Instantly share code, notes, and snippets.

Embed
What would you like to do?
[
{
"_id": "78342a60-126d-11e8-b602-c72150ea97ab",
"_type": "dashboard",
"_source": {
"title": "OSQUERY",
"hits": 0,
"description": "Visualize osquery results",
"panelsJSON": "[{\"panelIndex\":\"3\",\"gridData\":{\"x\":0,\"y\":3,\"w\":5,\"h\":4,\"i\":\"3\"},\"id\":\"a0201830-127d-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"4\",\"gridData\":{\"x\":7,\"y\":0,\"w\":5,\"h\":3,\"i\":\"4\"},\"id\":\"cf524480-127c-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":3,\"y\":0,\"w\":4,\"h\":3,\"i\":\"5\"},\"id\":\"f5d781f0-1282-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"6\",\"gridData\":{\"x\":5,\"y\":3,\"w\":7,\"h\":4,\"i\":\"6\"},\"id\":\"5cd63230-1282-11e8-b602-c72150ea97ab\",\"type\":\"visualization\",\"version\":\"6.1.1\"},{\"panelIndex\":\"7\",\"gridData\":{\"x\":0,\"y\":0,\"w\":3,\"h\":3,\"i\":\"7\"},\"version\":\"6.1.1\",\"type\":\"visualization\",\"id\":\"746b1270-1283-11e8-b602-c72150ea97ab\"}]",
"optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}",
"uiStateJSON": "{\"P-3\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-4\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-5\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}}",
"version": 1,
"timeRestore": false,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}"
}
}
}
]
[
{
"_id": "a0201830-127d-11e8-b602-c72150ea97ab",
"_type": "visualization",
"_source": {
"title": "osquery_cron_commands",
"visState": "{\"title\":\"osquery_cron_commands\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"snapshot.command.keyword\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\"}}]}",
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[{\"meta\":{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"negate\":false,\"disabled\":false,\"alias\":null,\"type\":\"phrase\",\"key\":\"name\",\"value\":\"pack/linux_collection/crontab\",\"params\":{\"query\":\"pack/linux_collection/crontab\",\"type\":\"phrase\"}},\"query\":{\"match\":{\"name\":{\"query\":\"pack/linux_collection/crontab\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
}
}
},
{
"_id": "cf524480-127c-11e8-b602-c72150ea97ab",
"_type": "visualization",
"_source": {
"title": "osquery_mount_paths",
"visState": "{\"title\":\"osquery_mount_paths\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"snapshot.path.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}",
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
}
}
},
{
"_id": "5cd63230-1282-11e8-b602-c72150ea97ab",
"_type": "visualization",
"_source": {
"title": "osquery_ports_listening",
"visState": "{\"title\":\"osquery_ports_listening\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":true,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"snapshot.port.keyword\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}",
"uiStateJSON": "{}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
}
}
},
{
"_id": "f5d781f0-1282-11e8-b602-c72150ea97ab",
"_type": "visualization",
"_source": {
"title": "osquery_open_files",
"visState": "{\"title\":\"osquery_open_files\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"snapshot.path.keyword\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\"}}]}",
"uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[{\"meta\":{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"negate\":false,\"disabled\":false,\"alias\":null,\"type\":\"phrase\",\"key\":\"name\",\"value\":\"open_files\",\"params\":{\"query\":\"open_files\",\"type\":\"phrase\"}},\"query\":{\"match\":{\"name\":{\"query\":\"open_files\",\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
}
}
},
{
"_id": "746b1270-1283-11e8-b602-c72150ea97ab",
"_type": "visualization",
"_source": {
"title": "osquery_hosts",
"visState": "{\"title\":\"osquery_hosts\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"decorations.hostname.keyword\",\"customLabel\":\"# of osquery hosts\"}}]}",
"uiStateJSON": "{}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"index\":\"6dc71b50-127c-11e8-b602-c72150ea97ab\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
}
}
}
]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment