "49", + "panelRefName": "panel_16", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 21, + "i": "50", + "w": 22, + "x": 26, + "y": 22 + }, + "panelIndex": "50", + "panelRefName": "panel_17", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 21, + "i": "51", + "w": 48, + "x": 0, + "y": 86 + }, + "panelIndex": "51", + "panelRefName": "panel_18", + "version": "7.3.1" + } + ], + "timeRestore": false, + "title": "[winlogbeat] Group Management Events - Simple Metrics", + "version": 1 + }, + "id": "01c54730-fee6-11e9-8405-516218e3d268", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "98884120-f49d-11e9-8405-516218e3d268", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_10", + "type": "search" + }, + { + "id": "a13bf640-fee8-11e9-8405-516218e3d268", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "f42f3b20-fee6-11e9-8405-516218e3d268", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "b5f38780-fee6-11e9-8405-516218e3d268", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "1b5f17d0-feea-11e9-8405-516218e3d268", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "0f2f5280-feeb-11e9-8405-516218e3d268", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "24954800-fef0-11e9-8405-516218e3d268", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "name": "panel_18", + "type": "search" + } + ], + "type": "dashboard", + "updated_at": "2019-11-04T15:38:34.464Z", + "version": "WzUyMSwxXQ==" + }, { - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "name": "panel_1", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Description", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 10, + "markdown": "# **Group Management Events**\n\n#### This dashboard shows information about Group Management Events collected by winlogbeat\n#\n#\n#\nEvent | Description|Event | Description\n-- | --|--|--\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \n|4758|A security-enabled universal group was deleted.| 4764|A group\\'s type was changed.|\n|4799|A security-enabled local group membership was enumerated.|", + "openLinksInNewTab": false + }, + "title": "Group Management Events - Description", + "type": "markdown" + } + }, + "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T08:28:57.594Z", + "version": "WzM0MywxXQ==" + }, { - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "name": "panel_2", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4732", + "4733", + "4734", + "4735", + "4764", + "4799", + "4727", + "4737", + "4728", + "4729", + "4730", + "4754", + "4755", + "4756", + "4757", + "4758" + ], + "type": "phrases", + "value": "4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Event Actions - Donut", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "segment", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metric": { + "accessor": 1, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + }, + "isDonut": true, + "labels": { + "last_level": true, + "show": true, + "truncate": 100, + "values": true + }, + "legendPosition": "right", + "type": "pie" + }, + "title": "Group Management Events - Event Actions - Donut", + "type": "pie" + } + }, + "id": "b01aaea0-f415-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:29:51.022Z", + "version": "WzM0NCwxXQ==" + }, { - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "name": "panel_3", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4727", + "4728", + "4729", + "4730", + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4754", + "4755", + "4756", + "4757", + "4758", + "4764", + "4799" + ], + "type": "phrases", + "value": "4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Event Actions - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Event Action", + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Event Code", + "field": "event.code", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Group Management Events - Event Actions - Table", + "type": "table" + } + }, + "id": "11b5c0e0-f417-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:51:18.570Z", + "version": "WzQ0OSwxXQ==" + }, { - "id": "98884120-f49d-11e9-8405-516218e3d268", - "name": "panel_4", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4727", + "4728", + "4729", + "4730", + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4754", + "4755", + "4756", + "4757", + "4758", + "4764", + "4799" + ], + "type": "phrases", + "value": "4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Management Events - Groups vs Actions - Heatmap", + "uiStateJSON": { + "vis": { + "defaultColors": { + "0 - 1": "rgb(247,251,255)", + "1 - 2": "rgb(198,219,239)", + "2 - 3": "rgb(107,174,214)", + "3 - 4": "rgb(33,113,181)" + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 15 + }, + "schema": "segment", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "colorSchema": "Blues", + "colorsNumber": 4, + "colorsRange": [], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + "y": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "enableHover": false, + "invertColors": false, + "legendPosition": "right", + "percentageMode": false, + "setColorRange": false, + "times": [], + "type": "heatmap", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "color": "black", + "overwriteColor": false, + "rotate": 0, + "show": true + }, + "scale": { + "defaultYExtents": false, + "type": "linear" + }, + "show": false, + "type": "value" + } + ] + }, + "title": "Group Management Events - Groups vs Actions - Heatmap", + "type": "heatmap" + } + }, + "id": "b948eaf0-f49c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T08:32:05.540Z", + "version": "WzM0NywxXQ==" + }, { - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "name": "panel_5", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4727", + "4754" + ], + "type": "phrases", + "value": "4731, 4727, 4754" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Created - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Groups Created - Table", + "type": "table" + } + }, + "id": "98884120-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:31:28.971Z", + "version": "WzQ3OSwxXQ==" + }, { - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "name": "panel_6", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4735", + "4737", + "4755" + ], + "type": "phrases", + "value": "4735, 4737, 4755" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Group Changes - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Group Changes - Table", + "type": "table" + } + }, + "id": "9e534190-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:06.806Z", + "version": "WzQ4MCwxXQ==" + }, { - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "name": "panel_7", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4734", + "4730", + "4758" + ], + "type": "phrases", + "value": "4734, 4730, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Groups Deleted - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Groups Deleted - Table", + "type": "table" + } + }, + "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:32:43.899Z", + "version": "WzQ4MSwxXQ==" + }, { - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "name": "panel_8", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4732", + "4728", + "4756" + ], + "type": "phrases", + "value": "4732, 4728, 4756" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Added - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "User", + "field": "winlog.event_data.MemberName", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "6", + "params": { + "customLabel": "Performed by Logon ID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 4, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 5, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Added - Table", + "type": "table" + } + }, + "id": "ce867840-f49e-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:09:21.781Z", + "version": "WzM2NywxXQ==" + }, { - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "name": "panel_9", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4733", + "4729", + "4757" + ], + "type": "phrases", + "value": "4733, 4729, 4757" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Removed from Group - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "User", + "field": "winlog.event_data.MemberName", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Performed by", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "6", + "params": { + "customLabel": "Performed by Logon ID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 4, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 5, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Removed from Group - Table", + "type": "table" + } + }, + "id": "fee83900-f49f-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T09:11:21.532Z", + "version": "WzM2OCwxXQ==" + }, { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_10", - "type": "search" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4799" + ], + "type": "phrases", + "value": "4799" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4799" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "5_Group_Enum", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Group", + "field": "group.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 20 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Domain", + "field": "group.domain", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Creator", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "5", + "params": { + "customLabel": "Creator LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 3, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 4, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 5, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "5_Group_Enum", + "type": "table" + } + }, + "id": "bc165210-f4b8-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-10-22T10:43:29.024Z", + "version": "WzI2MiwxXQ==" + }, { - "id": "a13bf640-fee8-11e9-8405-516218e3d268", - "name": "panel_11", - "type": "visualization" - }, + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4624" + ], + "type": "phrases", + "value": "4624" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4624" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, { - "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", - "name": "panel_12", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4732", + "4728", + "4756" + ], + "type": "phrases", + "value": "4732, 4728, 4756" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Added - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Users Added to Groups" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Reds", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "Background", + "percentageMode": false, + "style": { + "bgColor": true, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Added - Simple Metric", + "type": "metric" + } + }, + "id": "a13bf640-fee8-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:29:24.078Z", + "version": "WzQzMSwxXQ==" + }, { - "id": "f42f3b20-fee6-11e9-8405-516218e3d268", - "name": "panel_13", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4734", + "4730", + "4758" + ], + "type": "phrases", + "value": "4734, 4730, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Groups Deleted- Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Groups Deleted" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Greens", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "Background", + "percentageMode": false, + "style": { + "bgColor": true, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Groups Deleted- Simple Metric", + "type": "metric" + } + }, + "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:28:52.621Z", + "version": "WzQzMCwxXQ==" + }, { - "id": "b5f38780-fee6-11e9-8405-516218e3d268", - "name": "panel_14", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4727", + "4754" + ], + "type": "phrases", + "value": "4731, 4727, 4754" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Groups Created - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Groups Created" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Reds", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "Background", + "percentageMode": false, + "style": { + "bgColor": true, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Groups Created - Simple Metric", + "type": "metric" + } + }, + "id": "f42f3b20-fee6-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:28:05.274Z", + "version": "WzQyOCwxXQ==" + }, { - "id": "1b5f17d0-feea-11e9-8405-516218e3d268", - "name": "panel_15", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4735", + "4737", + "4755", + "4764" + ], + "type": "phrases", + "value": "4735, 4737, 4755, 4764" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Groups Changes - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Groups Changed" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Greys", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "Background", + "percentageMode": false, + "style": { + "bgColor": true, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Groups Changes - Simple Metric", + "type": "metric" + } + }, + "id": "b5f38780-fee6-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:28:25.310Z", + "version": "WzQyOSwxXQ==" + }, { - "id": "0f2f5280-feeb-11e9-8405-516218e3d268", - "name": "panel_16", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4733", + "4727", + "4729" + ], + "type": "phrases", + "value": "4733, 4727, 4729" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Removed from Group - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Users Removed from Groups" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Greens", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "Background", + "percentageMode": false, + "style": { + "bgColor": true, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Removed from Group - Simple Metric", + "type": "metric" + } + }, + "id": "1b5f17d0-feea-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:29:51.186Z", + "version": "WzQzMiwxXQ==" + }, { - "id": "24954800-fef0-11e9-8405-516218e3d268", - "name": "panel_17", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4799" + }, + "type": "phrase", + "value": "4799" + }, + "query": { + "match": { + "event.code": { + "query": "4799", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Group Membership Enumeration - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Group Membership Enumerated" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Blues", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": true, + "labels": { + "show": true + }, + "metricColorMode": "Background", + "percentageMode": false, + "style": { + "bgColor": true, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Group Membership Enumeration - Simple Metric", + "type": "metric" + } + }, + "id": "0f2f5280-feeb-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:30:31.143Z", + "version": "WzQzMywxXQ==" + }, { - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "name": "panel_18", - "type": "search" - } - ], - "type": "dashboard", - "updated_at": "2019-11-04T15:38:34.464Z", - "version": "WzUyMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Group Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T08:28:57.594Z", - "version": "WzM0MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4764\",\"4799\",\"4727\",\"4737\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:29:51.022Z", - "version": "WzM0NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Action\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:51:18.570Z", - "version": "WzQ0OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Groups vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Groups vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":15,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:32:05.540Z", - "version": "WzM0NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "98884120-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:31:28.971Z", - "version": "WzQ3OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755\",\"params\":[\"4735\",\"4737\",\"4755\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:06.806Z", - "version": "WzQ4MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4734, 4730, 4758\",\"params\":[\"4734\",\"4730\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:43.899Z", - "version": "WzQ4MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Added - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Added - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:09:21.781Z", - "version": "WzM2NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4729, 4757\",\"params\":[\"4733\",\"4729\",\"4757\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4757\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Removed from Group - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Removed from Group - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:11:21.532Z", - "version": "WzM2OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":[\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "5_Group_Enum", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"5_Group_Enum\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator LogonID\"}}]}" - }, - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-10-22T10:43:29.024Z", - "version": "WzI2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Added - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Added - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Reds\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Added to Groups\"}}]}" - }, - "id": "a13bf640-fee8-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:29:24.078Z", - "version": "WzQzMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"event.code\",\"negate\":false,\"params\":[\"4734\",\"4730\",\"4758\"],\"type\":\"phrases\",\"value\":\"4734, 4730, 4758\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}]}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Deleted- Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted- Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greens\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Deleted\"}}]}" - }, - "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:28:52.621Z", - "version": "WzQzMCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Created - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Reds\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Created\"}}]}" - }, - "id": "f42f3b20-fee6-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:28:05.274Z", - "version": "WzQyOCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755, 4764\",\"params\":[\"4735\",\"4737\",\"4755\",\"4764\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4764\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Changes - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Changes - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greys\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Changed\"}}]}" - }, - "id": "b5f38780-fee6-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:28:25.310Z", - "version": "WzQyOSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4727, 4729\",\"params\":[\"4733\",\"4727\",\"4729\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4729\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Removed from Group - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Removed from Group - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greens\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Removed from Groups\"}}]}" - }, - "id": "1b5f17d0-feea-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:29:51.186Z", - "version": "WzQzMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":{\"query\":\"4799\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4799\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Membership Enumeration - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Membership Enumeration - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Blues\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":true,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Group Membership Enumerated\"}}]}" - }, - "id": "0f2f5280-feeb-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:30:31.143Z", - "version": "WzQzMywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Action Distribution over Time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Action Distribution over Time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-10-05T09:56:42.142Z\",\"max\":\"2019-11-04T10:56:42.142Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "24954800-fef0-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:56:51.856Z", - "version": "WzQ1MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "group.name", - "group.domain", - "user.name", - "user.domain", - "host.name" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Group Management Details - Search View", - "version": 1 - }, - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4764", + "4799", + "4727", + "4728", + "4729", + "4730", + "4754", + "4755", + "4756", + "4757", + "4758" + ], + "type": "phrases", + "value": "4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Group Management Action Distribution over Time", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "drop_partials": false, + "extended_bounds": {}, + "field": "@timestamp", + "interval": "auto", + "min_doc_count": 1, + "timeRange": { + "from": "now-30d", + "to": "now" + }, + "useNormalizedEsInterval": true + }, + "schema": "segment", + "type": "date_histogram" + }, + { + "enabled": true, + "id": "3", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTimeMarker": false, + "addTooltip": true, + "categoryAxes": [ + { + "id": "CategoryAxis-1", + "labels": { + "filter": true, + "show": true, + "truncate": 100 + }, + "position": "bottom", + "scale": { + "type": "linear" + }, + "show": true, + "style": {}, + "title": {}, + "type": "category" + } + ], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "date_histogram", + "format": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm" + } + }, + "params": { + "bounds": { + "max": "2019-11-04T10:56:42.142Z", + "min": "2019-10-05T09:56:42.142Z" + }, + "date": true, + "format": "YYYY-MM-DD HH:mm", + "interval": "PT12H" + } + }, + "y": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "grid": { + "categoryLines": false + }, + "labels": { + "show": true + }, + "legendPosition": "bottom", + "seriesParams": [ + { + "data": { + "id": "1", + "label": "Count" + }, + "drawLinesBetweenPoints": true, + "mode": "stacked", + "show": "true", + "showCircles": true, + "type": "histogram", + "valueAxis": "ValueAxis-1" + } + ], + "times": [], + "type": "histogram", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "filter": false, + "rotate": 0, + "show": true, + "truncate": 100 + }, + "name": "LeftAxis-1", + "position": "left", + "scale": { + "mode": "normal", + "type": "linear" + }, + "show": true, + "style": {}, + "title": { + "text": "Count" + }, + "type": "value" + } + ] + }, + "title": "Group Management Action Distribution over Time", + "type": "histogram" + } + }, + "id": "24954800-fef0-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:56:51.856Z", + "version": "WzQ1MiwxXQ==" + }, { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" + "attributes": { + "columns": [ + "event.action", + "group.name", + "group.domain", + "user.name", + "user.domain", + "host.name" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4731", + "4732", + "4733", + "4734", + "4735", + "4737", + "4764", + "4799", + "4727", + "4728", + "4729", + "4730", + "4754", + "4755", + "4756", + "4757", + "4758" + ], + "type": "phrases", + "value": "4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4731" + } + }, + { + "match_phrase": { + "event.code": "4732" + } + }, + { + "match_phrase": { + "event.code": "4733" + } + }, + { + "match_phrase": { + "event.code": "4734" + } + }, + { + "match_phrase": { + "event.code": "4735" + } + }, + { + "match_phrase": { + "event.code": "4737" + } + }, + { + "match_phrase": { + "event.code": "4764" + } + }, + { + "match_phrase": { + "event.code": "4799" + } + }, + { + "match_phrase": { + "event.code": "4727" + } + }, + { + "match_phrase": { + "event.code": "4728" + } + }, + { + "match_phrase": { + "event.code": "4729" + } + }, + { + "match_phrase": { + "event.code": "4730" + } + }, + { + "match_phrase": { + "event.code": "4754" + } + }, + { + "match_phrase": { + "event.code": "4755" + } + }, + { + "match_phrase": { + "event.code": "4756" + } + }, + { + "match_phrase": { + "event.code": "4757" + } + }, + { + "match_phrase": { + "event.code": "4758" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Group Management Details - Search View", + "version": 1 + }, + "id": "9066d5b0-fef2-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T11:02:16.971Z", + "version": "WzQ2MCwxXQ==" } - ], - "type": "search", - "updated_at": "2019-11-04T11:02:16.971Z", - "version": "WzQ2MCwxXQ==" - } - ], - "version": "7.3.1" -} + ], + "version": "7.3.1" +} \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json index fa95d5ac824..e78bacc2191 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json @@ -1,778 +1,4073 @@ { - "objects": [ - { - "attributes": { - "description": "Includes Visual Builder Metric Interval size 90 days", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":17,\"h\":19,\"i\":\"1\"},\"panelIndex\":\"1\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":17,\"y\":0,\"w\":18,\"h\":19,\"i\":\"2\"},\"panelIndex\":\"2\",\"title\":\"User Management Actions\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":46,\"w\":9,\"h\":16,\"i\":\"3\"},\"panelIndex\":\"3\",\"title\":\"Created Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":35,\"y\":0,\"w\":13,\"h\":19,\"i\":\"4\"},\"panelIndex\":\"4\",\"title\":\"Event Codes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":46,\"w\":9,\"h\":16,\"i\":\"5\"},\"panelIndex\":\"5\",\"title\":\"Enabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":69,\"w\":9,\"h\":16,\"i\":\"6\"},\"panelIndex\":\"6\",\"title\":\"Disabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":46,\"w\":9,\"h\":16,\"i\":\"7\"},\"panelIndex\":\"7\",\"title\":\"Deleted Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 4\":\"rgb(247,252,245)\",\"12 - 16\":\"rgb(35,139,69)\",\"4 - 8\":\"rgb(199,233,192)\",\"8 - 12\":\"rgb(116,196,118)\"},\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":19,\"w\":27,\"h\":20,\"i\":\"8\"},\"panelIndex\":\"8\",\"title\":\"Actions performed over Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":69,\"w\":9,\"h\":16,\"i\":\"9\"},\"panelIndex\":\"9\",\"title\":\"Passwords Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":69,\"w\":9,\"h\":16,\"i\":\"15\"},\"panelIndex\":\"15\",\"title\":\"Unlocked Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":36,\"y\":69,\"w\":12,\"h\":16,\"i\":\"16\"},\"panelIndex\":\"16\",\"title\":\"Users Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":69,\"w\":9,\"h\":16,\"i\":\"20\"},\"panelIndex\":\"20\",\"title\":\"Locked-out Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":19,\"w\":21,\"h\":20,\"i\":\"21\"},\"panelIndex\":\"21\",\"title\":\"User Management Actions Distributions over Time\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":39,\"w\":21,\"h\":23,\"i\":\"22\"},\"panelIndex\":\"22\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":85,\"w\":48,\"h\":19,\"i\":\"23\"},\"panelIndex\":\"23\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"gridData\":{\"x\":0,\"y\":62,\"w\":9,\"h\":7,\"i\":\"24\"},\"version\":\"7.3.1\",\"panelIndex\":\"24\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_15\"},{\"gridData\":{\"x\":9,\"y\":39,\"w\":9,\"h\":7,\"i\":\"25\"},\"version\":\"7.3.1\",\"panelIndex\":\"25\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_16\"},{\"gridData\":{\"x\":18,\"y\":39,\"w\":9,\"h\":7,\"i\":\"26\"},\"version\":\"7.3.1\",\"panelIndex\":\"26\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_17\"},{\"gridData\":{\"x\":0,\"y\":39,\"w\":9,\"h\":7,\"i\":\"27\"},\"version\":\"7.3.1\",\"panelIndex\":\"27\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_18\"},{\"gridData\":{\"x\":9,\"y\":62,\"w\":9,\"h\":7,\"i\":\"28\"},\"version\":\"7.3.1\",\"panelIndex\":\"28\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_19\"},{\"gridData\":{\"x\":18,\"y\":62,\"w\":9,\"h\":7,\"i\":\"29\"},\"version\":\"7.3.1\",\"panelIndex\":\"29\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_20\"},{\"gridData\":{\"x\":27,\"y\":62,\"w\":9,\"h\":7,\"i\":\"30\"},\"version\":\"7.3.1\",\"panelIndex\":\"30\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_21\"},{\"gridData\":{\"x\":36,\"y\":62,\"w\":12,\"h\":7,\"i\":\"31\"},\"version\":\"7.3.1\",\"panelIndex\":\"31\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_22\"}]", - "timeRestore": false, - "title": "[winlogbeat] User Management Events", - "version": 1 - }, - "id": "71f720f0-ff18-11e9-8405-516218e3d268", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ + "objects": [ { - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "name": "panel_0", - "type": "visualization" - }, + "attributes": { + "description": "Includes Visual Builder Metric Interval size 90 days", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": {}, + "gridData": { + "h": 19, + "i": "1", + "w": 17, + "x": 0, + "y": 0 + }, + "panelIndex": "1", + "panelRefName": "panel_0", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": { + "vis": { + "legendOpen": false + } + }, + "gridData": { + "h": 19, + "i": "2", + "w": 18, + "x": 17, + "y": 0 + }, + "panelIndex": "2", + "panelRefName": "panel_1", + "title": "User Management Actions", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "3", + "w": 9, + "x": 0, + "y": 46 + }, + "panelIndex": "3", + "panelRefName": "panel_2", + "title": "Created Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 19, + "i": "4", + "w": 13, + "x": 35, + "y": 0 + }, + "panelIndex": "4", + "panelRefName": "panel_3", + "title": "Event Codes", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "5", + "w": 9, + "x": 9, + "y": 46 + }, + "panelIndex": "5", + "panelRefName": "panel_4", + "title": "Enabled Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "6", + "w": 9, + "x": 0, + "y": 69 + }, + "panelIndex": "6", + "panelRefName": "panel_5", + "title": "Disabled Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "7", + "w": 9, + "x": 18, + "y": 46 + }, + "panelIndex": "7", + "panelRefName": "panel_6", + "title": "Deleted Users", + "version": "7.3.0" + }, + { + "embeddableConfig": { + "vis": { + "defaultColors": { + "0 - 4": "rgb(247,252,245)", + "12 - 16": "rgb(35,139,69)", + "4 - 8": "rgb(199,233,192)", + "8 - 12": "rgb(116,196,118)" + }, + "legendOpen": false + } + }, + "gridData": { + "h": 20, + "i": "8", + "w": 27, + "x": 0, + "y": 19 + }, + "panelIndex": "8", + "panelRefName": "panel_7", + "title": "Actions performed over Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "9", + "w": 9, + "x": 18, + "y": 69 + }, + "panelIndex": "9", + "panelRefName": "panel_8", + "title": "Passwords Changes", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "15", + "w": 9, + "x": 9, + "y": 69 + }, + "panelIndex": "15", + "panelRefName": "panel_9", + "title": "Unlocked Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "16", + "w": 12, + "x": 36, + "y": 69 + }, + "panelIndex": "16", + "panelRefName": "panel_10", + "title": "Users Changes", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "20", + "w": 9, + "x": 27, + "y": 69 + }, + "panelIndex": "20", + "panelRefName": "panel_11", + "title": "Locked-out Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 20, + "i": "21", + "w": 21, + "x": 27, + "y": 19 + }, + "panelIndex": "21", + "panelRefName": "panel_12", + "title": "User Management Actions Distributions over Time", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 23, + "i": "22", + "w": 21, + "x": 27, + "y": 39 + }, + "panelIndex": "22", + "panelRefName": "panel_13", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 19, + "i": "23", + "w": 48, + "x": 0, + "y": 85 + }, + "panelIndex": "23", + "panelRefName": "panel_14", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "24", + "w": 9, + "x": 0, + "y": 62 + }, + "panelIndex": "24", + "panelRefName": "panel_15", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "25", + "w": 9, + "x": 9, + "y": 39 + }, + "panelIndex": "25", + "panelRefName": "panel_16", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "26", + "w": 9, + "x": 18, + "y": 39 + }, + "panelIndex": "26", + "panelRefName": "panel_17", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "27", + "w": 9, + "x": 0, + "y": 39 + }, + "panelIndex": "27", + "panelRefName": "panel_18", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "28", + "w": 9, + "x": 9, + "y": 62 + }, + "panelIndex": "28", + "panelRefName": "panel_19", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "29", + "w": 9, + "x": 18, + "y": 62 + }, + "panelIndex": "29", + "panelRefName": "panel_20", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "30", + "w": 9, + "x": 27, + "y": 62 + }, + "panelIndex": "30", + "panelRefName": "panel_21", + "title": "", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 7, + "i": "31", + "w": 12, + "x": 36, + "y": 62 + }, + "panelIndex": "31", + "panelRefName": "panel_22", + "title": "", + "version": "7.3.1" + } + ], + "timeRestore": false, + "title": "[winlogbeat] User Management Events", + "version": 1 + }, + "id": "71f720f0-ff18-11e9-8405-516218e3d268", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_13", + "type": "search" + }, + { + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "name": "panel_14", + "type": "search" + }, + { + "id": "97c70300-ff1c-11e9-8405-516218e3d268", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", + "name": "panel_18", + "type": "visualization" + }, + { + "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", + "name": "panel_19", + "type": "visualization" + }, + { + "id": "60301890-ff1d-11e9-8405-516218e3d268", + "name": "panel_20", + "type": "visualization" + }, + { + "id": "9dd22440-ff1d-11e9-8405-516218e3d268", + "name": "panel_21", + "type": "visualization" + }, + { + "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", + "name": "panel_22", + "type": "visualization" + } + ], + "type": "dashboard", + "updated_at": "2019-11-05T15:40:21.391Z", + "version": "WzU2MiwxXQ==" + }, { - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "name": "panel_1", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Description", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 10, + "markdown": "# **User Management Events**\n\n#### This dashboard shows information about User Management Events collected by winlogbeat\n#\n#\n#\nEvent | Description\n-- | --\n4720 | A user account was created\n4722 | A user account was enabled\n4723 | An attempt was made to change an account's password\n4724 | An attempt was made to reset an account's password\n4725 | An user account was disabled\n4726 | An user account was deleted\n4738 | An user account was changed\n4740 | An user account was locked out\n4767 | An account was unlocked\n4781 | The name of an account was changed", + "openLinksInNewTab": false + }, + "title": "User Management Events - Description", + "type": "markdown" + } + }, + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T10:20:41.549Z", + "version": "WzQxNywxXQ==" + }, { - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "name": "panel_2", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4765", + "4766", + "4767", + "4780", + "4781", + "4794", + "5376", + "5377" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4765" + } + }, + { + "match_phrase": { + "event.code": "4766" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4780" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4794" + } + }, + { + "match_phrase": { + "event.code": "5376" + } + }, + { + "match_phrase": { + "event.code": "5377" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Event Actions - Donut", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "segment", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metric": { + "accessor": 1, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + }, + "isDonut": true, + "labels": { + "last_level": true, + "show": true, + "truncate": 100, + "values": true + }, + "legendPosition": "right", + "type": "pie" + }, + "title": "User Management Events - Event Actions - Donut", + "type": "pie" + } + }, + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T11:13:23.297Z", + "version": "WzQ2NiwxXQ==" + }, { - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "name": "panel_3", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4720" + }, + "type": "phrase", + "value": "4720" + }, + "query": { + "match": { + "event.code": { + "query": "4720", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Created - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Created User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Created - Table", + "type": "table" + } + }, + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:35:21.465Z", + "version": "WzQ4NSwxXQ==" + }, { - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_4", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4765", + "4766", + "4767", + "4780", + "4781", + "4794", + "5376", + "5377" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4765" + } + }, + { + "match_phrase": { + "event.code": "4766" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4780" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4794" + } + }, + { + "match_phrase": { + "event.code": "5376" + } + }, + { + "match_phrase": { + "event.code": "5377" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Event Actions - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Event Short Description", + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Event Code", + "field": "event.code", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "User Management Events - Event Actions - Table", + "type": "table" + } + }, + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:23:43.282Z", + "version": "WzQyMiwxXQ==" + }, { - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_5", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4722" + }, + "type": "phrase", + "value": "4722" + }, + "query": { + "match": { + "event.code": { + "query": "4722", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Enabled - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Enabled User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Enabled - Table", + "type": "table" + } + }, + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:37:53.874Z", + "version": "WzQ4NywxXQ==" + }, { - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_6", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4725" + }, + "type": "phrase", + "value": "4725" + }, + "query": { + "match": { + "event.code": { + "query": "4725", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Disabled - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Disabled User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Disabled - Table", + "type": "table" + } + }, + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:15:00.943Z", + "version": "WzUwNCwxXQ==" + }, { - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "name": "panel_7", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4726" + }, + "type": "phrase", + "value": "4726" + }, + "query": { + "match": { + "event.code": { + "query": "4726", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Deleted - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Deleted User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Deleted - Table", + "type": "table" + } + }, + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:44:25.678Z", + "version": "WzQ5MywxXQ==" + }, { - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "name": "panel_8", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4765", + "4766", + "4767", + "4780", + "4781", + "4794", + "5376", + "5377" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4765" + } + }, + { + "match_phrase": { + "event.code": "4766" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4780" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4794" + } + }, + { + "match_phrase": { + "event.code": "5376" + } + }, + { + "match_phrase": { + "event.code": "5377" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Affected Users vs Actions - Heatmap", + "uiStateJSON": { + "vis": { + "defaultColors": { + "0 - 14": "rgb(247,251,255)", + "14 - 28": "rgb(198,219,239)", + "28 - 42": "rgb(107,174,214)", + "42 - 55": "rgb(33,113,181)" + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Target User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "segment", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Operation", + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "colorSchema": "Blues", + "colorsNumber": 4, + "colorsRange": [], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + "y": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "enableHover": false, + "invertColors": false, + "legendPosition": "right", + "percentageMode": false, + "setColorRange": false, + "times": [], + "type": "heatmap", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "color": "black", + "overwriteColor": false, + "rotate": 0, + "show": true + }, + "scale": { + "defaultYExtents": false, + "type": "linear" + }, + "show": false, + "type": "value" + } + ] + }, + "title": "User Management Events - Affected Users vs Actions - Heatmap", + "type": "heatmap" + } + }, + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:24:35.247Z", + "version": "WzQyNCwxXQ==" + }, { - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_9", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4723", + "4724" + ], + "type": "phrases", + "value": "4723, 4724" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Password Changes - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Password Change to", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Password Changes - Table", + "type": "table" + } + }, + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:21:59.683Z", + "version": "WzUxMSwxXQ==" + }, { - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_10", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4767" + }, + "type": "phrase", + "value": "4767" + }, + "query": { + "match": { + "event.code": { + "query": "4767", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Unlocked Users - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Unlocked User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer Logonid", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Unlocked Users - Table", + "type": "table" + } + }, + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:25:13.281Z", + "version": "WzUxNSwxXQ==" + }, { - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "name": "panel_11", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4738" + }, + "type": "phrase", + "value": "4738" + }, + "query": { + "match": { + "event.code": { + "query": "4738", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Changes Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Changed User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Changes Table", + "type": "table" + } + }, + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:26:15.729Z", + "version": "WzUxNiwxXQ==" + }, { - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "name": "panel_12", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4740" + }, + "type": "phrase", + "value": "4740" + }, + "query": { + "match": { + "event.code": { + "query": "4740", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Locked Out - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Locked User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Locked Out - Table", + "type": "table" + } + }, + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:24:32.268Z", + "version": "WzUxNCwxXQ==" + }, { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_13", - "type": "search" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4767", + "4781", + "4798" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4798" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "4_Event_Distribution in time", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "drop_partials": false, + "extended_bounds": {}, + "field": "@timestamp", + "interval": "auto", + "min_doc_count": 1, + "timeRange": { + "from": "now-45d", + "to": "now" + }, + "useNormalizedEsInterval": true + }, + "schema": "segment", + "type": "date_histogram" + }, + { + "enabled": true, + "id": "3", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTimeMarker": false, + "addTooltip": true, + "categoryAxes": [ + { + "id": "CategoryAxis-1", + "labels": { + "filter": true, + "show": true, + "truncate": 100 + }, + "position": "bottom", + "scale": { + "type": "linear" + }, + "show": true, + "style": {}, + "title": {}, + "type": "category" + } + ], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "filters", + "format": {}, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "date_histogram", + "format": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm" + } + }, + "params": { + "bounds": { + "max": "2019-11-04T14:10:39.628Z", + "min": "2019-09-20T13:10:39.628Z" + }, + "date": true, + "format": "YYYY-MM-DD HH:mm", + "interval": "PT12H" + } + }, + "y": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "grid": { + "categoryLines": false + }, + "labels": { + "show": true + }, + "legendPosition": "bottom", + "seriesParams": [ + { + "data": { + "id": "1", + "label": "Count" + }, + "drawLinesBetweenPoints": true, + "mode": "stacked", + "show": "true", + "showCircles": true, + "type": "histogram", + "valueAxis": "ValueAxis-1" + } + ], + "times": [], + "type": "histogram", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "filter": false, + "rotate": 0, + "show": true, + "truncate": 100 + }, + "name": "LeftAxis-1", + "position": "left", + "scale": { + "mode": "normal", + "type": "linear" + }, + "show": true, + "style": {}, + "title": { + "text": "Count" + }, + "type": "value" + } + ] + }, + "title": "4_Event_Distribution in time", + "type": "histogram" + } + }, + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:12:00.548Z", + "version": "WzQ3NiwxXQ==" + }, { - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "name": "panel_14", - "type": "search" - }, + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4624" + ], + "type": "phrases", + "value": "4624" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4624" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, { - "id": "97c70300-ff1c-11e9-8405-516218e3d268", - "name": "panel_15", - "type": "visualization" - }, + "attributes": { + "columns": [ + "event.action", + "user.name", + "user.domain", + "winlog.event_data.SubjectUserName", + "winlog.event_data.SubjectDomainName", + "winlog.logon.id" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4767", + "4781" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "User management Details - Search", + "version": 1 + }, + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T12:04:57.352Z", + "version": "WzQ3NSwxXQ==" + }, { - "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", - "name": "panel_16", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Disabled - VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(219,223,0,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4725\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Disabled", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Disabled - VB Metric", + "type": "metrics" + } + }, + "id": "97c70300-ff1c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:06:23.209Z", + "version": "WzUyOSwxXQ==" + }, { - "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", - "name": "panel_17", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Enabled - VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(251,158,0,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4722\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Enabled", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Enabled - VB Metric", + "type": "metrics" + } + }, + "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:01:43.218Z", + "version": "WzUyNCwxXQ==" + }, { - "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", - "name": "panel_18", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Deleted - VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(176,188,0,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4726\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Deleted", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Deleted - VB Metric", + "type": "metrics" + } + }, + "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:02:50.506Z", + "version": "WzUyNiwxXQ==" + }, { - "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", - "name": "panel_19", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Created - VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(159,5,0,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4720\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Created", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Created - VB Metric", + "type": "metrics" + } + }, + "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T15:49:13.249Z", + "version": "WzUyMiwxXQ==" + }, { - "id": "60301890-ff1d-11e9-8405-516218e3d268", - "name": "panel_20", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Unlocks - VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(254,146,0,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4767\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Unlocks", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Unlocks - VB Metric", + "type": "metrics" + } + }, + "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:08:21.249Z", + "version": "WzUzMiwxXQ==" + }, { - "id": "9dd22440-ff1d-11e9-8405-516218e3d268", - "name": "panel_21", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Password Changes - VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(22,165,165,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4723\" OR event.code: \"4724\"" + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Password Changes/Reset", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Password Changes - VB Metric", + "type": "metrics" + } + }, + "id": "60301890-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:10:09.726Z", + "version": "WzUzNCwxXQ==" + }, { - "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", - "name": "panel_22", - "type": "visualization" - } - ], - "type": "dashboard", - "updated_at": "2019-11-05T15:40:21.391Z", - "version": "WzU2MiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "User Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **User Management Events**\\n\\n#### This dashboard shows information about User Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description\\n-- | --\\n4720 | A user account was created\\n4722 | A user account was enabled\\n4723 | An attempt was made to change an account's password\\n4724 | An attempt was made to reset an account's password\\n4725 | An user account was disabled\\n4726 | An user account was deleted\\n4738 | An user account was changed\\n4740 | An user account was locked out\\n4767 | An account was unlocked\\n4781 | The name of an account was changed\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T10:20:41.549Z", - "version": "WzQxNywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T11:13:23.297Z", - "version": "WzQ2NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Created User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:35:21.465Z", - "version": "WzQ4NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}},{\"accessor\":1,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}}],\"metrics\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"perPage\":10,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Short Description\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:23:43.282Z", - "version": "WzQyMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Enabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Enabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:37:53.874Z", - "version": "WzQ4NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Disabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Disabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:15:00.943Z", - "version": "WzUwNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Deleted User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed LogonId\"}}]}" - }, - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:44:25.678Z", - "version": "WzQ5MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Affected Users vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 14\":\"rgb(247,251,255)\",\"14 - 28\":\"rgb(198,219,239)\",\"28 - 42\":\"rgb(107,174,214)\",\"42 - 55\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Affected Users vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Operation\"}}]}" - }, - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:24:35.247Z", - "version": "WzQyNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Password Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Password Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Password Change to\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:21:59.683Z", - "version": "WzUxMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":{\"query\":\"4767\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4767\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Unlocked Users - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Unlocked Users - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Unlocked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer Logonid\"}}]}" - }, - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:25:13.281Z", - "version": "WzUxNSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":{\"query\":\"4738\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4738\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Changes Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Changes Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Changed User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:26:15.729Z", - "version": "WzUxNiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":{\"query\":\"4740\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4740\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Locked Out - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Locked Out - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Locked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:24:32.268Z", - "version": "WzUxNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\",\"4798\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4798\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "4_Event_Distribution in time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"4_Event_Distribution in time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-09-20T13:10:39.628Z\",\"max\":\"2019-11-04T14:10:39.628Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-45d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:12:00.548Z", - "version": "WzQ3NiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "user.name", - "user.domain", - "winlog.event_data.SubjectUserName", - "winlog.event_data.SubjectDomainName", - "winlog.logon.id" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "User management Details - Search", - "version": 1 - }, - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users locked Out - VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(51,51,51,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4740\"" + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Locked Out", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users locked Out - VB Metric", + "type": "metrics" + } + }, + "id": "9dd22440-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:24:47.051Z", + "version": "WzU0MCwxXQ==" + }, { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "title": "Users Changes VB Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "8d597960-ff18-11e9-8249-2371c695f3b0", + "operator": "lte", + "value": 0 + }, + { + "background_color": "rgba(179,179,179,1)", + "id": "a3f59730-ff18-11e9-8249-2371c695f3b0", + "operator": "gte", + "value": 1 + } + ], + "default_index_pattern": "winlogbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "event.code: \"4738\" " + }, + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "", + "interval": "90d", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Users Changes", + "line_width": 1, + "metrics": [ + { + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "", + "type": "metric" + }, + "title": "Users Changes VB Metric", + "type": "metrics" + } + }, + "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T16:12:34.736Z", + "version": "WzUzOCwxXQ==" } - ], - "type": "search", - "updated_at": "2019-11-04T12:04:57.352Z", - "version": "WzQ3NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Disabled - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Disabled\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(219,223,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4725\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "97c70300-ff1c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:06:23.209Z", - "version": "WzUyOSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Enabled - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Enabled\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(251,158,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4722\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:01:43.218Z", - "version": "WzUyNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Deleted - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Deleted\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(176,188,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4726\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:02:50.506Z", - "version": "WzUyNiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Created - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Created - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Created\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(159,5,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4720\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T15:49:13.249Z", - "version": "WzUyMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Unlocks - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Unlocks - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Unlocks\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(254,146,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4767\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:08:21.249Z", - "version": "WzUzMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Password Changes - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Password Changes - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Password Changes/Reset\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(22,165,165,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4723\\\" OR event.code: \\\"4724\\\"\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "60301890-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:10:09.726Z", - "version": "WzUzNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users locked Out - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users locked Out - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Locked Out\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(51,51,51,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4740\\\"\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "9dd22440-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:24:47.051Z", - "version": "WzU0MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Changes VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Changes VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Changes\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(179,179,179,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4738\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:12:34.736Z", - "version": "WzUzOCwxXQ==" - } - ], - "version": "7.3.1" -} + ], + "version": "7.3.1" +} \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json index d484f3d1634..72175dcc308 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json @@ -1,866 +1,4377 @@ { - "objects": [ - { - "attributes": { - "description": "Uses Simple Metric Visualizations", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"1\",\"w\":17,\"x\":0,\"y\":0},\"panelIndex\":\"1\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":19,\"i\":\"2\",\"w\":18,\"x\":17,\"y\":0},\"panelIndex\":\"2\",\"title\":\"User Management Actions\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"3\",\"w\":9,\"x\":0,\"y\":44},\"panelIndex\":\"3\",\"title\":\"Created Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"4\",\"w\":13,\"x\":35,\"y\":0},\"panelIndex\":\"4\",\"title\":\"Event Codes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"5\",\"w\":9,\"x\":9,\"y\":44},\"panelIndex\":\"5\",\"title\":\"Enabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"6\",\"w\":9,\"x\":0,\"y\":66},\"panelIndex\":\"6\",\"title\":\"Disabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"7\",\"w\":9,\"x\":18,\"y\":44},\"panelIndex\":\"7\",\"title\":\"Deleted Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 4\":\"rgb(247,252,245)\",\"12 - 16\":\"rgb(35,139,69)\",\"4 - 8\":\"rgb(199,233,192)\",\"8 - 12\":\"rgb(116,196,118)\"},\"legendOpen\":false}},\"gridData\":{\"h\":20,\"i\":\"8\",\"w\":27,\"x\":0,\"y\":19},\"panelIndex\":\"8\",\"title\":\"Actions performed over Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"9\",\"w\":9,\"x\":18,\"y\":66},\"panelIndex\":\"9\",\"title\":\"Passwords Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"10\",\"w\":9,\"x\":0,\"y\":39},\"panelIndex\":\"10\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"11\",\"w\":9,\"x\":9,\"y\":39},\"panelIndex\":\"11\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"12\",\"w\":9,\"x\":18,\"y\":39},\"panelIndex\":\"12\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"13\",\"w\":9,\"x\":0,\"y\":60},\"panelIndex\":\"13\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"14\",\"w\":9,\"x\":18,\"y\":60},\"panelIndex\":\"14\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"15\",\"w\":9,\"x\":9,\"y\":66},\"panelIndex\":\"15\",\"title\":\"Unlocked Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"16\",\"w\":12,\"x\":36,\"y\":66},\"panelIndex\":\"16\",\"title\":\"Users Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"17\",\"w\":9,\"x\":27,\"y\":60},\"panelIndex\":\"17\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_16\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"18\",\"w\":9,\"x\":9,\"y\":60},\"panelIndex\":\"18\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_17\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"19\",\"w\":12,\"x\":36,\"y\":60},\"panelIndex\":\"19\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_18\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"20\",\"w\":9,\"x\":27,\"y\":66},\"panelIndex\":\"20\",\"title\":\"Locked-out Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_19\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"21\",\"w\":21,\"x\":27,\"y\":19},\"panelIndex\":\"21\",\"title\":\"User Management Actions Distributions over Time\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_20\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":21,\"i\":\"22\",\"w\":21,\"x\":27,\"y\":39},\"panelIndex\":\"22\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_21\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"23\",\"w\":48,\"x\":0,\"y\":82},\"panelIndex\":\"23\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_22\"}]", - "timeRestore": false, - "title": "[winlogbeat] User Management Events - Simple Metric", - "version": 1 - }, - "id": "8223bed0-b9e9-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ + "objects": [ { - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "name": "panel_0", - "type": "visualization" - }, + "attributes": { + "description": "Uses Simple Metric Visualizations", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": {}, + "gridData": { + "h": 19, + "i": "1", + "w": 17, + "x": 0, + "y": 0 + }, + "panelIndex": "1", + "panelRefName": "panel_0", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": { + "vis": { + "legendOpen": false + } + }, + "gridData": { + "h": 19, + "i": "2", + "w": 18, + "x": 17, + "y": 0 + }, + "panelIndex": "2", + "panelRefName": "panel_1", + "title": "User Management Actions", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "3", + "w": 9, + "x": 0, + "y": 44 + }, + "panelIndex": "3", + "panelRefName": "panel_2", + "title": "Created Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 19, + "i": "4", + "w": 13, + "x": 35, + "y": 0 + }, + "panelIndex": "4", + "panelRefName": "panel_3", + "title": "Event Codes", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "5", + "w": 9, + "x": 9, + "y": 44 + }, + "panelIndex": "5", + "panelRefName": "panel_4", + "title": "Enabled Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "6", + "w": 9, + "x": 0, + "y": 66 + }, + "panelIndex": "6", + "panelRefName": "panel_5", + "title": "Disabled Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "7", + "w": 9, + "x": 18, + "y": 44 + }, + "panelIndex": "7", + "panelRefName": "panel_6", + "title": "Deleted Users", + "version": "7.3.0" + }, + { + "embeddableConfig": { + "vis": { + "defaultColors": { + "0 - 4": "rgb(247,252,245)", + "12 - 16": "rgb(35,139,69)", + "4 - 8": "rgb(199,233,192)", + "8 - 12": "rgb(116,196,118)" + }, + "legendOpen": false + } + }, + "gridData": { + "h": 20, + "i": "8", + "w": 