Created
August 4, 2015 10:58
-
-
Save evoxco/16e1bd83cb9f4386bdab to your computer and use it in GitHub Desktop.
Bro ids HTTP Kibana dashboard
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"title": "Broids-HTTP", | |
"services": { | |
"query": { | |
"list": { | |
"0": { | |
"id": 0, | |
"color": "#7EB26D", | |
"alias": "All Connections", | |
"pin": true, | |
"type": "lucene", | |
"enable": true, | |
"query": "_type:\"conn\"" | |
}, | |
"1": { | |
"id": 1, | |
"color": "#EAB839", | |
"alias": "HTTP", | |
"pin": true, | |
"type": "lucene", | |
"enable": true, | |
"query": "_type:\"http\"" | |
}, | |
"2": { | |
"id": 2, | |
"color": "#6ED0E0", | |
"alias": "SSL", | |
"pin": true, | |
"type": "lucene", | |
"enable": true, | |
"query": "_type:\"ssl\"" | |
}, | |
"3": { | |
"id": 3, | |
"color": "#EF843C", | |
"alias": "", | |
"pin": false, | |
"type": "lucene", | |
"enable": true, | |
"query": "_type:\"http\"" | |
} | |
}, | |
"ids": [ | |
0, | |
1, | |
2, | |
3 | |
] | |
}, | |
"filter": { | |
"list": { | |
"0": { | |
"type": "querystring", | |
"query": "\"term\": {\"_type\":\"http\"}", | |
"mandate": "must", | |
"active": false, | |
"alias": "", | |
"id": 0 | |
}, | |
"1": { | |
"type": "time", | |
"field": "ts", | |
"from": "now-6h", | |
"to": "now", | |
"mandate": "must", | |
"active": true, | |
"alias": "", | |
"id": 1 | |
} | |
}, | |
"ids": [ | |
0, | |
1 | |
] | |
} | |
}, | |
"rows": [ | |
{ | |
"title": "Time Events", | |
"height": "300px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"span": 12, | |
"editable": true, | |
"type": "histogram", | |
"loadingEditor": false, | |
"mode": "count", | |
"time_field": "ts", | |
"value_field": null, | |
"x-axis": true, | |
"y-axis": true, | |
"scale": 1, | |
"y_format": "none", | |
"grid": { | |
"max": null, | |
"min": 0 | |
}, | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1 | |
] | |
}, | |
"annotate": { | |
"enable": false, | |
"query": "*", | |
"size": 20, | |
"field": "_type", | |
"sort": [ | |
"_score", | |
"desc" | |
] | |
}, | |
"auto_int": false, | |
"resolution": 100, | |
"interval": "1m", | |
"intervals": [ | |
"auto", | |
"1s", | |
"1m", | |
"5m", | |
"10m", | |
"30m", | |
"1h", | |
"3h", | |
"12h", | |
"1d", | |
"1w", | |
"1y" | |
], | |
"lines": true, | |
"fill": 0, | |
"linewidth": 2, | |
"points": false, | |
"pointradius": 5, | |
"bars": false, | |
"stack": true, | |
"spyable": true, | |
"zoomlinks": true, | |
"options": true, | |
"legend": true, | |
"show_query": true, | |
"interactive": true, | |
"legend_counts": true, | |
"timezone": "browser", | |
"percentage": false, | |
"zerofill": true, | |
"derivative": false, | |
"tooltip": { | |
"value_type": "cumulative", | |
"query_as_alias": true | |
}, | |
"title": "Bro Events", | |
"scaleSeconds": false | |
} | |
], | |
"notice": false | |
}, | |
{ | |
"title": "Network Statistics", | |
"height": "350px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"span": 4, | |
"editable": true, | |
"type": "histogram", | |
"loadingEditor": false, | |
"mode": "count", | |
"time_field": "ts", | |
"value_field": "response_body_len", | |
"x-axis": true, | |
"y-axis": true, | |
"scale": "1", | |
"y_format": "bytes", | |
"grid": { | |
"max": null, | |
"min": 0 | |
}, | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1 | |
] | |
}, | |
"annotate": { | |
"enable": false, | |
"query": "*", | |
"size": 20, | |
"field": "_type", | |
"sort": [ | |
"_score", | |
"desc" | |
] | |
}, | |
"auto_int": false, | |
"resolution": 100, | |
"interval": "1m", | |
"intervals": [ | |
"auto", | |
"1s", | |
"1m", | |
"5m", | |
"10m", | |
"30m", | |
"1h", | |
"3h", | |
"12h", | |
"1d", | |
"1w", | |
"1y" | |
], | |
"lines": true, | |
"fill": 1, | |
"linewidth": 2, | |
"points": false, | |
"pointradius": 5, | |
"bars": false, | |
"stack": true, | |
"spyable": true, | |
"zoomlinks": true, | |
"options": true, | |
"legend": true, | |
"show_query": true, | |
"interactive": true, | |
"legend_counts": true, | |
"timezone": "browser", | |
"percentage": false, | |
"zerofill": true, | |
"derivative": true, | |
"tooltip": { | |
"value_type": "cumulative", | |
"query_as_alias": true | |
}, | |
"title": "Download Size", | |
"scaleSeconds": false | |
}, | |
{ | |
"error": false, | |
"span": 5, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"field": "id.orig_h", | |
"exclude": [], | |
"missing": false, | |
"other": false, | |
"size": 10, | |
"order": "count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "bar", | |
"counter_pos": "above", | |
"spyable": true, | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1 | |
] | |
}, | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "", | |
"title": "Top 10 talkers", | |
"tsums": false, | |
"dtype": "" | |
} | |
], | |
"notice": false | |
}, | |
{ | |
"title": "Graph", | |
"height": "250px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"error": false, | |
"span": 3, | |
"editable": true, | |
"group": [ | |
"default" | |
], | |
"type": "terms", | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1 | |
] | |
}, | |
"field": "status_code", | |
"exclude": [], | |
"missing": false, | |
"other": true, | |
"size": 10, | |
"order": "count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "table", | |
"counter_pos": "none", | |
"title": "Top 10 HTTP Status", | |
"spyable": true, | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "", | |
"tsums": false, | |
"dtype": "" | |
}, | |
{ | |
"error": false, | |
"span": 3, | |
"editable": true, | |
"group": [ | |
"default" | |
], | |
"type": "terms", | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1 | |
] | |
}, | |
"field": "method", | |
"exclude": [], | |
"missing": false, | |
"other": true, | |
"size": 10, | |
"order": "count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "table", | |
"counter_pos": "above", | |
"spyable": true, | |
"title": "HTTP methods", | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "", | |
"tsums": false, | |
"dtype": "" | |
}, | |
{ | |
"error": false, | |
"span": 5, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"field": "id.resp_p", | |
"exclude": [], | |
"missing": false, | |
"other": true, | |
"size": 5, | |
"order": "count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "pie", | |
"counter_pos": "above", | |
"spyable": true, | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1, | |
2 | |
] | |
}, | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "", | |
"title": "Top Protocols", | |
"tsums": false, | |
"dtype": "" | |
} | |
], | |
"notice": false | |
}, | |
{ | |
"title": "Agents", | |
"height": "350px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"error": false, | |
"span": 4, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"field": "user_agent", | |
"exclude": [], | |
"missing": false, | |
"other": false, | |
"size": 10, | |
"order": "reverse_count", | |
"style": { | |
"font-size": "10pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "table", | |
"counter_pos": "above", | |
"spyable": true, | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1 | |
] | |
}, | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "", | |
"title": "Less popular agents", | |
"tsums": false, | |
"dtype": "" | |
}, | |
{ | |
"error": false, | |
"span": 4, | |
"editable": true, | |
"type": "terms", | |
"loadingEditor": false, | |
"field": "host", | |
"exclude": [], | |
"missing": false, | |
"other": true, | |
"size": 10, | |
"order": "reverse_count", | |
"style": { | |
"font-size": "9pt" | |
}, | |
"donut": false, | |
"tilt": false, | |
"labels": true, | |
"arrangement": "horizontal", | |
"chart": "table", | |
"counter_pos": "above", | |
"spyable": true, | |
"queries": { | |
"mode": "selected", | |
"ids": [ | |
1 | |
] | |
}, | |
"tmode": "terms", | |
"tstat": "total", | |
"valuefield": "", | |
"title": "Less popular hosts", | |
"tsums": false, | |
"dtype": "" | |
} | |
], | |
"notice": false | |
}, | |
{ | |
"title": "AgentsTable", | |
"height": "250px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [], | |
"notice": false | |
}, | |
{ | |
"title": "Events", | |
"height": "650px", | |
"editable": true, | |
"collapse": false, | |
"collapsable": true, | |
"panels": [ | |
{ | |
"error": false, | |
"span": 12, | |
"editable": true, | |
"group": [ | |
"default" | |
], | |
"type": "table", | |
"size": 100, | |
"pages": 5, | |
"offset": 0, | |
"sort": [ | |
"_score", | |
"desc" | |
], | |
"style": { | |
"font-size": "9pt" | |
}, | |
"overflow": "min-height", | |
"fields": [ | |
"id.orig_h", | |
"id.orig_p", | |
"id.resp_h", | |
"id.resp_p", | |
"_type", | |
"host", | |
"proto" | |
], | |
"highlight": [], | |
"sortable": true, | |
"header": true, | |
"paging": true, | |
"spyable": true, | |
"queries": { | |
"mode": "unpinned", | |
"ids": [ | |
3 | |
] | |
}, | |
"field_list": true, | |
"status": "Stable", | |
"trimFactor": 300, | |
"normTimes": true, | |
"title": "Documents", | |
"all_fields": false, | |
"localTime": false, | |
"timeField": "@timestamp" | |
} | |
], | |
"notice": false | |
} | |
], | |
"editable": true, | |
"index": { | |
"interval": "none", | |
"pattern": "[bro-]YYYYMMDDHHmm", | |
"default": "bro*", | |
"warm_fields": true | |
}, | |
"style": "dark", | |
"failover": false, | |
"panel_hints": true, | |
"loader": { | |
"save_gist": false, | |
"save_elasticsearch": true, | |
"save_local": true, | |
"save_default": true, | |
"save_temp": true, | |
"save_temp_ttl_enable": true, | |
"save_temp_ttl": "30d", | |
"load_gist": true, | |
"load_elasticsearch": true, | |
"load_elasticsearch_size": 20, | |
"load_local": true, | |
"hide": false | |
}, | |
"pulldowns": [ | |
{ | |
"type": "query", | |
"collapse": false, | |
"notice": false, | |
"query": "*", | |
"pinned": true, | |
"history": [ | |
"_type:\"http\"", | |
"_type:\"ssl\"", | |
"_type:\"conn\"", | |
"user_agent:\"1.20*\"", | |
"_type:\"dns\"", | |
"", | |
"*", | |
"type:\"conn\"", | |
"_index:\"bro-201502011200\"", | |
"_index:bro-201502011200" | |
], | |
"remember": 10, | |
"enable": true | |
}, | |
{ | |
"type": "filtering", | |
"collapse": true, | |
"notice": false, | |
"enable": true | |
} | |
], | |
"nav": [ | |
{ | |
"type": "timepicker", | |
"collapse": false, | |
"notice": false, | |
"status": "Stable", | |
"time_options": [ | |
"5m", | |
"15m", | |
"1h", | |
"6h", | |
"12h", | |
"24h", | |
"2d", | |
"7d", | |
"30d" | |
], | |
"refresh_intervals": [ | |
"5s", | |
"10s", | |
"30s", | |
"1m", | |
"5m", | |
"15m", | |
"30m", | |
"1h", | |
"2h", | |
"1d" | |
], | |
"timefield": "ts", | |
"enable": true, | |
"now": true, | |
"filter_id": 1 | |
} | |
], | |
"refresh": "30s" | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment