Created
January 21, 2014 21:29
-
-
Save VAdamec/8548768 to your computer and use it in GitHub Desktop.
Kibana3 dashboard for OSSEC (using fields from logstash basic parsing)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"title": "OSSEC", | |
"services": { | |
"query": { | |
"idQueue": [ | |
0, | |
1 | |
], | |
"list": { | |
"2": { | |
"id": 2, | |
"color": "#E0752D", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.DESCRIPTION:*SSHD*" | |
}, | |
"3": { | |
"id": 3, | |
"color": "#F2C96D", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.ORIGMESSAGE:*audit*" | |
}, | |
"4": { | |
"id": 4, | |
"color": "#82B5D8", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.DESCRIPTION:*attack*" | |
}, | |
"5": { | |
"id": 5, | |
"color": "#D683CE", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.LEVEL:10" | |
}, | |
"6": { | |
"id": 6, | |
"color": "#BA43A9", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.LEVEL:11" | |
}, | |
"7": { | |
"id": 7, | |
"color": "#705DA0", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.LEVEL:12" | |
}, | |
"8": { | |
"id": 8, | |
"color": "#508642", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.LEVEL:13" | |
}, | |
"9": { | |
"id": 9, | |
"color": "#CCA300", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.LEVEL:14" | |
}, | |
"10": { | |
"id": 10, | |
"color": "#447EBC", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "@fields.LEVEL:15" | |
} | |
}, | |
"ids": [ | |
2, | |
3, | |
4, | |
5, | |
6, | |
7, | |
8, | |
9, | |
10 | |
] | |
}, | |
"filter": { | |
"idQueue": [ | |
1, | |
5 | |
], | |
"list": { | |
"0": { | |
"type": "time", | |
"field": "@timestamp", | |
"from": "now-6h", | |
"to": "now", | |
"mandate": "must", | |
"active": true, | |
"alias": "", | |
"id": 0 | |
}, | |
"2": { | |
"type": "field", | |
"field": "@fields.DESCRIPTION", | |
"query": "(\"File added to the system.\")", | |
"mandate": "mustNot", | |
"active": true, | |
"alias": "", | |
"id": 2 | |
}, | |
"3": { | |
"type": "field", | |
"field": "@fields.DESCRIPTION", | |
"query": "(\"SSHD authentication success.\")", | |
"mandate": "mustNot", | |
"active": true, | |
"alias": "", | |
"id": 3 | |
}, | |
"4": { | |
"type": "field", | |
"field": "@fields.DESCRIPTION", | |
"query": "(\"Listened ports have changed.\")", | |
"mandate": "mustNot", | |
"active": true, | |
"alias": "", | |
"id": 4 | |
} | |
}, | |
"ids": [ | |
2, | |
3, | |
4, | |
0 | |
] | |
} | |
}, | |
"rows": [ | |
{ | |
"title": "Histogram", | |
"height": "150px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"span": 12, | |
"editable": true, | |
"type": "histogram", | |
"loadingEditor": false, | |
"mode": "count", | |
"time_field": "@timestamp", | |
"queries": { | |
"mode": "all", | |
"ids": [ | |
2, | |
3, | |
4, | |
5, | |
6, | |
7, | |
8, | |
9, | |
10 | |
] | |
}, | |
"annotate": { | |
"enable": false, | |
"query": "*", | |
"size": 20, | |
"field": "_type", | |
"sort": [ | |
"_score", | |
"desc" | |
] | |
}, | |
"value_field": null, | |
"auto_int": true, | |
"resolution": 100, | |
"interval": "5m", | |
"intervals": [ | |
"auto", | |
"1s", | |
"1m", | |
"5m", | |
"10m", | |
"30m", | |
"1h", | |
"3h", | |
"12h", | |
"1d", | |
"1w", | |
"1y" | |
], | |
"fill": 2, | |
"linewidth": 1, | |
"pointradius": 5, | |
"timezone": "browser", | |
"spyable": true, | |
"zoomlinks": true, | |
"bars": false, | |
"stack": true, | |
"points": false, | |
"lines": true, | |
"legend": true, | |
"show_query": true, | |
"legend_counts": true, | |
"x-axis": true, | |
"y-axis": true, | |
"percentage": false, | |
"zerofill": true, | |
"interactive": true, | |
"options": true, | |
"derivative": false, | |
"scale": 1, | |
"tooltip": { | |
"value_type": "cumulative", | |
"query_as_alias": true | |
}, | |
"grid": { | |
"max": null, | |
"min": 0 | |
}, | |
"y_as_bytes": false, | |
"y_format": "none" | |
} | |
], | |
"notice": false | |
}, | |
{ | |
"title": "Graphs", | |
"height": "150px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"error": false, | |
"span": 3, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"queries": { | |
"mode": "all", | |
"ids": [ | |
2, | |
3, | |
4, | |
5, | |
6, | |
7, | |
8, | |
9, | |
10 | |
] | |
}, | |
"field": "@fields.SERVER", | |
"exclude": [], | |
"missing": false, | |
"other": false, | |
"size": 10, | |
"order": "count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "bar", | |
"counter_pos": "below", | |
"spyable": true, | |
"title": "Server", | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "" | |
}, | |
{ | |