27, + "x": 0, + "y": 19 + }, + "panelIndex": "8", + "panelRefName": "panel_7", + "title": "Actions performed over Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "9", + "w": 9, + "x": 18, + "y": 66 + }, + "panelIndex": "9", + "panelRefName": "panel_8", + "title": "Passwords Changes", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 5, + "i": "10", + "w": 9, + "x": 0, + "y": 39 + }, + "panelIndex": "10", + "panelRefName": "panel_9", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 5, + "i": "11", + "w": 9, + "x": 9, + "y": 39 + }, + "panelIndex": "11", + "panelRefName": "panel_10", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 5, + "i": "12", + "w": 9, + "x": 18, + "y": 39 + }, + "panelIndex": "12", + "panelRefName": "panel_11", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 6, + "i": "13", + "w": 9, + "x": 0, + "y": 60 + }, + "panelIndex": "13", + "panelRefName": "panel_12", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 6, + "i": "14", + "w": 9, + "x": 18, + "y": 60 + }, + "panelIndex": "14", + "panelRefName": "panel_13", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "15", + "w": 9, + "x": 9, + "y": 66 + }, + "panelIndex": "15", + "panelRefName": "panel_14", + "title": "Unlocked Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "16", + "w": 12, + "x": 36, + "y": 66 + }, + "panelIndex": "16", + "panelRefName": "panel_15", + "title": "Users Changes", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 6, + "i": "17", + "w": 9, + "x": 27, + "y": 60 + }, + "panelIndex": "17", + "panelRefName": "panel_16", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 6, + "i": "18", + "w": 9, + "x": 9, + "y": 60 + }, + "panelIndex": "18", + "panelRefName": "panel_17", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 6, + "i": "19", + "w": 12, + "x": 36, + "y": 60 + }, + "panelIndex": "19", + "panelRefName": "panel_18", + "title": "", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 16, + "i": "20", + "w": 9, + "x": 27, + "y": 66 + }, + "panelIndex": "20", + "panelRefName": "panel_19", + "title": "Locked-out Users", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 20, + "i": "21", + "w": 21, + "x": 27, + "y": 19 + }, + "panelIndex": "21", + "panelRefName": "panel_20", + "title": "User Management Actions Distributions over Time", + "version": "7.3.0" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 21, + "i": "22", + "w": 21, + "x": 27, + "y": 39 + }, + "panelIndex": "22", + "panelRefName": "panel_21", + "version": "7.3.1" + }, + { + "embeddableConfig": {}, + "gridData": { + "h": 19, + "i": "23", + "w": 48, + "x": 0, + "y": 82 + }, + "panelIndex": "23", + "panelRefName": "panel_22", + "version": "7.3.1" + } + ], + "timeRestore": false, + "title": "[winlogbeat] User Management Events - Simple Metric", + "version": 1 + }, + "id": "8223bed0-b9e9-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", + "name": "panel_18", + "type": "visualization" + }, + { + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "name": "panel_19", + "type": "visualization" + }, + { + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "name": "panel_20", + "type": "visualization" + }, + { + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "name": "panel_21", + "type": "search" + }, + { + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "name": "panel_22", + "type": "search" + } + ], + "type": "dashboard", + "updated_at": "2019-11-04T15:28:21.018Z", + "version": "WzUxNywxXQ==" + }, { - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "name": "panel_1", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Description", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 10, + "markdown": "# **User Management Events**\n\n#### This dashboard shows information about User Management Events collected by winlogbeat\n#\n#\n#\nEvent | Description\n-- | --\n4720 | A user account was created\n4722 | A user account was enabled\n4723 | An attempt was made to change an account's password\n4724 | An attempt was made to reset an account's password\n4725 | An user account was disabled\n4726 | An user account was deleted\n4738 | An user account was changed\n4740 | An user account was locked out\n4767 | An account was unlocked\n4781 | The name of an account was changed", + "openLinksInNewTab": false + }, + "title": "User Management Events - Description", + "type": "markdown" + } + }, + "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [], + "type": "visualization", + "updated_at": "2019-11-04T10:20:41.549Z", + "version": "WzQxNywxXQ==" + }, { - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "name": "panel_2", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4765", + "4766", + "4767", + "4780", + "4781", + "4794", + "5376", + "5377" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4765" + } + }, + { + "match_phrase": { + "event.code": "4766" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4780" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4794" + } + }, + { + "match_phrase": { + "event.code": "5376" + } + }, + { + "match_phrase": { + "event.code": "5377" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Event Actions - Donut", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "segment", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metric": { + "accessor": 1, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + }, + "isDonut": true, + "labels": { + "last_level": true, + "show": true, + "truncate": 100, + "values": true + }, + "legendPosition": "right", + "type": "pie" + }, + "title": "User Management Events - Event Actions - Donut", + "type": "pie" + } + }, + "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T11:13:23.297Z", + "version": "WzQ2NiwxXQ==" + }, { - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "name": "panel_3", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4720" + }, + "type": "phrase", + "value": "4720" + }, + "query": { + "match": { + "event.code": { + "query": "4720", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Created - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Created User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonID", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Created - Table", + "type": "table" + } + }, + "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:35:21.465Z", + "version": "WzQ4NSwxXQ==" + }, { - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_4", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4765", + "4766", + "4767", + "4780", + "4781", + "4794", + "5376", + "5377" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4765" + } + }, + { + "match_phrase": { + "event.code": "4766" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4780" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4794" + } + }, + { + "match_phrase": { + "event.code": "5376" + } + }, + { + "match_phrase": { + "event.code": "5377" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Event Actions - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Event Short Description", + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Event Code", + "field": "event.code", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "User Management Events - Event Actions - Table", + "type": "table" + } + }, + "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:23:43.282Z", + "version": "WzQyMiwxXQ==" + }, { - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_5", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4722" + }, + "type": "phrase", + "value": "4722" + }, + "query": { + "match": { + "event.code": { + "query": "4722", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Enabled - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Enabled User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Enabled - Table", + "type": "table" + } + }, + "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:37:53.874Z", + "version": "WzQ4NywxXQ==" + }, { - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_6", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4725" + }, + "type": "phrase", + "value": "4725" + }, + "query": { + "match": { + "event.code": { + "query": "4725", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Disabled - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Disabled User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Disabled - Table", + "type": "table" + } + }, + "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:15:00.943Z", + "version": "WzUwNCwxXQ==" + }, { - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "name": "panel_7", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4726" + }, + "type": "phrase", + "value": "4726" + }, + "query": { + "match": { + "event.code": { + "query": "4726", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Deleted - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Deleted User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performed LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Deleted - Table", + "type": "table" + } + }, + "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:44:25.678Z", + "version": "WzQ5MywxXQ==" + }, { - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "name": "panel_8", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4765", + "4766", + "4767", + "4780", + "4781", + "4794", + "5376", + "5377" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4765" + } + }, + { + "match_phrase": { + "event.code": "4766" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4780" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4794" + } + }, + { + "match_phrase": { + "event.code": "5376" + } + }, + { + "match_phrase": { + "event.code": "5377" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "User Management Events - Affected Users vs Actions - Heatmap", + "uiStateJSON": { + "vis": { + "defaultColors": { + "0 - 14": "rgb(247,251,255)", + "14 - 28": "rgb(198,219,239)", + "28 - 42": "rgb(107,174,214)", + "42 - 55": "rgb(33,113,181)" + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Target User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 10 + }, + "schema": "segment", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Operation", + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "colorSchema": "Blues", + "colorsNumber": 4, + "colorsRange": [], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + "y": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "enableHover": false, + "invertColors": false, + "legendPosition": "right", + "percentageMode": false, + "setColorRange": false, + "times": [], + "type": "heatmap", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "color": "black", + "overwriteColor": false, + "rotate": 0, + "show": true + }, + "scale": { + "defaultYExtents": false, + "type": "linear" + }, + "show": false, + "type": "value" + } + ] + }, + "title": "User Management Events - Affected Users vs Actions - Heatmap", + "type": "heatmap" + } + }, + "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T10:24:35.247Z", + "version": "WzQyNCwxXQ==" + }, { - "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", - "name": "panel_9", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4723", + "4724" + ], + "type": "phrases", + "value": "4723, 4724" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Password Changes - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Password Change to", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Password Changes - Table", + "type": "table" + } + }, + "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:21:59.683Z", + "version": "WzUxMSwxXQ==" + }, { - "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", - "name": "panel_10", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4720" + }, + "type": "phrase", + "value": "4720" + }, + "query": { + "match": { + "event.code": { + "query": "4720", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Created - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Users Created" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Created - Simple Metric", + "type": "metric" + } + }, + "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:39:07.209Z", + "version": "WzQ5MCwxXQ==" + }, { - "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", - "name": "panel_11", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4722" + }, + "type": "phrase", + "value": "4722" + }, + "query": { + "match": { + "event.code": { + "query": "4722", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Enabled - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Users Enabled", + "field": "user.name" + }, + "schema": "metric", + "type": "cardinality" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Enabled - Simple Metric", + "type": "metric" + } + }, + "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:38:36.233Z", + "version": "WzQ4OCwxXQ==" + }, { - "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", - "name": "panel_12", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4726" + }, + "type": "phrase", + "value": "4726" + }, + "query": { + "match": { + "event.code": { + "query": "4726", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Deleted - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Deleted Users" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Deleted - Simple Metric", + "type": "metric" + } + }, + "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:39:59.945Z", + "version": "WzQ5MSwxXQ==" + }, { - "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", - "name": "panel_13", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4725" + }, + "type": "phrase", + "value": "4725" + }, + "query": { + "match": { + "event.code": { + "query": "4725", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Disabled - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Disabled Users", + "field": "user.name" + }, + "schema": "metric", + "type": "cardinality" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Disabled - Simple Metric", + "type": "metric" + } + }, + "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:00:11.591Z", + "version": "WzQ5NCwxXQ==" + }, { - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_14", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4723", + "4724" + ], + "type": "phrases", + "value": "4723, 4724" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Password Reset / Changes", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Password Changes" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Password Reset / Changes", + "type": "metric" + } + }, + "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:01:45.486Z", + "version": "WzQ5OCwxXQ==" + }, { - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_15", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4767" + }, + "type": "phrase", + "value": "4767" + }, + "query": { + "match": { + "event.code": { + "query": "4767", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Unlocked Users - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Unlocked User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer Logonid", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Unlocked Users - Table", + "type": "table" + } + }, + "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:25:13.281Z", + "version": "WzUxNSwxXQ==" + }, { - "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", - "name": "panel_16", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4738" + }, + "type": "phrase", + "value": "4738" + }, + "query": { + "match": { + "event.code": { + "query": "4738", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Changes Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Changed User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Changes Table", + "type": "table" + } + }, + "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:26:15.729Z", + "version": "WzUxNiwxXQ==" + }, { - "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", - "name": "panel_17", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4740" + ], + "type": "phrases", + "value": "4740" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4740" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Unlocks - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Users Locked Out" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Unlocks - Simple Metric", + "type": "metric" + } + }, + "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:06:22.616Z", + "version": "WzUwMSwxXQ==" + }, { - "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", - "name": "panel_18", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4767" + ], + "type": "phrases", + "value": "4767" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4767" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Unlocked Users - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Users Unlocks" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Unlocked Users - Simple Metric", + "type": "metric" + } + }, + "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:01:01.325Z", + "version": "WzQ5NiwxXQ==" + }, { - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "name": "panel_19", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4738" + ], + "type": "phrases", + "value": "4738" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4738" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Changes - Simple Metric", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Changes in Users" + }, + "schema": "metric", + "type": "count" + } + ], + "params": { + "addLegend": false, + "addTooltip": true, + "dimensions": { + "metrics": [ + { + "accessor": 0, + "format": { + "id": "number", + "params": {} + }, + "type": "vis_dimension" + } + ] + }, + "metric": { + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 10000, + "type": "range" + } + ], + "invertColors": false, + "labels": { + "show": true + }, + "metricColorMode": "None", + "percentageMode": false, + "style": { + "bgColor": false, + "bgFill": "#000", + "fontSize": 60, + "labelColor": false, + "subText": "" + }, + "useRanges": false + }, + "type": "metric" + }, + "title": "Users Changes - Simple Metric", + "type": "metric" + } + }, + "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:03:27.480Z", + "version": "WzUwMCwxXQ==" + }, { - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "name": "panel_20", - "type": "visualization" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": { + "query": "4740" + }, + "type": "phrase", + "value": "4740" + }, + "query": { + "match": { + "event.code": { + "query": "4740", + "type": "phrase" + } + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Users Locked Out - Table", + "uiStateJSON": { + "vis": { + "params": { + "sort": { + "columnIndex": null, + "direction": null + } + } + } + }, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "customLabel": "Locked User", + "field": "user.name", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 100 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "3", + "params": { + "customLabel": "Performed by", + "field": "winlog.event_data.SubjectUserName", + "missingBucket": true, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + }, + { + "enabled": true, + "id": "4", + "params": { + "customLabel": "Performer LogonId", + "field": "winlog.logon.id", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "bucket", + "type": "terms" + } + ], + "params": { + "dimensions": { + "buckets": [ + { + "accessor": 0, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 1, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + }, + { + "accessor": 2, + "aggType": "terms", + "format": { + "id": "terms", + "params": { + "id": "string", + "missingBucketLabel": "Missing", + "otherBucketLabel": "Other" + } + }, + "params": {} + } + ], + "metrics": [ + { + "accessor": 3, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "perPage": 10, + "showMetricsAtAllLevels": false, + "showPartialRows": false, + "showTotal": false, + "sort": { + "columnIndex": null, + "direction": null + }, + "totalFunc": "sum" + }, + "title": "Users Locked Out - Table", + "type": "table" + } + }, + "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T15:24:32.268Z", + "version": "WzUxNCwxXQ==" + }, { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_21", - "type": "search" - }, + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4767", + "4781", + "4798" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + }, + { + "match_phrase": { + "event.code": "4798" + } + } + ] + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "4_Event_Distribution in time", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": {}, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "drop_partials": false, + "extended_bounds": {}, + "field": "@timestamp", + "interval": "auto", + "min_doc_count": 1, + "timeRange": { + "from": "now-45d", + "to": "now" + }, + "useNormalizedEsInterval": true + }, + "schema": "segment", + "type": "date_histogram" + }, + { + "enabled": true, + "id": "3", + "params": { + "field": "event.action", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 5 + }, + "schema": "group", + "type": "terms" + } + ], + "params": { + "addLegend": true, + "addTimeMarker": false, + "addTooltip": true, + "categoryAxes": [ + { + "id": "CategoryAxis-1", + "labels": { + "filter": true, + "show": true, + "truncate": 100 + }, + "position": "bottom", + "scale": { + "type": "linear" + }, + "show": true, + "style": {}, + "title": {}, + "type": "category" + } + ], + "dimensions": { + "series": [ + { + "accessor": 1, + "aggType": "filters", + "format": {}, + "params": {} + } + ], + "x": { + "accessor": 0, + "aggType": "date_histogram", + "format": { + "id": "date", + "params": { + "pattern": "YYYY-MM-DD HH:mm" + } + }, + "params": { + "bounds": { + "max": "2019-11-04T14:10:39.628Z", + "min": "2019-09-20T13:10:39.628Z" + }, + "date": true, + "format": "YYYY-MM-DD HH:mm", + "interval": "PT12H" + } + }, + "y": [ + { + "accessor": 2, + "aggType": "count", + "format": { + "id": "number" + }, + "params": {} + } + ] + }, + "grid": { + "categoryLines": false + }, + "labels": { + "show": true + }, + "legendPosition": "bottom", + "seriesParams": [ + { + "data": { + "id": "1", + "label": "Count" + }, + "drawLinesBetweenPoints": true, + "mode": "stacked", + "show": "true", + "showCircles": true, + "type": "histogram", + "valueAxis": "ValueAxis-1" + } + ], + "times": [], + "type": "histogram", + "valueAxes": [ + { + "id": "ValueAxis-1", + "labels": { + "filter": false, + "rotate": 0, + "show": true, + "truncate": 100 + }, + "name": "LeftAxis-1", + "position": "left", + "scale": { + "mode": "normal", + "type": "linear" + }, + "show": true, + "style": {}, + "title": { + "text": "Count" + }, + "type": "value" + } + ] + }, + "title": "4_Event_Distribution in time", + "type": "histogram" + } + }, + "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", + "migrationVersion": { + "visualization": "7.3.1" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2019-11-04T14:12:00.548Z", + "version": "WzQ3NiwxXQ==" + }, { - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "name": "panel_22", - "type": "search" - } - ], - "type": "dashboard", - "updated_at": "2019-11-04T15:28:21.018Z", - "version": "WzUxNywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "User Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **User Management Events**\\n\\n#### This dashboard shows information about User Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description\\n-- | --\\n4720 | A user account was created\\n4722 | A user account was enabled\\n4723 | An attempt was made to change an account's password\\n4724 | An attempt was made to reset an account's password\\n4725 | An user account was disabled\\n4726 | An user account was deleted\\n4738 | An user account was changed\\n4740 | An user account was locked out\\n4767 | An account was unlocked\\n4781 | The name of an account was changed\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T10:20:41.549Z", - "version": "WzQxNywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T11:13:23.297Z", - "version": "WzQ2NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Created User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:35:21.465Z", - "version": "WzQ4NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}},{\"accessor\":1,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}}],\"metrics\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"perPage\":10,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Short Description\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:23:43.282Z", - "version": "WzQyMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Enabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Enabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:37:53.874Z", - "version": "WzQ4NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Disabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Disabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:15:00.943Z", - "version": "WzUwNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Deleted User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed LogonId\"}}]}" - }, - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:44:25.678Z", - "version": "WzQ5MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Affected Users vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 14\":\"rgb(247,251,255)\",\"14 - 28\":\"rgb(198,219,239)\",\"28 - 42\":\"rgb(107,174,214)\",\"42 - 55\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Affected Users vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Operation\"}}]}" - }, - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:24:35.247Z", - "version": "WzQyNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Password Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Password Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Password Change to\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:21:59.683Z", - "version": "WzUxMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Created - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Created - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Created\"}}]}" - }, - "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:39:07.209Z", - "version": "WzQ5MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Enabled - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"user.name\",\"customLabel\":\"Users Enabled\"}}]}" - }, - "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:38:36.233Z", - "version": "WzQ4OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Deleted - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Deleted Users\"}}]}" - }, - "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:39:59.945Z", - "version": "WzQ5MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Disabled - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"user.name\",\"customLabel\":\"Disabled Users\"}}]}" - }, - "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:00:11.591Z", - "version": "WzQ5NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Password Reset / Changes", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Password Reset / Changes\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Password Changes\"}}]}" - }, - "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:01:45.486Z", - "version": "WzQ5OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":{\"query\":\"4767\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4767\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Unlocked Users - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Unlocked Users - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Unlocked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer Logonid\"}}]}" - }, - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:25:13.281Z", - "version": "WzUxNSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":{\"query\":\"4738\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4738\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Changes Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Changes Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Changed User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:26:15.729Z", - "version": "WzUxNiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":[\"4740\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4740\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Unlocks - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Unlocks - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Locked Out\"}}]}" - }, - "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:06:22.616Z", - "version": "WzUwMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":[\"4767\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4767\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Unlocked Users - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Unlocked Users - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Unlocks\"}}]}" - }, - "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:01:01.325Z", - "version": "WzQ5NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":[\"4738\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4738\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Changes - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Changes - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Changes in Users\"}}]}" - }, - "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:03:27.480Z", - "version": "WzUwMCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":{\"query\":\"4740\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4740\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Locked Out - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Locked Out - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Locked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:24:32.268Z", - "version": "WzUxNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\",\"4798\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4798\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "4_Event_Distribution in time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"4_Event_Distribution in time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-09-20T13:10:39.628Z\",\"max\":\"2019-11-04T14:10:39.628Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-45d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:12:00.548Z", - "version": "WzQ3NiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "user.name", - "user.domain", - "winlog.event_data.SubjectUserName", - "winlog.event_data.SubjectDomainName", - "winlog.logon.id" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "User management Details - Search", - "version": 1 - }, - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, + "attributes": { + "columns": [ + "user.name", + "source.domain", + "source.ip", + "winlog.logon.id", + "winlog.logon.type" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4624" + ], + "type": "phrases", + "value": "4624" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4624" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "Logon Details", + "version": 1 + }, + "id": "7e178c80-fee1-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T09:00:36.878Z", + "version": "WzM2MiwxXQ==" + }, { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" + "attributes": { + "columns": [ + "event.action", + "user.name", + "user.domain", + "winlog.event_data.SubjectUserName", + "winlog.event_data.SubjectDomainName", + "winlog.logon.id" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "4720", + "4722", + "4723", + "4724", + "4725", + "4726", + "4738", + "4740", + "4767", + "4781" + ], + "type": "phrases", + "value": "4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "4720" + } + }, + { + "match_phrase": { + "event.code": "4722" + } + }, + { + "match_phrase": { + "event.code": "4723" + } + }, + { + "match_phrase": { + "event.code": "4724" + } + }, + { + "match_phrase": { + "event.code": "4725" + } + }, + { + "match_phrase": { + "event.code": "4726" + } + }, + { + "match_phrase": { + "event.code": "4738" + } + }, + { + "match_phrase": { + "event.code": "4740" + } + }, + { + "match_phrase": { + "event.code": "4767" + } + }, + { + "match_phrase": { + "event.code": "4781" + } + } + ] + } + } + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "lucene", + "query": "" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "User management Details - Search", + "version": 1 + }, + "id": "324686c0-fefb-11e9-8405-516218e3d268", + "migrationVersion": { + "search": "7.0.0" + }, + "references": [ + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "winlogbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "updated_at": "2019-11-04T12:04:57.352Z", + "version": "WzQ3NSwxXQ==" } - ], - "type": "search", - "updated_at": "2019-11-04T12:04:57.352Z", - "version": "WzQ3NSwxXQ==" - } - ], - "version": "7.3.1" -} + ], + "version": "7.3.1" +} \ No newline at end of file From 4d0ecc1f45f8bf3fcc98e00815defc2dc0c1fc04 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Nov 2019 11:06:42 -0600 Subject: [PATCH 10/11] Update titles --- .../[winlogbeat]_Group_Management_Events.json | 38 +++++++-------- ...roup_Management_Events_Simple_Metrics.json | 38 +++++++-------- .../[winlogbeat]_User_Management_Events.json | 46 +++++++++---------- ...User_Management_Events_Simple_Metrics.json | 46 +++++++++---------- 4 files changed, 84 insertions(+), 84 deletions(-) diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json index a703cdb8a17..fa800ebee21 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json @@ -299,7 +299,7 @@ } ], "timeRestore": false, - "title": "[winlogbeat] Group Management Events", + "title": "[Winlogbeat security] Management Events", "version": 1 }, "id": "bb858830-f412-11e9-8405-516218e3d268", @@ -419,7 +419,7 @@ } } }, - "title": "Group Management Events - Description", + "title": "Group Management Events - Description [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -581,7 +581,7 @@ } } }, - "title": "Group Management Events - Event Actions - Donut", + "title": "Group Management Events - Event Actions - Donut [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -811,7 +811,7 @@ } } }, - "title": "Group Management Events - Event Actions - Table", + "title": "Group Management Events - Event Actions - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -954,7 +954,7 @@ } } }, - "title": "Users Added - Metric", + "title": "Users Added - Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -1039,7 +1039,7 @@ } } }, - "title": "Groups Deleted - Metric", + "title": "Groups Deleted - Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -1124,7 +1124,7 @@ } } }, - "title": "Groups Created - Metric", + "title": "Groups Created - Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -1209,7 +1209,7 @@ } } }, - "title": "Groups Changed - Metric", + "title": "Groups Changed - Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -1294,7 +1294,7 @@ } } }, - "title": "Users Removed - Table", + "title": "Users Removed - Table [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -1373,7 +1373,7 @@ } } }, - "title": "Groups Enumeration - Metric", + "title": "Groups Enumeration - Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -1579,7 +1579,7 @@ } } }, - "title": "Group Management Events - Groups vs Actions - Heatmap", + "title": "Group Management Events - Groups vs Actions - Heatmap [Winlogbeat security]", "uiStateJSON": { "vis": { "defaultColors": { @@ -1784,7 +1784,7 @@ } } }, - "title": "Groups Created - Table", + "title": "Groups Created - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2030,7 +2030,7 @@ } } }, - "title": "Group Changes - Table", + "title": "Group Changes - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2276,7 +2276,7 @@ } } }, - "title": "Groups Deleted - Table", + "title": "Groups Deleted - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2522,7 +2522,7 @@ } } }, - "title": "Users Added - Table", + "title": "Users Added - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2798,7 +2798,7 @@ } } }, - "title": "Users Removed from Group - Table", + "title": "Users Removed from Group - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -3062,7 +3062,7 @@ } } }, - "title": "5_Group_Enum", + "title": "5_Group_Enum [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -3472,7 +3472,7 @@ } } }, - "title": "Group Management Action Distribution over Time", + "title": "Group Management Action Distribution over Time [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3850,4 +3850,4 @@ } ], "version": "7.3.1" -} \ No newline at end of file +} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json index 69d0fb635b3..485b47d393a 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json @@ -298,7 +298,7 @@ } ], "timeRestore": false, - "title": "[winlogbeat] Group Management Events - Simple Metrics", + "title": "[Winlogbeat security] Group Management Events - Simple Metrics", "version": 1 }, "id": "01c54730-fee6-11e9-8405-516218e3d268", @@ -418,7 +418,7 @@ } } }, - "title": "Group Management Events - Description", + "title": "Group Management Events - Description [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -580,7 +580,7 @@ } } }, - "title": "Group Management Events - Event Actions - Donut", + "title": "Group Management Events - Event Actions - Donut [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -810,7 +810,7 @@ } } }, - "title": "Group Management Events - Event Actions - Table", + "title": "Group Management Events - Event Actions - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1080,7 +1080,7 @@ } } }, - "title": "Group Management Events - Groups vs Actions - Heatmap", + "title": "Group Management Events - Groups vs Actions - Heatmap [Winlogbeat security]", "uiStateJSON": { "vis": { "defaultColors": { @@ -1285,7 +1285,7 @@ } } }, - "title": "Groups Created - Table", + "title": "Groups Created - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1531,7 +1531,7 @@ } } }, - "title": "Group Changes - Table", + "title": "Group Changes - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1777,7 +1777,7 @@ } } }, - "title": "Groups Deleted - Table", + "title": "Groups Deleted - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2023,7 +2023,7 @@ } } }, - "title": "Users Added - Table", + "title": "Users Added - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2299,7 +2299,7 @@ } } }, - "title": "Users Removed from Group - Table", + "title": "Users Removed from Group - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2563,7 +2563,7 @@ } } }, - "title": "5_Group_Enum", + "title": "5_Group_Enum [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2889,7 +2889,7 @@ } } }, - "title": "Users Added - Simple Metric", + "title": "Users Added - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3024,7 +3024,7 @@ } } }, - "title": "Groups Deleted- Simple Metric", + "title": "Groups Deleted- Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3159,7 +3159,7 @@ } } }, - "title": "Groups Created - Simple Metric", + "title": "Groups Created - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3300,7 +3300,7 @@ } } }, - "title": "Groups Changes - Simple Metric", + "title": "Groups Changes - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3435,7 +3435,7 @@ } } }, - "title": "Users Removed from Group - Simple Metric", + "title": "Users Removed from Group - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3554,7 +3554,7 @@ } } }, - "title": "Group Membership Enumeration - Simple Metric", + "title": "Group Membership Enumeration - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3773,7 +3773,7 @@ } } }, - "title": "Group Management Action Distribution over Time", + "title": "Group Management Action Distribution over Time [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -4151,4 +4151,4 @@ } ], "version": "7.3.1" -} \ No newline at end of file +} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json index e78bacc2191..0fb78c2c68f 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json @@ -354,7 +354,7 @@ } ], "timeRestore": false, - "title": "[winlogbeat] User Management Events", + "title": "[Winlogbeat security] User Management Events", "version": 1 }, "id": "71f720f0-ff18-11e9-8405-516218e3d268", @@ -494,7 +494,7 @@ } } }, - "title": "User Management Events - Description", + "title": "User Management Events - Description [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -650,7 +650,7 @@ } } }, - "title": "User Management Events - Event Actions - Donut", + "title": "User Management Events - Event Actions - Donut [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -780,7 +780,7 @@ } } }, - "title": "Users Created - Table", + "title": "Users Created - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1074,7 +1074,7 @@ } } }, - "title": "User Management Events - Event Actions - Table", + "title": "User Management Events - Event Actions - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1244,7 +1244,7 @@ } } }, - "title": "Users Enabled - Table", + "title": "Users Enabled - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1444,7 +1444,7 @@ } } }, - "title": "Users Disabled - Table", + "title": "Users Disabled - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1644,7 +1644,7 @@ } } }, - "title": "Users Deleted - Table", + "title": "Users Deleted - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1938,7 +1938,7 @@ } } }, - "title": "User Management Events - Affected Users vs Actions - Heatmap", + "title": "User Management Events - Affected Users vs Actions - Heatmap [Winlogbeat security]", "uiStateJSON": { "vis": { "defaultColors": { @@ -2138,7 +2138,7 @@ } } }, - "title": "Users Password Changes - Table", + "title": "Users Password Changes - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2338,7 +2338,7 @@ } } }, - "title": "Unlocked Users - Table", + "title": "Unlocked Users - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2538,7 +2538,7 @@ } } }, - "title": "Users Changes Table", + "title": "Users Changes Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2738,7 +2738,7 @@ } } }, - "title": "Users Locked Out - Table", + "title": "Users Locked Out - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -3002,7 +3002,7 @@ } } }, - "title": "4_Event_Distribution in time", + "title": "4_Event_Distribution in time [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3408,7 +3408,7 @@ } } }, - "title": "Users Disabled - VB Metric", + "title": "Users Disabled - VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3492,7 +3492,7 @@ } } }, - "title": "Users Enabled - VB Metric", + "title": "Users Enabled - VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3576,7 +3576,7 @@ } } }, - "title": "Users Deleted - VB Metric", + "title": "Users Deleted - VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3660,7 +3660,7 @@ } } }, - "title": "Users Created - VB Metric", + "title": "Users Created - VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3744,7 +3744,7 @@ } } }, - "title": "Users Unlocks - VB Metric", + "title": "Users Unlocks - VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3828,7 +3828,7 @@ } } }, - "title": "Users Password Changes - VB Metric", + "title": "Users Password Changes - VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3912,7 +3912,7 @@ } } }, - "title": "Users locked Out - VB Metric", + "title": "Users locked Out - VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3996,7 +3996,7 @@ } } }, - "title": "Users Changes VB Metric", + "title": "Users Changes VB Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -4070,4 +4070,4 @@ } ], "version": "7.3.1" -} \ No newline at end of file +} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json index 72175dcc308..b853b970643 100644 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json +++ b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json @@ -354,7 +354,7 @@ } ], "timeRestore": false, - "title": "[winlogbeat] User Management Events - Simple Metric", + "title": "[Winlogbeat security] User Management Events - Simple Metric", "version": 1 }, "id": "8223bed0-b9e9-11e9-b6a2-c9b4015c4baf", @@ -494,7 +494,7 @@ } } }, - "title": "User Management Events - Description", + "title": "User Management Events - Description [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -650,7 +650,7 @@ } } }, - "title": "User Management Events - Event Actions - Donut", + "title": "User Management Events - Event Actions - Donut [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -780,7 +780,7 @@ } } }, - "title": "Users Created - Table", + "title": "Users Created - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1074,7 +1074,7 @@ } } }, - "title": "User Management Events - Event Actions - Table", + "title": "User Management Events - Event Actions - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1244,7 +1244,7 @@ } } }, - "title": "Users Enabled - Table", + "title": "Users Enabled - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1444,7 +1444,7 @@ } } }, - "title": "Users Disabled - Table", + "title": "Users Disabled - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1644,7 +1644,7 @@ } } }, - "title": "Users Deleted - Table", + "title": "Users Deleted - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -1938,7 +1938,7 @@ } } }, - "title": "User Management Events - Affected Users vs Actions - Heatmap", + "title": "User Management Events - Affected Users vs Actions - Heatmap [Winlogbeat security]", "uiStateJSON": { "vis": { "defaultColors": { @@ -2138,7 +2138,7 @@ } } }, - "title": "Users Password Changes - Table", + "title": "Users Password Changes - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -2338,7 +2338,7 @@ } } }, - "title": "Users Created - Simple Metric", + "title": "Users Created - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -2457,7 +2457,7 @@ } } }, - "title": "Users Enabled - Simple Metric", + "title": "Users Enabled - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -2577,7 +2577,7 @@ } } }, - "title": "Users Deleted - Simple Metric", + "title": "Users Deleted - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -2696,7 +2696,7 @@ } } }, - "title": "Users Disabled - Simple Metric", + "title": "Users Disabled - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -2826,7 +2826,7 @@ } } }, - "title": "Users Password Reset / Changes", + "title": "Users Password Reset / Changes [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -2945,7 +2945,7 @@ } } }, - "title": "Unlocked Users - Table", + "title": "Unlocked Users - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -3145,7 +3145,7 @@ } } }, - "title": "Users Changes Table", + "title": "Users Changes Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -3349,7 +3349,7 @@ } } }, - "title": "Users Unlocks - Simple Metric", + "title": "Users Unlocks - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3472,7 +3472,7 @@ } } }, - "title": "Unlocked Users - Simple Metric", + "title": "Unlocked Users - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3595,7 +3595,7 @@ } } }, - "title": "Users Changes - Simple Metric", + "title": "Users Changes - Simple Metric [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -3714,7 +3714,7 @@ } } }, - "title": "Users Locked Out - Table", + "title": "Users Locked Out - Table [Winlogbeat security]", "uiStateJSON": { "vis": { "params": { @@ -3978,7 +3978,7 @@ } } }, - "title": "4_Event_Distribution in time", + "title": "4_Event_Distribution in time [Winlogbeat security]", "uiStateJSON": {}, "version": 1, "visState": { @@ -4374,4 +4374,4 @@ } ], "version": "7.3.1" -} \ No newline at end of file +} From 64c2d5118c4d2798317d40f55c2b1688fa0cdf9d Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Thu, 12 Dec 2019 16:56:03 +0100 Subject: [PATCH 11/11] Deleted Dashboards - will open a separate PR --- .../[winlogbeat]_Group_Management_Events.json | 656 ------------- ...roup_Management_Events_Simple_Metrics.json | 722 --------------- .../[winlogbeat]_User_Management_Events.json | 778 ---------------- ...User_Management_Events_Simple_Metrics.json | 866 ------------------ 4 files changed, 3022 deletions(-) delete mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json delete mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json delete mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json delete mode 100644 x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json deleted file mode 100644 index febb0ee2ef3..00000000000 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events.json +++ /dev/null @@ -1,656 +0,0 @@ -{ - "objects": [ - { - "attributes": { - "description": "Includes Visual Builder Metric\nInterval size 90 days", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"22\",\"w\":17,\"x\":0,\"y\":0},\"panelIndex\":\"22\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":20,\"i\":\"23\",\"w\":21,\"x\":17,\"y\":0},\"panelIndex\":\"23\",\"title\":\"Group Managment Actions\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"25\",\"w\":10,\"x\":38,\"y\":0},\"panelIndex\":\"25\",\"title\":\"Event Codes\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"29\",\"w\":16,\"x\":0,\"y\":61},\"panelIndex\":\"29\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"30\",\"w\":9,\"x\":18,\"y\":41},\"panelIndex\":\"30\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"31\",\"w\":9,\"x\":0,\"y\":41},\"panelIndex\":\"31\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"32\",\"w\":9,\"x\":9,\"y\":41},\"panelIndex\":\"32\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"33\",\"w\":17,\"x\":16,\"y\":61},\"panelIndex\":\"33\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":7,\"i\":\"34\",\"w\":15,\"x\":33,\"y\":61},\"panelIndex\":\"34\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"},\"legendOpen\":false}},\"gridData\":{\"h\":21,\"i\":\"35\",\"w\":27,\"x\":0,\"y\":20},\"panelIndex\":\"35\",\"title\":\"Actions performed over Groups\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"36\",\"w\":9,\"x\":0,\"y\":48},\"panelIndex\":\"36\",\"title\":\"Group Creation Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"37\",\"w\":9,\"x\":9,\"y\":48},\"panelIndex\":\"37\",\"title\":\"Group Changes Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":13,\"i\":\"38\",\"w\":9,\"x\":18,\"y\":48},\"panelIndex\":\"38\",\"title\":\"Group Deletion Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"39\",\"w\":16,\"x\":0,\"y\":68},\"panelIndex\":\"39\",\"title\":\"Users Added to Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"40\",\"w\":17,\"x\":16,\"y\":68},\"panelIndex\":\"40\",\"title\":\"Users Removed From Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":14,\"i\":\"42\",\"w\":15,\"x\":33,\"y\":68},\"panelIndex\":\"42\",\"title\":\"Group Enumeration - Table\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"43\",\"w\":21,\"x\":27,\"y\":41},\"panelIndex\":\"43\",\"title\":\"Logon Details \",\"version\":\"7.3.1\",\"panelRefName\":\"panel_16\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":21,\"i\":\"44\",\"w\":21,\"x\":27,\"y\":20},\"panelIndex\":\"44\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_17\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":22,\"i\":\"45\",\"w\":48,\"x\":0,\"y\":82},\"panelIndex\":\"45\",\"title\":\"Group Management Operations Details\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_18\"}]", - "timeRestore": false, - "title": "[winlogbeat] Group Management Events", - "version": 1 - }, - "id": "bb858830-f412-11e9-8405-516218e3d268", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ - { - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "ffebe440-f419-11e9-8405-516218e3d268", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "e22c6f40-f498-11e9-8405-516218e3d268", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "ee292bc0-f499-11e9-8405-516218e3d268", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "400b63e0-f49a-11e9-8405-516218e3d268", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "a5f664c0-f49a-11e9-8405-516218e3d268", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "546febc0-f49b-11e9-8405-516218e3d268", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "98884120-f49d-11e9-8405-516218e3d268", - "name": "panel_10", - "type": "visualization" - }, - { - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "name": "panel_11", - "type": "visualization" - }, - { - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "name": "panel_12", - "type": "visualization" - }, - { - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "name": "panel_13", - "type": "visualization" - }, - { - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "name": "panel_14", - "type": "visualization" - }, - { - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "name": "panel_15", - "type": "visualization" - }, - { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_16", - "type": "search" - }, - { - "id": "24954800-fef0-11e9-8405-516218e3d268", - "name": "panel_17", - "type": "visualization" - }, - { - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "name": "panel_18", - "type": "search" - } - ], - "type": "dashboard", - "updated_at": "2019-11-05T15:39:38.478Z", - "version": "WzU2MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Group Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T08:28:57.594Z", - "version": "WzM0MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4764\",\"4799\",\"4727\",\"4737\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:29:51.022Z", - "version": "WzM0NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Action\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:51:18.570Z", - "version": "WzQ0OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}" - }, - "title": "Users Added - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Added - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(128,137,0,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\",\"value\":1},{\"background_color\":\"rgba(211,49,21,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gte\",\"value\":3}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"language\":\"kuery\",\"query\":\"event.code:4732 OR event.code:4728 OR event.code:4756\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Users Added to Group\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "ffebe440-f419-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:06:18.059Z", - "version": "WzM2NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Deleted - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(153,172,99,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4734 OR event.code:4730 OR event.code:4758\",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Deleted\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "e22c6f40-f498-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T08:35:35.777Z", - "version": "WzM1MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Created - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(244,78,59,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4731 OR event.code:4727 OR event.code:\\\"4754\\\" \",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Created\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "ee292bc0-f499-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:26:31.457Z", - "version": "WzM3NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Changed - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Changed - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"background_color\":\"rgba(200,201,197,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"lte\",\"value\":0},{\"value\":0,\"background_color\":\"rgba(252,196,0,1)\",\"id\":\"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4735 OR event.code:4737 OR event.code:\\\"4755\\\" OR event.code:\\\"4764\\\" \",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"60d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Groups Changed\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "400b63e0-f49a-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:21:17.132Z", - "version": "WzM3MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}" - }, - "title": "Users Removed - Table", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Removed - Table\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Removed from Group\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\",\"background_color\":\"rgba(176,188,0,1)\"}],\"filter\":{\"query\":\"event.code:4733 OR event.code:4727 OR event.code:4729\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "a5f664c0-f49a-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:06:43.461Z", - "version": "WzM2NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Groups Enumeration - Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Enumeration - Metric\",\"type\":\"metrics\",\"params\":{\"axis_formatter\":\"number\",\"axis_position\":\"left\",\"axis_scale\":\"normal\",\"background_color_rules\":[{\"value\":0,\"background_color\":\"rgba(159,5,0,1)\",\"id\":\"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\",\"operator\":\"gt\"}],\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"drop_last_bucket\":0,\"filter\":{\"query\":\"event.code:4799\",\"language\":\"kuery\"},\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"index_pattern\":\"\",\"interval\":\"90d\",\"series\":[{\"axis_position\":\"right\",\"chart_type\":\"line\",\"color\":\"#68BC00\",\"fill\":0.5,\"formatter\":\"number\",\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"label\":\"Group Membership Enumeration\",\"line_width\":1,\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"point_size\":1,\"separate_axis\":0,\"split_mode\":\"everything\",\"stacked\":\"none\"}],\"show_grid\":1,\"show_legend\":1,\"time_field\":\"\",\"type\":\"metric\"},\"aggs\":[]}" - }, - "id": "546febc0-f49b-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T09:08:11.959Z", - "version": "WzM2NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Groups vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Groups vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":15,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:32:05.540Z", - "version": "WzM0NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "98884120-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:31:28.971Z", - "version": "WzQ3OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755\",\"params\":[\"4735\",\"4737\",\"4755\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:06.806Z", - "version": "WzQ4MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4734, 4730, 4758\",\"params\":[\"4734\",\"4730\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:43.899Z", - "version": "WzQ4MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Added - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Added - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:09:21.781Z", - "version": "WzM2NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4729, 4757\",\"params\":[\"4733\",\"4729\",\"4757\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4757\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Removed from Group - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Removed from Group - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:11:21.532Z", - "version": "WzM2OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":[\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "5_Group_Enum", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"5_Group_Enum\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator LogonID\"}}]}" - }, - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-10-22T10:43:29.024Z", - "version": "WzI2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Action Distribution over Time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Action Distribution over Time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-10-05T09:56:42.142Z\",\"max\":\"2019-11-04T10:56:42.142Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "24954800-fef0-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:56:51.856Z", - "version": "WzQ1MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "group.name", - "group.domain", - "user.name", - "user.domain", - "host.name" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Group Management Details - Search View", - "version": 1 - }, - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T11:02:16.971Z", - "version": "WzQ2MCwxXQ==" - } - ], - "version": "7.3.1" -} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json deleted file mode 100644 index f4d6eeb8c65..00000000000 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_Group_Management_Events_Simple_Metrics.json +++ /dev/null @@ -1,722 +0,0 @@ -{ - "objects": [ - { - "attributes": { - "description": "Uses Simple Metric Visualizations", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":17,\"h\":22,\"i\":\"22\"},\"panelIndex\":\"22\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":17,\"y\":0,\"w\":22,\"h\":22,\"i\":\"23\"},\"panelIndex\":\"23\",\"title\":\"Group Management Actions\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":39,\"y\":0,\"w\":9,\"h\":22,\"i\":\"25\"},\"panelIndex\":\"25\",\"title\":\"Event Codes\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"},\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":22,\"w\":26,\"h\":21,\"i\":\"35\"},\"panelIndex\":\"35\",\"title\":\"Actions performed over Groups\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":52,\"w\":9,\"h\":13,\"i\":\"36\"},\"panelIndex\":\"36\",\"title\":\"Group Creation Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":52,\"w\":9,\"h\":13,\"i\":\"37\"},\"panelIndex\":\"37\",\"title\":\"Group Changes Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":52,\"w\":9,\"h\":13,\"i\":\"38\"},\"panelIndex\":\"38\",\"title\":\"Group Deletion Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":72,\"w\":16,\"h\":14,\"i\":\"39\"},\"panelIndex\":\"39\",\"title\":\"Users Added to Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":16,\"y\":72,\"w\":17,\"h\":14,\"i\":\"40\"},\"panelIndex\":\"40\",\"title\":\"Users Removed From Group Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":33,\"y\":72,\"w\":15,\"h\":14,\"i\":\"42\"},\"panelIndex\":\"42\",\"title\":\"Group Membership Enumeration Summary\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":43,\"w\":21,\"h\":22,\"i\":\"43\"},\"panelIndex\":\"43\",\"title\":\"Logon Details \",\"version\":\"7.3.1\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":65,\"w\":16,\"h\":7,\"i\":\"44\"},\"panelIndex\":\"44\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":43,\"w\":9,\"h\":9,\"i\":\"45\"},\"panelIndex\":\"45\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":43,\"w\":9,\"h\":9,\"i\":\"46\"},\"panelIndex\":\"46\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":43,\"w\":9,\"h\":9,\"i\":\"47\"},\"panelIndex\":\"47\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":16,\"y\":65,\"w\":17,\"h\":7,\"i\":\"48\"},\"panelIndex\":\"48\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":33,\"y\":65,\"w\":15,\"h\":7,\"i\":\"49\"},\"panelIndex\":\"49\",\"title\":\"\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_16\"},{\"gridData\":{\"x\":26,\"y\":22,\"w\":22,\"h\":21,\"i\":\"50\"},\"version\":\"7.3.1\",\"panelIndex\":\"50\",\"embeddableConfig\":{},\"panelRefName\":\"panel_17\"},{\"gridData\":{\"x\":0,\"y\":86,\"w\":48,\"h\":21,\"i\":\"51\"},\"version\":\"7.3.1\",\"panelIndex\":\"51\",\"embeddableConfig\":{},\"panelRefName\":\"panel_18\"}]", - "timeRestore": false, - "title": "[winlogbeat] Group Management Events - Simple Metrics", - "version": 1 - }, - "id": "01c54730-fee6-11e9-8405-516218e3d268", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ - { - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "98884120-f49d-11e9-8405-516218e3d268", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_10", - "type": "search" - }, - { - "id": "a13bf640-fee8-11e9-8405-516218e3d268", - "name": "panel_11", - "type": "visualization" - }, - { - "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", - "name": "panel_12", - "type": "visualization" - }, - { - "id": "f42f3b20-fee6-11e9-8405-516218e3d268", - "name": "panel_13", - "type": "visualization" - }, - { - "id": "b5f38780-fee6-11e9-8405-516218e3d268", - "name": "panel_14", - "type": "visualization" - }, - { - "id": "1b5f17d0-feea-11e9-8405-516218e3d268", - "name": "panel_15", - "type": "visualization" - }, - { - "id": "0f2f5280-feeb-11e9-8405-516218e3d268", - "name": "panel_16", - "type": "visualization" - }, - { - "id": "24954800-fef0-11e9-8405-516218e3d268", - "name": "panel_17", - "type": "visualization" - }, - { - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "name": "panel_18", - "type": "search" - } - ], - "type": "dashboard", - "updated_at": "2019-11-04T15:38:34.464Z", - "version": "WzUyMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "Group Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "6f0f2ea0-f414-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T08:28:57.594Z", - "version": "WzM0MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4764\",\"4799\",\"4727\",\"4737\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b01aaea0-f415-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:29:51.022Z", - "version": "WzM0NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Action\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "11b5c0e0-f417-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:51:18.570Z", - "version": "WzQ0OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\",\"params\":[\"4727\",\"4728\",\"4729\",\"4730\",\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\",\"4764\",\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Events - Groups vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 1\":\"rgb(247,251,255)\",\"1 - 2\":\"rgb(198,219,239)\",\"2 - 3\":\"rgb(107,174,214)\",\"3 - 4\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"Group Management Events - Groups vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":15,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "b948eaf0-f49c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T08:32:05.540Z", - "version": "WzM0NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "98884120-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:31:28.971Z", - "version": "WzQ3OSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755\",\"params\":[\"4735\",\"4737\",\"4755\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Group Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "9e534190-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:06.806Z", - "version": "WzQ4MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4734, 4730, 4758\",\"params\":[\"4734\",\"4730\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:32:43.899Z", - "version": "WzQ4MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Added - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Added - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "ce867840-f49e-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:09:21.781Z", - "version": "WzM2NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4729, 4757\",\"params\":[\"4733\",\"4729\",\"4757\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4757\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Removed from Group - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Removed from Group - Table\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":5,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":4,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.MemberName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by Logon ID\"}}]}" - }, - "id": "fee83900-f49f-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T09:11:21.532Z", - "version": "WzM2OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":[\"4799\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4799\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "5_Group_Enum", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"5_Group_Enum\",\"type\":\"table\",\"params\":{\"perPage\":5,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":4,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":3,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Group\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"group.domain\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Domain\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator\"}},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Creator LogonID\"}}]}" - }, - "id": "bc165210-f4b8-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-10-22T10:43:29.024Z", - "version": "WzI2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4732, 4728, 4756\",\"params\":[\"4732\",\"4728\",\"4756\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4756\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Added - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Added - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Reds\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Added to Groups\"}}]}" - }, - "id": "a13bf640-fee8-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:29:24.078Z", - "version": "WzQzMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"key\":\"event.code\",\"negate\":false,\"params\":[\"4734\",\"4730\",\"4758\"],\"type\":\"phrases\",\"value\":\"4734, 4730, 4758\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}]}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Deleted- Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Deleted- Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greens\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Deleted\"}}]}" - }, - "id": "5eeaafd0-fee7-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:28:52.621Z", - "version": "WzQzMCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4727, 4754\",\"params\":[\"4731\",\"4727\",\"4754\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4754\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Created - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Created - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Reds\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Created\"}}]}" - }, - "id": "f42f3b20-fee6-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:28:05.274Z", - "version": "WzQyOCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4735, 4737, 4755, 4764\",\"params\":[\"4735\",\"4737\",\"4755\",\"4764\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4764\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Groups Changes - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Groups Changes - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greys\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Groups Changed\"}}]}" - }, - "id": "b5f38780-fee6-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:28:25.310Z", - "version": "WzQyOSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4733, 4727, 4729\",\"params\":[\"4733\",\"4727\",\"4729\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4729\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Removed from Group - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Removed from Group - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Greens\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Removed from Groups\"}}]}" - }, - "id": "1b5f17d0-feea-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:29:51.186Z", - "version": "WzQzMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4799\",\"params\":{\"query\":\"4799\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4799\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Membership Enumeration - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Membership Enumeration - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Blues\",\"metricColorMode\":\"Background\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":true,\"style\":{\"bgFill\":\"#000\",\"bgColor\":true,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Group Membership Enumerated\"}}]}" - }, - "id": "0f2f5280-feeb-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:30:31.143Z", - "version": "WzQzMywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Group Management Action Distribution over Time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Group Management Action Distribution over Time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-10-05T09:56:42.142Z\",\"max\":\"2019-11-04T10:56:42.142Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-30d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "24954800-fef0-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:56:51.856Z", - "version": "WzQ1MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "group.name", - "group.domain", - "user.name", - "user.domain", - "host.name" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\",\"params\":[\"4731\",\"4732\",\"4733\",\"4734\",\"4735\",\"4737\",\"4764\",\"4799\",\"4727\",\"4728\",\"4729\",\"4730\",\"4754\",\"4755\",\"4756\",\"4757\",\"4758\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4731\"}},{\"match_phrase\":{\"event.code\":\"4732\"}},{\"match_phrase\":{\"event.code\":\"4733\"}},{\"match_phrase\":{\"event.code\":\"4734\"}},{\"match_phrase\":{\"event.code\":\"4735\"}},{\"match_phrase\":{\"event.code\":\"4737\"}},{\"match_phrase\":{\"event.code\":\"4764\"}},{\"match_phrase\":{\"event.code\":\"4799\"}},{\"match_phrase\":{\"event.code\":\"4727\"}},{\"match_phrase\":{\"event.code\":\"4728\"}},{\"match_phrase\":{\"event.code\":\"4729\"}},{\"match_phrase\":{\"event.code\":\"4730\"}},{\"match_phrase\":{\"event.code\":\"4754\"}},{\"match_phrase\":{\"event.code\":\"4755\"}},{\"match_phrase\":{\"event.code\":\"4756\"}},{\"match_phrase\":{\"event.code\":\"4757\"}},{\"match_phrase\":{\"event.code\":\"4758\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Group Management Details - Search View", - "version": 1 - }, - "id": "9066d5b0-fef2-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T11:02:16.971Z", - "version": "WzQ2MCwxXQ==" - } - ], - "version": "7.3.1" -} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json deleted file mode 100644 index fa95d5ac824..00000000000 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events.json +++ /dev/null @@ -1,778 +0,0 @@ -{ - "objects": [ - { - "attributes": { - "description": "Includes Visual Builder Metric Interval size 90 days", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":17,\"h\":19,\"i\":\"1\"},\"panelIndex\":\"1\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"x\":17,\"y\":0,\"w\":18,\"h\":19,\"i\":\"2\"},\"panelIndex\":\"2\",\"title\":\"User Management Actions\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":46,\"w\":9,\"h\":16,\"i\":\"3\"},\"panelIndex\":\"3\",\"title\":\"Created Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":35,\"y\":0,\"w\":13,\"h\":19,\"i\":\"4\"},\"panelIndex\":\"4\",\"title\":\"Event Codes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":46,\"w\":9,\"h\":16,\"i\":\"5\"},\"panelIndex\":\"5\",\"title\":\"Enabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":69,\"w\":9,\"h\":16,\"i\":\"6\"},\"panelIndex\":\"6\",\"title\":\"Disabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":46,\"w\":9,\"h\":16,\"i\":\"7\"},\"panelIndex\":\"7\",\"title\":\"Deleted Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 4\":\"rgb(247,252,245)\",\"12 - 16\":\"rgb(35,139,69)\",\"4 - 8\":\"rgb(199,233,192)\",\"8 - 12\":\"rgb(116,196,118)\"},\"legendOpen\":false}},\"gridData\":{\"x\":0,\"y\":19,\"w\":27,\"h\":20,\"i\":\"8\"},\"panelIndex\":\"8\",\"title\":\"Actions performed over Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":18,\"y\":69,\"w\":9,\"h\":16,\"i\":\"9\"},\"panelIndex\":\"9\",\"title\":\"Passwords Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":9,\"y\":69,\"w\":9,\"h\":16,\"i\":\"15\"},\"panelIndex\":\"15\",\"title\":\"Unlocked Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":36,\"y\":69,\"w\":12,\"h\":16,\"i\":\"16\"},\"panelIndex\":\"16\",\"title\":\"Users Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":69,\"w\":9,\"h\":16,\"i\":\"20\"},\"panelIndex\":\"20\",\"title\":\"Locked-out Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":19,\"w\":21,\"h\":20,\"i\":\"21\"},\"panelIndex\":\"21\",\"title\":\"User Management Actions Distributions over Time\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":27,\"y\":39,\"w\":21,\"h\":23,\"i\":\"22\"},\"panelIndex\":\"22\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":85,\"w\":48,\"h\":19,\"i\":\"23\"},\"panelIndex\":\"23\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_14\"},{\"gridData\":{\"x\":0,\"y\":62,\"w\":9,\"h\":7,\"i\":\"24\"},\"version\":\"7.3.1\",\"panelIndex\":\"24\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_15\"},{\"gridData\":{\"x\":9,\"y\":39,\"w\":9,\"h\":7,\"i\":\"25\"},\"version\":\"7.3.1\",\"panelIndex\":\"25\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_16\"},{\"gridData\":{\"x\":18,\"y\":39,\"w\":9,\"h\":7,\"i\":\"26\"},\"version\":\"7.3.1\",\"panelIndex\":\"26\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_17\"},{\"gridData\":{\"x\":0,\"y\":39,\"w\":9,\"h\":7,\"i\":\"27\"},\"version\":\"7.3.1\",\"panelIndex\":\"27\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_18\"},{\"gridData\":{\"x\":9,\"y\":62,\"w\":9,\"h\":7,\"i\":\"28\"},\"version\":\"7.3.1\",\"panelIndex\":\"28\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_19\"},{\"gridData\":{\"x\":18,\"y\":62,\"w\":9,\"h\":7,\"i\":\"29\"},\"version\":\"7.3.1\",\"panelIndex\":\"29\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_20\"},{\"gridData\":{\"x\":27,\"y\":62,\"w\":9,\"h\":7,\"i\":\"30\"},\"version\":\"7.3.1\",\"panelIndex\":\"30\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_21\"},{\"gridData\":{\"x\":36,\"y\":62,\"w\":12,\"h\":7,\"i\":\"31\"},\"version\":\"7.3.1\",\"panelIndex\":\"31\",\"embeddableConfig\":{},\"title\":\"\",\"panelRefName\":\"panel_22\"}]", - "timeRestore": false, - "title": "[winlogbeat] User Management Events", - "version": 1 - }, - "id": "71f720f0-ff18-11e9-8405-516218e3d268", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ - { - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_10", - "type": "visualization" - }, - { - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "name": "panel_11", - "type": "visualization" - }, - { - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "name": "panel_12", - "type": "visualization" - }, - { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_13", - "type": "search" - }, - { - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "name": "panel_14", - "type": "search" - }, - { - "id": "97c70300-ff1c-11e9-8405-516218e3d268", - "name": "panel_15", - "type": "visualization" - }, - { - "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", - "name": "panel_16", - "type": "visualization" - }, - { - "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", - "name": "panel_17", - "type": "visualization" - }, - { - "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", - "name": "panel_18", - "type": "visualization" - }, - { - "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", - "name": "panel_19", - "type": "visualization" - }, - { - "id": "60301890-ff1d-11e9-8405-516218e3d268", - "name": "panel_20", - "type": "visualization" - }, - { - "id": "9dd22440-ff1d-11e9-8405-516218e3d268", - "name": "panel_21", - "type": "visualization" - }, - { - "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", - "name": "panel_22", - "type": "visualization" - } - ], - "type": "dashboard", - "updated_at": "2019-11-05T15:40:21.391Z", - "version": "WzU2MiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "User Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **User Management Events**\\n\\n#### This dashboard shows information about User Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description\\n-- | --\\n4720 | A user account was created\\n4722 | A user account was enabled\\n4723 | An attempt was made to change an account's password\\n4724 | An attempt was made to reset an account's password\\n4725 | An user account was disabled\\n4726 | An user account was deleted\\n4738 | An user account was changed\\n4740 | An user account was locked out\\n4767 | An account was unlocked\\n4781 | The name of an account was changed\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T10:20:41.549Z", - "version": "WzQxNywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T11:13:23.297Z", - "version": "WzQ2NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Created User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:35:21.465Z", - "version": "WzQ4NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}},{\"accessor\":1,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}}],\"metrics\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"perPage\":10,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Short Description\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:23:43.282Z", - "version": "WzQyMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Enabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Enabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:37:53.874Z", - "version": "WzQ4NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Disabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Disabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:15:00.943Z", - "version": "WzUwNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Deleted User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed LogonId\"}}]}" - }, - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:44:25.678Z", - "version": "WzQ5MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Affected Users vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 14\":\"rgb(247,251,255)\",\"14 - 28\":\"rgb(198,219,239)\",\"28 - 42\":\"rgb(107,174,214)\",\"42 - 55\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Affected Users vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Operation\"}}]}" - }, - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:24:35.247Z", - "version": "WzQyNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Password Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Password Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Password Change to\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:21:59.683Z", - "version": "WzUxMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":{\"query\":\"4767\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4767\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Unlocked Users - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Unlocked Users - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Unlocked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer Logonid\"}}]}" - }, - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:25:13.281Z", - "version": "WzUxNSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":{\"query\":\"4738\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4738\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Changes Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Changes Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Changed User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:26:15.729Z", - "version": "WzUxNiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":{\"query\":\"4740\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4740\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Locked Out - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Locked Out - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Locked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:24:32.268Z", - "version": "WzUxNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\",\"4798\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4798\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "4_Event_Distribution in time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"4_Event_Distribution in time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-09-20T13:10:39.628Z\",\"max\":\"2019-11-04T14:10:39.628Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-45d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:12:00.548Z", - "version": "WzQ3NiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "user.name", - "user.domain", - "winlog.event_data.SubjectUserName", - "winlog.event_data.SubjectDomainName", - "winlog.logon.id" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "User management Details - Search", - "version": 1 - }, - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T12:04:57.352Z", - "version": "WzQ3NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Disabled - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Disabled\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(219,223,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4725\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "97c70300-ff1c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:06:23.209Z", - "version": "WzUyOSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Enabled - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Enabled\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(251,158,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4722\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "bf45dc50-ff1a-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:01:43.218Z", - "version": "WzUyNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Deleted - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Deleted\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(176,188,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4726\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "7322f9f0-ff1c-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:02:50.506Z", - "version": "WzUyNiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Created - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Created - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Created\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(159,5,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4720\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "d3a5fec0-ff18-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T15:49:13.249Z", - "version": "WzUyMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Unlocks - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Unlocks - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Unlocks\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(254,146,0,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4767\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "1b6725f0-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:08:21.249Z", - "version": "WzUzMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Password Changes - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Password Changes - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Password Changes/Reset\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(22,165,165,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4723\\\" OR event.code: \\\"4724\\\"\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "60301890-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:10:09.726Z", - "version": "WzUzNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users locked Out - VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users locked Out - VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Locked Out\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(51,51,51,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4740\\\"\",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "9dd22440-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:24:47.051Z", - "version": "WzU0MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}" - }, - "title": "Users Changes VB Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Changes VB Metric\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"metric\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\"}],\"separate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"Users Changes\"}],\"time_field\":\"\",\"index_pattern\":\"\",\"interval\":\"90d\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"axis_scale\":\"normal\",\"show_legend\":1,\"show_grid\":1,\"default_index_pattern\":\"winlogbeat-*\",\"default_timefield\":\"@timestamp\",\"background_color_rules\":[{\"value\":0,\"id\":\"8d597960-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"lte\"},{\"value\":1,\"id\":\"a3f59730-ff18-11e9-8249-2371c695f3b0\",\"operator\":\"gte\",\"background_color\":\"rgba(179,179,179,1)\"}],\"filter\":{\"query\":\"event.code: \\\"4738\\\" \",\"language\":\"kuery\"},\"drop_last_bucket\":0},\"aggs\":[]}" - }, - "id": "c9d959f0-ff1d-11e9-8405-516218e3d268", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T16:12:34.736Z", - "version": "WzUzOCwxXQ==" - } - ], - "version": "7.3.1" -} diff --git a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json b/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json deleted file mode 100644 index d484f3d1634..00000000000 --- a/x-pack/winlogbeat/module/security/_meta/kibana/7/dashboard/[winlogbeat]_User_Management_Events_Simple_Metrics.json +++ /dev/null @@ -1,866 +0,0 @@ -{ - "objects": [ - { - "attributes": { - "description": "Uses Simple Metric Visualizations", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"1\",\"w\":17,\"x\":0,\"y\":0},\"panelIndex\":\"1\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{\"vis\":{\"legendOpen\":false}},\"gridData\":{\"h\":19,\"i\":\"2\",\"w\":18,\"x\":17,\"y\":0},\"panelIndex\":\"2\",\"title\":\"User Management Actions\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"3\",\"w\":9,\"x\":0,\"y\":44},\"panelIndex\":\"3\",\"title\":\"Created Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_2\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"4\",\"w\":13,\"x\":35,\"y\":0},\"panelIndex\":\"4\",\"title\":\"Event Codes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_3\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"5\",\"w\":9,\"x\":9,\"y\":44},\"panelIndex\":\"5\",\"title\":\"Enabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_4\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"6\",\"w\":9,\"x\":0,\"y\":66},\"panelIndex\":\"6\",\"title\":\"Disabled Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"7\",\"w\":9,\"x\":18,\"y\":44},\"panelIndex\":\"7\",\"title\":\"Deleted Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_6\"},{\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 4\":\"rgb(247,252,245)\",\"12 - 16\":\"rgb(35,139,69)\",\"4 - 8\":\"rgb(199,233,192)\",\"8 - 12\":\"rgb(116,196,118)\"},\"legendOpen\":false}},\"gridData\":{\"h\":20,\"i\":\"8\",\"w\":27,\"x\":0,\"y\":19},\"panelIndex\":\"8\",\"title\":\"Actions performed over Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_7\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"9\",\"w\":9,\"x\":18,\"y\":66},\"panelIndex\":\"9\",\"title\":\"Passwords Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_8\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"10\",\"w\":9,\"x\":0,\"y\":39},\"panelIndex\":\"10\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_9\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"11\",\"w\":9,\"x\":9,\"y\":39},\"panelIndex\":\"11\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_10\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":5,\"i\":\"12\",\"w\":9,\"x\":18,\"y\":39},\"panelIndex\":\"12\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_11\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"13\",\"w\":9,\"x\":0,\"y\":60},\"panelIndex\":\"13\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_12\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"14\",\"w\":9,\"x\":18,\"y\":60},\"panelIndex\":\"14\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_13\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"15\",\"w\":9,\"x\":9,\"y\":66},\"panelIndex\":\"15\",\"title\":\"Unlocked Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_14\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"16\",\"w\":12,\"x\":36,\"y\":66},\"panelIndex\":\"16\",\"title\":\"Users Changes\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_15\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"17\",\"w\":9,\"x\":27,\"y\":60},\"panelIndex\":\"17\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_16\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"18\",\"w\":9,\"x\":9,\"y\":60},\"panelIndex\":\"18\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_17\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":6,\"i\":\"19\",\"w\":12,\"x\":36,\"y\":60},\"panelIndex\":\"19\",\"title\":\"\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_18\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":16,\"i\":\"20\",\"w\":9,\"x\":27,\"y\":66},\"panelIndex\":\"20\",\"title\":\"Locked-out Users\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_19\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":20,\"i\":\"21\",\"w\":21,\"x\":27,\"y\":19},\"panelIndex\":\"21\",\"title\":\"User Management Actions Distributions over Time\",\"version\":\"7.3.0\",\"panelRefName\":\"panel_20\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":21,\"i\":\"22\",\"w\":21,\"x\":27,\"y\":39},\"panelIndex\":\"22\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_21\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":19,\"i\":\"23\",\"w\":48,\"x\":0,\"y\":82},\"panelIndex\":\"23\",\"version\":\"7.3.1\",\"panelRefName\":\"panel_22\"}]", - "timeRestore": false, - "title": "[winlogbeat] User Management Events - Simple Metric", - "version": 1 - }, - "id": "8223bed0-b9e9-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "dashboard": "7.3.0" - }, - "references": [ - { - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", - "name": "panel_10", - "type": "visualization" - }, - { - "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", - "name": "panel_11", - "type": "visualization" - }, - { - "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", - "name": "panel_12", - "type": "visualization" - }, - { - "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", - "name": "panel_13", - "type": "visualization" - }, - { - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_14", - "type": "visualization" - }, - { - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "name": "panel_15", - "type": "visualization" - }, - { - "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", - "name": "panel_16", - "type": "visualization" - }, - { - "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", - "name": "panel_17", - "type": "visualization" - }, - { - "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", - "name": "panel_18", - "type": "visualization" - }, - { - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "name": "panel_19", - "type": "visualization" - }, - { - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "name": "panel_20", - "type": "visualization" - }, - { - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "name": "panel_21", - "type": "search" - }, - { - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "name": "panel_22", - "type": "search" - } - ], - "type": "dashboard", - "updated_at": "2019-11-04T15:28:21.018Z", - "version": "WzUxNywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}" - }, - "title": "User Management Events - Description", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Description\",\"type\":\"markdown\",\"params\":{\"markdown\":\"# **User Management Events**\\n\\n#### This dashboard shows information about User Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description\\n-- | --\\n4720 | A user account was created\\n4722 | A user account was enabled\\n4723 | An attempt was made to change an account's password\\n4724 | An attempt was made to reset an account's password\\n4725 | An user account was disabled\\n4726 | An user account was deleted\\n4738 | An user account was changed\\n4740 | An user account was locked out\\n4767 | An account was unlocked\\n4781 | The name of an account was changed\",\"openLinksInNewTab\":false,\"fontSize\":10},\"aggs\":[]}" - }, - "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [], - "type": "visualization", - "updated_at": "2019-11-04T10:20:41.549Z", - "version": "WzQxNywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Donut", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Donut\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]},\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":true,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T11:13:23.297Z", - "version": "WzQ2NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Created - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Created - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Created User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonID\"}}]}" - }, - "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:35:21.465Z", - "version": "WzQ4NSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Event Actions - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Event Actions - Table\",\"type\":\"table\",\"params\":{\"dimensions\":{\"buckets\":[{\"accessor\":0,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}},{\"accessor\":1,\"aggType\":\"terms\",\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"missingBucketLabel\":\"Missing\",\"otherBucketLabel\":\"Other\"}},\"params\":{}}],\"metrics\":[{\"accessor\":2,\"aggType\":\"count\",\"format\":{\"id\":\"number\"},\"params\":{}}]},\"perPage\":10,\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Short Description\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"event.code\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Event Code\"}}]}" - }, - "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:23:43.282Z", - "version": "WzQyMiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Enabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Enabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:37:53.874Z", - "version": "WzQ4NywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Disabled - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Disabled User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:15:00.943Z", - "version": "WzUwNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Deleted - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Deleted User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed LogonId\"}}]}" - }, - "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:44:25.678Z", - "version": "WzQ5MywxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4765\",\"4766\",\"4767\",\"4780\",\"4781\",\"4794\",\"5376\",\"5377\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4765\"}},{\"match_phrase\":{\"event.code\":\"4766\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4780\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4794\"}},{\"match_phrase\":{\"event.code\":\"5376\"}},{\"match_phrase\":{\"event.code\":\"5377\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "User Management Events - Affected Users vs Actions - Heatmap", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 14\":\"rgb(247,251,255)\",\"14 - 28\":\"rgb(198,219,239)\",\"28 - 42\":\"rgb(107,174,214)\",\"42 - 55\":\"rgb(33,113,181)\"}}}", - "version": 1, - "visState": "{\"title\":\"User Management Events - Affected Users vs Actions - Heatmap\",\"type\":\"heatmap\",\"params\":{\"type\":\"heatmap\",\"addTooltip\":true,\"addLegend\":true,\"enableHover\":false,\"legendPosition\":\"right\",\"times\":[],\"colorsNumber\":4,\"colorSchema\":\"Blues\",\"setColorRange\":false,\"colorsRange\":[],\"invertColors\":false,\"percentageMode\":false,\"valueAxes\":[{\"show\":false,\"id\":\"ValueAxis-1\",\"type\":\"value\",\"scale\":{\"type\":\"linear\",\"defaultYExtents\":false},\"labels\":{\"show\":true,\"rotate\":0,\"overwriteColor\":false,\"color\":\"black\"}}],\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Target User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Operation\"}}]}" - }, - "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T10:24:35.247Z", - "version": "WzQyNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Password Changes - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Password Changes - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Password Change to\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:21:59.683Z", - "version": "WzUxMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4720\",\"params\":{\"query\":\"4720\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4720\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Created - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Created - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Created\"}}]}" - }, - "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:39:07.209Z", - "version": "WzQ5MCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4722\",\"params\":{\"query\":\"4722\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4722\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Enabled - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Enabled - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"user.name\",\"customLabel\":\"Users Enabled\"}}]}" - }, - "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:38:36.233Z", - "version": "WzQ4OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4726\",\"params\":{\"query\":\"4726\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4726\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Deleted - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Deleted - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Deleted Users\"}}]}" - }, - "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:39:59.945Z", - "version": "WzQ5MSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4725\",\"params\":{\"query\":\"4725\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4725\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Disabled - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Disabled - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"user.name\",\"customLabel\":\"Disabled Users\"}}]}" - }, - "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:00:11.591Z", - "version": "WzQ5NCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4723, 4724\",\"params\":[\"4723\",\"4724\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Password Reset / Changes", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Password Reset / Changes\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Password Changes\"}}]}" - }, - "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:01:45.486Z", - "version": "WzQ5OCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":{\"query\":\"4767\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4767\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Unlocked Users - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Unlocked Users - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Unlocked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer Logonid\"}}]}" - }, - "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:25:13.281Z", - "version": "WzUxNSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":{\"query\":\"4738\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4738\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Changes Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Changes Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Changed User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:26:15.729Z", - "version": "WzUxNiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":[\"4740\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4740\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Unlocks - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Unlocks - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Locked Out\"}}]}" - }, - "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:06:22.616Z", - "version": "WzUwMSwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4767\",\"params\":[\"4767\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4767\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Unlocked Users - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Unlocked Users - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Users Unlocks\"}}]}" - }, - "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:01:01.325Z", - "version": "WzQ5NiwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4738\",\"params\":[\"4738\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4738\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Changes - Simple Metric", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Users Changes - Simple Metric\",\"type\":\"metric\",\"params\":{\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"type\":\"range\",\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}},\"dimensions\":{\"metrics\":[{\"type\":\"vis_dimension\",\"accessor\":0,\"format\":{\"id\":\"number\",\"params\":{}}}]},\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"Changes in Users\"}}]}" - }, - "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:03:27.480Z", - "version": "WzUwMCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"type\":\"phrase\",\"key\":\"event.code\",\"value\":\"4740\",\"params\":{\"query\":\"4740\"},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"event.code\":{\"query\":\"4740\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "Users Locked Out - Table", - "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", - "version": 1, - "visState": "{\"title\":\"Users Locked Out - Table\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\",\"dimensions\":{\"metrics\":[{\"accessor\":3,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":1,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"},{\"accessor\":2,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"user.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Locked User\"}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.event_data.SubjectUserName\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performed by\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"winlog.logon.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Performer LogonId\"}}]}" - }, - "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T15:24:32.268Z", - "version": "WzUxNCwxXQ==" - }, - { - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\",\"4798\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}},{\"match_phrase\":{\"event.code\":\"4798\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "title": "4_Event_Distribution in time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"4_Event_Distribution in time\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"bottom\",\"times\":[],\"addTimeMarker\":false,\"labels\":{\"show\":true},\"dimensions\":{\"x\":{\"accessor\":0,\"format\":{\"id\":\"date\",\"params\":{\"pattern\":\"YYYY-MM-DD HH:mm\"}},\"params\":{\"date\":true,\"interval\":\"PT12H\",\"format\":\"YYYY-MM-DD HH:mm\",\"bounds\":{\"min\":\"2019-09-20T13:10:39.628Z\",\"max\":\"2019-11-04T14:10:39.628Z\"}},\"aggType\":\"date_histogram\"},\"y\":[{\"accessor\":2,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}],\"series\":[{\"accessor\":1,\"format\":{},\"params\":{},\"aggType\":\"filters\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"timeRange\":{\"from\":\"now-45d\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"interval\":\"auto\",\"drop_partials\":false,\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.action\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":5,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}" - }, - "id": "8f723a10-bd97-11e9-b9c5-fddc96658612", - "migrationVersion": { - "visualization": "7.3.1" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2019-11-04T14:12:00.548Z", - "version": "WzQ3NiwxXQ==" - }, - { - "attributes": { - "columns": [ - "user.name", - "source.domain", - "source.ip", - "winlog.logon.id", - "winlog.logon.type" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4624\",\"params\":[\"4624\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4624\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "Logon Details", - "version": 1 - }, - "id": "7e178c80-fee1-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T09:00:36.878Z", - "version": "WzM2MiwxXQ==" - }, - { - "attributes": { - "columns": [ - "event.action", - "user.name", - "user.domain", - "winlog.event_data.SubjectUserName", - "winlog.event_data.SubjectDomainName", - "winlog.logon.id" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[{\"meta\":{\"type\":\"phrases\",\"key\":\"event.code\",\"value\":\"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781\",\"params\":[\"4720\",\"4722\",\"4723\",\"4724\",\"4725\",\"4726\",\"4738\",\"4740\",\"4767\",\"4781\"],\"alias\":null,\"negate\":false,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"bool\":{\"should\":[{\"match_phrase\":{\"event.code\":\"4720\"}},{\"match_phrase\":{\"event.code\":\"4722\"}},{\"match_phrase\":{\"event.code\":\"4723\"}},{\"match_phrase\":{\"event.code\":\"4724\"}},{\"match_phrase\":{\"event.code\":\"4725\"}},{\"match_phrase\":{\"event.code\":\"4726\"}},{\"match_phrase\":{\"event.code\":\"4738\"}},{\"match_phrase\":{\"event.code\":\"4740\"}},{\"match_phrase\":{\"event.code\":\"4767\"}},{\"match_phrase\":{\"event.code\":\"4781\"}}],\"minimum_should_match\":1}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" - }, - "sort": [ - "@timestamp", - "desc" - ], - "title": "User management Details - Search", - "version": 1 - }, - "id": "324686c0-fefb-11e9-8405-516218e3d268", - "migrationVersion": { - "search": "7.0.0" - }, - "references": [ - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "winlogbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search", - "updated_at": "2019-11-04T12:04:57.352Z", - "version": "WzQ3NSwxXQ==" - } - ], - "version": "7.3.1" -}