-
-
Save jordanpotti/941de75af8c2496dae1b619c11222f52 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[ | |
{ | |
"_id": "78342a60-126d-11e8-b602-c72150ea97ab", | |
"_type": "dashboard", | |
"_source": { | |
"title": "OSQUERY", | |
"hits": 0, | |
"description": "Visualize osquery results", | |
"panelsJSON": "[{\"panelIndex\":\"3\",\"gridData\":{\"x\":0,\"y\":3,\"w\":5,\"h\":4,\"i\":\"3\"},\"id\":\"a0201830-127d-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"4\",\"gridData\":{\"x\":7,\"y\":0,\"w\":5,\"h\":3,\"i\":\"4\"},\"id\":\"cf524480-127c-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":3,\"y\":0,\"w\":4,\"h\":3,\"i\":\"5\"},\"id\":\"f5d781f0-1282-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"6\",\"gridData\":{\"x\":5,\"y\":3,\"w\":7,\"h\":4,\"i\":\"6\"},\"id\":\"5cd63230-1282-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"7\",\"gridData\":{\"x\":0,\"y\":0,\"w\":3,\"h\":3,\"i\":\"7\"},\"version\":\"6.1.1\",\"type\":\"visualization\",\"id\":\"746b1270-1283-11e8-b602-c72150ea97ab\"}]", | |
"optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", | |
"uiStateJSON": "{\"P-3\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-4\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-5\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}}", | |
"version": 1, | |
"timeRestore": false, | |
"kibanaSavedObjectMeta": { | |
"searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}" | |
} | |
} | |
} | |
] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[ | |
{ | |
"_id": "a0201830-127d-11e8-b602-c72150ea97ab", | |
"_type": "visualization", | |
"_source": { | |
"title": "osquery_cron_commands", | |
"visState": "{\"title\":\"osquery_cron_commands\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"snapshot.command.keyword\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\"}}]}", | |
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", | |
"description": "", | |
"version": 1, | |
"kibanaSavedObjectMeta": { | |
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[{\"meta\":{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"negate\":false,\"disabled\":false,\"alias\":null,\"type\":\"phrase\",\"key\":\"name\",\"value\":\"pack/linux_collection/crontab\",\"params\":{\"query\":\"pack/linux_collection/crontab\",\"type\":\"phrase\"}},\"query\":{\"match\":{\"name\":{\"query\":\"pack/linux_collection/crontab\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" | |
} | |
} | |
}, | |
{ | |
"_id": "cf524480-127c-11e8-b602-c72150ea97ab", | |
"_type": "visualization", | |
"_source": { | |
"title": "osquery_mount_paths", | |
"visState": "{\"title\":\"osquery_mount_paths\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"snapshot.path.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}", | |
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", | |
"description": "", | |
"version": 1, | |
"kibanaSavedObjectMeta": { | |
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" | |
} | |
} | |
}, | |
{ | |
"_id": "5cd63230-1282-11e8-b602-c72150ea97ab", | |
"_type": "visualization", | |
"_source": { | |
"title": "osquery_ports_listening", | |
"visState": "{\"title\":\"osquery_ports_listening\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"snapshot.port.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}", | |
"uiStateJSON": "{}", | |
"description": "", | |
"version": 1, | |
"kibanaSavedObjectMeta": { | |
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" | |
} | |
} | |
}, | |
{ | |
"_id": "f5d781f0-1282-11e8-b602-c72150ea97ab", | |
"_type": "visualization", | |
"_source": { | |
"title": "osquery_open_files", | |
"visState": "{\"title\":\"osquery_open_files\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"snapshot.path.keyword\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\"}}]}", | |
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", | |
"description": "", | |
"version": 1, | |
"kibanaSavedObjectMeta": { | |
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[{\"meta\":{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"negate\":false,\"disabled\":false,\"alias\":null,\"type\":\"phrase\",\"key\":\"name\",\"value\":\"open_files\",\"params\":{\"query\":\"open_files\",\"type\":\"phrase\"}},\"query\":{\"match\":{\"name\":{\"query\":\"open_files\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" | |
} | |
} | |
}, | |
{ | |
"_id": "746b1270-1283-11e8-b602-c72150ea97ab", | |
"_type": "visualization", | |
"_source": { | |
"title": "osquery_hosts", | |
"visState": "{\"title\":\"osquery_hosts\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"decorations.hostname.keyword\",\"customLabel\":\"# of osquery hosts\"}}]}", | |
"uiStateJSON": "{}", | |
"description": "", | |
"version": 1, | |
"kibanaSavedObjectMeta": { | |
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}" | |
} | |
} | |
} | |
] |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
How to draw above visualization? I have tried with above JSON .but it's not not working.