"error": false, | |
"span": 3, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"queries": { | |
"mode": "all", | |
"ids": [ | |
2, | |
3, | |
4, | |
5, | |
6, | |
7, | |
8, | |
9, | |
10 | |
] | |
}, | |
"field": "@fields.DESCRIPTION", | |
"exclude": [], | |
"missing": false, | |
"other": false, | |
"size": 10, | |
"order": "term", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "bar", | |
"counter_pos": "below", | |
"spyable": true, | |
"title": "Type", | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "" | |
}, | |
{ | |
"error": false, | |
"span": 3, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"queries": { | |
"mode": "all", | |
"ids": [ | |
2, | |
3, | |
4, | |
5, | |
6, | |
7, | |
8, | |
9, | |
10 | |
] | |
}, | |
"field": "@fields.LEVEL", | |
"exclude": [], | |
"missing": false, | |
"other": false, | |
"size": 10, | |
"order": "count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "bar", | |
"counter_pos": "below", | |
"spyable": true, | |
"title": "Level", | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "" | |
}, | |
{ | |
"error": false, | |
"span": 3, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"queries": { | |
"mode": "all", | |
"ids": [ | |
2, | |
3, | |
4, | |
5, | |
6, | |
7, | |
8, | |
9, | |
10 | |
] | |
}, | |
"field": "@fields.RULE", | |
"exclude": [], | |
"missing": false, | |
"other": false, | |
"size": 10, | |
"order": "count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "bar", | |
"counter_pos": "below", | |
"spyable": true, | |
"title": "Rule", | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "" | |
} | |
], | |
"notice": false | |
}, | |
{ | |
"title": "Result", | |
"height": "500px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"error": false, | |
"span": 12, | |
"editable": true, | |
"type": "table", | |
"loadingEditor": false, | |
"queries": { | |
"mode": "all", | |
"ids": [ | |
2, | |
3, | |
4, | |
5, | |
6, | |
7, | |
8, | |
9, | |
10 | |
] | |
}, | |
"size": 100, | |
"pages": 5, | |
"offset": 0, | |
"sort": [ | |
"@timestamp", | |
"desc" | |
], | |
"group": "default", | |
"style": { | |
"font-size": "9pt" | |
}, | |
"overflow": "min-height", | |
"fields": [ | |
"@timestamp", | |
"@fields.SERVER", | |
"@fields.DESCRIPTION", | |
"@fields.RULE", | |
"@fields.LEVEL", | |
"@fields.LOG", | |
"@fields.ORIGMESSAGE" | |
], | |
"highlight": [ | |
"@fields.TYPE", | |
"@fields.SERVER", | |
"@fields.LOG", | |
"@fields.RULE", | |
"@fields.DESCRIPTION", | |
"@fields.ORIGMESSAGE" | |
], | |
"sortable": true, | |
"header": true, | |
"paging": true, | |
"field_list": false, | |
"all_fields": true, | |
"trimFactor": 500, | |
"normTimes": true, | |
"spyable": true, | |
"title": "Result", | |
"localTime": false, | |
"timeField": "@timestamp" | |
} | |
], | |
"notice": false | |
} | |
], | |
"editable": true, | |
"failover": false, | |
"index": { | |
"interval": "day", | |
"pattern": "[ossec-logstash-]YYYY.MM.DD", | |
"default": "_all", | |
"warm_fields": true | |
}, | |
"style": "light", | |
"panel_hints": false, | |
"pulldowns": [ | |
{ | |
"type": "query", | |
"collapse": true, | |
"notice": false, | |
"enable": true, | |
"query": "*", | |
"pinned": true, | |
"history": [ | |
"@fields.LEVEL:15", | |
"@fields.LEVEL:14", | |
"@fields.LEVEL:13", | |
"@fields.LEVEL:12", | |
"@fields.LEVEL:11", | |
"@fields.LEVEL:10", | |
"@fields.DESCRIPTION:*attack*", | |
"@fields.ORIGMESSAGE:*audit*", | |
"@fields.DESCRIPTION:*SSHD*", | |
"@source_host:ossec.cz*" | |
], | |
"remember": 10 | |
}, | |
{ | |
"type": "filtering", | |
"collapse": true, | |
"notice": true, | |
"enable": true | |
} | |
], | |
"nav": [ | |
{ | |
"type": "timepicker", | |
"collapse": false, | |
"notice": false, | |
"enable": true, | |
"status": "Stable", | |
"time_options": [ | |
"5m", | |
"15m", | |
"30m", | |
"1h", | |
"6h", | |
"12h", | |
"24h", | |
"2d", | |
"7d", | |
"30d" | |
], | |
"refresh_intervals": [ | |
"5s", | |
"10s", | |
"30s", | |
"1m", | |
"5m", | |
"15m", | |
"30m", | |
"1h", | |
"2h", | |
"1d" | |
], | |
"timefield": "@timestamp", | |
"now": true, | |
"filter_id": 0 | |
} | |
], | |
"loader": { | |
"save_gist": false, | |
"save_elasticsearch": true, | |
"save_local": true, | |
"save_default": true, | |
"save_temp": true, | |
"save_temp_ttl_enable": true, | |
"save_temp_ttl": "30d", | |
"load_gist": false, | |
"load_elasticsearch": true, | |
"load_elasticsearch_size": 20, | |
"load_local": false, | |
"hide": false | |
}, | |
"refresh": "5m" | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment