@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
json 1,982 lines 39.4 KB
Raw
1 {
2 "annotations": {
3 "list": [
4 {
5 "builtIn": 1,
6 "datasource": {
7 "type": "datasource",
8 "uid": "grafana"
9 },
10 "enable": true,
11 "hide": true,
12 "iconColor": "rgba(0, 211, 255, 1)",
13 "name": "Annotations & Alerts",
14 "target": {
15 "limit": 100,
16 "matchAny": false,
17 "tags": [],
18 "type": "dashboard"
19 },
20 "type": "dashboard"
21 }
22 ]
23 },
24 "editable": false,
25 "fiscalYearStartMonth": 0,
26 "graphTooltip": 0,
27 "id": null,
28 "links": [
29 {
30 "asDropdown": true,
31 "icon": "external link",
32 "includeVars": true,
33 "keepTime": true,
34 "tags": ["EDR"],
35 "targetBlank": true,
36 "title": "",
37 "type": "dashboards"
38 }
39 ],
40 "liveNow": false,
41 "panels": [
42 {
43 "datasource": {
44 "type": "elasticsearch",
45 "uid": "replace_datasource_uid"
46 },
47 "fieldConfig": {
48 "defaults": {
49 "mappings": [
50 {
51 "options": {
52 "match": "null",
53 "result": {
54 "text": "N/A"
55 }
56 },
57 "type": "special"
58 }
59 ],
60 "thresholds": {
61 "mode": "absolute",
62 "steps": [
63 {
64 "color": "blue",
65 "value": null
66 }
67 ]
68 },
69 "unit": "short"
70 },
71 "overrides": []
72 },
73 "gridPos": {
74 "h": 7,
75 "w": 4,
76 "x": 0,
77 "y": 0
78 },
79 "id": 43,
80 "links": [],
81 "options": {
82 "colorMode": "value",
83 "graphMode": "area",
84 "justifyMode": "auto",
85 "orientation": "horizontal",
86 "reduceOptions": {
87 "calcs": ["sum"],
88 "fields": "",
89 "values": false
90 },
91 "text": {},
92 "textMode": "auto"
93 },
94 "pluginVersion": "10.0.2",
95 "targets": [
96 {
97 "bucketAggs": [
98 {
99 "$$hashKey": "object:135",
100 "field": "timestamp",
101 "id": "2",
102 "settings": {
103 "interval": "auto",
104 "min_doc_count": 0,
105 "trimEdges": 0
106 },
107 "type": "date_histogram"
108 }
109 ],
110 "datasource": {
111 "type": "elasticsearch",
112 "uid": "replace_datasource_uid"
113 },
114 "metrics": [
115 {
116 "$$hashKey": "object:133",
117 "field": "select field",
118 "id": "1",
119 "type": "count"
120 }
121 ],
122 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
123 "refId": "A",
124 "timeField": "timestamp"
125 }
126 ],
127 "title": "PROCESS EVENTS",
128 "type": "stat"
129 },
130 {
131 "datasource": {
132 "type": "elasticsearch",
133 "uid": "replace_datasource_uid"
134 },
135 "fieldConfig": {
136 "defaults": {
137 "color": {
138 "mode": "thresholds"
139 },
140 "custom": {
141 "align": "auto",
142 "cellOptions": {
143 "type": "auto"
144 },
145 "inspect": false
146 },
147 "mappings": [],
148 "thresholds": {
149 "mode": "absolute",
150 "steps": [
151 {
152 "color": "green",
153 "value": null
154 },
155 {
156 "color": "red",
157 "value": 80
158 }
159 ]
160 }
161 },
162 "overrides": [
163 {
164 "matcher": {
165 "id": "byName",
166 "options": "Time"
167 },
168 "properties": [
169 {
170 "id": "displayName",
171 "value": "Time"
172 },
173 {
174 "id": "unit",
175 "value": "time: YYYY-MM-DD HH:mm:ss"
176 },
177 {
178 "id": "custom.align"
179 }
180 ]
181 },
182 {
183 "matcher": {
184 "id": "byName",
185 "options": ""
186 },
187 "properties": [
188 {
189 "id": "unit",
190 "value": "short"
191 },
192 {
193 "id": "decimals",
194 "value": 2
195 },
196 {
197 "id": "custom.align"
198 }
199 ]
200 },
201 {
202 "matcher": {
203 "id": "byName",
204 "options": "agent_name"
205 },
206 "properties": [
207 {
208 "id": "displayName",
209 "value": "AGENT"
210 },
211 {
212 "id": "unit",
213 "value": "short"
214 },
215 {
216 "id": "decimals",
217 "value": 2
218 },
219 {
220 "id": "custom.align"
221 }
222 ]
223 },
224 {
225 "matcher": {
226 "id": "byName",
227 "options": "AGENT"
228 },
229 "properties": [
230 {
231 "id": "custom.width",
232 "value": 299
233 }
234 ]
235 }
236 ]
237 },
238 "gridPos": {
239 "h": 7,
240 "w": 8,
241 "x": 4,
242 "y": 0
243 },
244 "id": 31,
245 "options": {
246 "cellHeight": "sm",
247 "footer": {
248 "countRows": false,
249 "fields": "",
250 "reducer": ["sum"],
251 "show": false
252 },
253 "showHeader": true,
254 "sortBy": []
255 },
256 "pluginVersion": "10.0.2",
257 "targets": [
258 {
259 "bucketAggs": [
260 {
261 "$$hashKey": "object:89",
262 "fake": true,
263 "field": "agent_name",
264 "id": "4",
265 "settings": {
266 "min_doc_count": 1,
267 "order": "desc",
268 "orderBy": "_count",
269 "size": "0"
270 },
271 "type": "terms"
272 }
273 ],
274 "datasource": {
275 "type": "elasticsearch",
276 "uid": "replace_datasource_uid"
277 },
278 "metrics": [
279 {
280 "$$hashKey": "object:87",
281 "field": "select field",
282 "id": "1",
283 "type": "count"
284 }
285 ],
286 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
287 "refId": "A",
288 "timeField": "timestamp"
289 }
290 ],
291 "title": "AGENTS",
292 "transformations": [
293 {
294 "id": "merge",
295 "options": {
296 "reducers": []
297 }
298 }
299 ],
300 "type": "table"
301 },
302 {
303 "datasource": {
304 "type": "elasticsearch",
305 "uid": "replace_datasource_uid"
306 },
307 "fieldConfig": {
308 "defaults": {
309 "color": {
310 "mode": "palette-classic"
311 },
312 "custom": {
313 "hideFrom": {
314 "legend": false,
315 "tooltip": false,
316 "viz": false
317 }
318 },
319 "decimals": 0,
320 "mappings": [],
321 "unit": "short"
322 },
323 "overrides": []
324 },
325 "gridPos": {
326 "h": 7,
327 "w": 5,
328 "x": 12,
329 "y": 0
330 },
331 "id": 59,
332 "links": [],
333 "options": {
334 "displayLabels": [],
335 "legend": {
336 "calcs": [],
337 "displayMode": "list",
338 "placement": "bottom",
339 "showLegend": false,
340 "values": ["value"]
341 },
342 "pieType": "pie",
343 "reduceOptions": {
344 "calcs": ["sum"],
345 "fields": "",
346 "values": false
347 },
348 "text": {},
349 "tooltip": {
350 "mode": "single",
351 "sort": "none"
352 }
353 },
354 "pluginVersion": "7.3.4",
355 "targets": [
356 {
357 "bucketAggs": [
358 {
359 "$$hashKey": "object:211",
360 "fake": true,
361 "field": "software_vendor",
362 "id": "3",
363 "settings": {
364 "min_doc_count": "1",
365 "order": "desc",
366 "orderBy": "_count",
367 "size": "10"
368 },
369 "type": "terms"
370 },
371 {
372 "$$hashKey": "object:117",
373 "field": "timestamp",
374 "id": "2",
375 "settings": {
376 "interval": "auto",
377 "min_doc_count": 0,
378 "trimEdges": 0
379 },
380 "type": "date_histogram"
381 }
382 ],
383 "datasource": {
384 "type": "elasticsearch",
385 "uid": "replace_datasource_uid"
386 },
387 "metrics": [
388 {
389 "$$hashKey": "object:115",
390 "field": "select field",
391 "id": "1",
392 "type": "count"
393 }
394 ],
395 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
396 "queryType": "randomWalk",
397 "refId": "A",
398 "timeField": "timestamp"
399 }
400 ],
401 "title": "PROCESSES STARTED / SOFTWARE VENDOR",
402 "type": "piechart"
403 },
404 {
405 "datasource": {
406 "type": "elasticsearch",
407 "uid": "replace_datasource_uid"
408 },
409 "fieldConfig": {
410 "defaults": {
411 "custom": {
412 "align": "auto",
413 "cellOptions": {
414 "type": "auto"
415 },
416 "filterable": false,
417 "inspect": false
418 },
419 "mappings": [],
420 "thresholds": {
421 "mode": "absolute",
422 "steps": [
423 {
424 "color": "green",
425 "value": null
426 },
427 {
428 "color": "red",
429 "value": 80
430 }
431 ]
432 }
433 },
434 "overrides": []
435 },
436 "gridPos": {
437 "h": 7,
438 "w": 7,
439 "x": 17,
440 "y": 0
441 },
442 "id": 61,
443 "links": [],
444 "options": {
445 "cellHeight": "sm",
446 "footer": {
447 "countRows": false,
448 "fields": "",
449 "reducer": ["sum"],
450 "show": false
451 },
452 "showHeader": true
453 },
454 "pluginVersion": "10.0.2",
455 "targets": [
456 {
457 "bucketAggs": [
458 {
459 "$$hashKey": "object:211",
460 "fake": true,
461 "field": "software_vendor",
462 "id": "3",
463 "settings": {
464 "min_doc_count": "1",
465 "order": "desc",
466 "orderBy": "_count",
467 "size": "10"
468 },
469 "type": "terms"
470 }
471 ],
472 "datasource": {
473 "type": "elasticsearch",
474 "uid": "replace_datasource_uid"
475 },
476 "metrics": [
477 {
478 "$$hashKey": "object:115",
479 "field": "select field",
480 "id": "1",
481 "type": "count"
482 }
483 ],
484 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
485 "queryType": "randomWalk",
486 "refId": "A",
487 "timeField": "timestamp"
488 }
489 ],
490 "title": "PROCESSES STARTED / SOFTWARE VENDOR",
491 "type": "table"
492 },
493 {
494 "datasource": {
495 "type": "elasticsearch",
496 "uid": "replace_datasource_uid"
497 },
498 "fieldConfig": {
499 "defaults": {
500 "color": {
501 "mode": "continuous-GrYlRd"
502 },
503 "mappings": [],
504 "thresholds": {
505 "mode": "absolute",
506 "steps": [
507 {
508 "color": "green",
509 "value": null
510 }
511 ]
512 },
513 "unit": "short"
514 },
515 "overrides": []
516 },
517 "gridPos": {
518 "h": 19,
519 "w": 24,
520 "x": 0,
521 "y": 7
522 },
523 "id": 66,
524 "options": {
525 "color": "blue",
526 "iteration": 20,
527 "monochrome": false,
528 "nodeColor": "super-light-purple",
529 "nodePadding": 20,
530 "nodeWidth": 30
531 },
532 "targets": [
533 {
534 "alias": "",
535 "bucketAggs": [
536 {
537 "field": "parent_process_image",
538 "id": "2",
539 "settings": {
540 "min_doc_count": "1",
541 "order": "desc",
542 "orderBy": "_term",
543 "size": "10"
544 },
545 "type": "terms"
546 },
547 {
548 "field": "process_image",
549 "id": "3",
550 "settings": {
551 "min_doc_count": "1",
552 "order": "desc",
553 "orderBy": "_term",
554 "size": "1"
555 },
556 "type": "terms"
557 }
558 ],
559 "datasource": {
560 "type": "elasticsearch",
561 "uid": "replace_datasource_uid"
562 },
563 "metrics": [
564 {
565 "id": "1",
566 "type": "count"
567 }
568 ],
569 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
570 "refId": "A",
571 "timeField": "timestamp"
572 }
573 ],
574 "title": "PROCESS SPAWNS",
575 "transformations": [
576 {
577 "id": "organize",
578 "options": {
579 "excludeByName": {},
580 "indexByName": {},
581 "renameByName": {
582 "Count": "Count",
583 "parent_process_image": "PARENT PROCESS",
584 "process_image": "PROCESS"
585 }
586 }
587 }
588 ],
589 "transparent": true,
590 "type": "netsage-sankey-panel"
591 },
592 {
593 "datasource": {
594 "type": "elasticsearch",
595 "uid": "replace_datasource_uid"
596 },
597 "fieldConfig": {
598 "defaults": {
599 "color": {
600 "mode": "palette-classic"
601 },
602 "custom": {
603 "hideFrom": {
604 "legend": false,
605 "tooltip": false,
606 "viz": false
607 }
608 },
609 "decimals": 0,
610 "mappings": [],
611 "unit": "short"
612 },
613 "overrides": []
614 },
615 "gridPos": {
616 "h": 8,
617 "w": 4,
618 "x": 0,
619 "y": 26
620 },
621 "id": 60,
622 "links": [],
623 "options": {
624 "displayLabels": [],
625 "legend": {
626 "calcs": [],
627 "displayMode": "list",
628 "placement": "bottom",
629 "showLegend": false,
630 "values": ["value"]
631 },
632 "pieType": "donut",
633 "reduceOptions": {
634 "calcs": ["sum"],
635 "fields": "",
636 "values": false
637 },
638 "text": {},
639 "tooltip": {
640 "mode": "single",
641 "sort": "none"
642 }
643 },
644 "pluginVersion": "7.3.4",
645 "targets": [
646 {
647 "bucketAggs": [
648 {
649 "$$hashKey": "object:211",
650 "fake": true,
651 "field": "software_product",
652 "id": "3",
653 "settings": {
654 "min_doc_count": "1",
655 "order": "desc",
656 "orderBy": "_count",
657 "size": "10"
658 },
659 "type": "terms"
660 },
661 {
662 "$$hashKey": "object:117",
663 "field": "timestamp",
664 "id": "2",
665 "settings": {
666 "interval": "auto",
667 "min_doc_count": 0,
668 "trimEdges": 0
669 },
670 "type": "date_histogram"
671 }
672 ],
673 "datasource": {
674 "type": "elasticsearch",
675 "uid": "replace_datasource_uid"
676 },
677 "metrics": [
678 {
679 "$$hashKey": "object:115",
680 "field": "select field",
681 "id": "1",
682 "type": "count"
683 }
684 ],
685 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
686 "queryType": "randomWalk",
687 "refId": "A",
688 "timeField": "timestamp"
689 }
690 ],
691 "title": "PROCESSES STARTED / SOFTWARE PACKAGE",
692 "type": "piechart"
693 },
694 {
695 "datasource": {
696 "type": "elasticsearch",
697 "uid": "replace_datasource_uid"
698 },
699 "fieldConfig": {
700 "defaults": {
701 "custom": {
702 "align": "auto",
703 "cellOptions": {
704 "type": "auto"
705 },
706 "filterable": false,
707 "inspect": false
708 },
709 "mappings": [],
710 "thresholds": {
711 "mode": "absolute",
712 "steps": [
713 {
714 "color": "green",
715 "value": null
716 },
717 {
718 "color": "red",
719 "value": 80
720 }
721 ]
722 }
723 },
724 "overrides": [
725 {
726 "matcher": {
727 "id": "byName",
728 "options": "software_package"
729 },
730 "properties": [
731 {
732 "id": "custom.width",
733 "value": 444
734 }
735 ]
736 }
737 ]
738 },
739 "gridPos": {
740 "h": 8,
741 "w": 8,
742 "x": 4,
743 "y": 26
744 },
745 "id": 62,
746 "links": [],
747 "options": {
748 "cellHeight": "sm",
749 "footer": {
750 "countRows": false,
751 "fields": "",
752 "reducer": ["sum"],
753 "show": false
754 },
755 "showHeader": true,
756 "sortBy": []
757 },
758 "pluginVersion": "10.0.2",
759 "targets": [
760 {
761 "bucketAggs": [
762 {
763 "$$hashKey": "object:211",
764 "fake": true,
765 "field": "software_product",
766 "id": "3",
767 "settings": {
768 "min_doc_count": "1",
769 "order": "desc",
770 "orderBy": "_count",
771 "size": "0"
772 },
773 "type": "terms"
774 }
775 ],
776 "datasource": {
777 "type": "elasticsearch",
778 "uid": "replace_datasource_uid"
779 },
780 "metrics": [
781 {
782 "$$hashKey": "object:115",
783 "field": "select field",
784 "id": "1",
785 "type": "count"
786 }
787 ],
788 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
789 "queryType": "randomWalk",
790 "refId": "A",
791 "timeField": "timestamp"
792 }
793 ],
794 "title": "PROCESSES STARTED / SOFTWARE PACKAGE",
795 "type": "table"
796 },
797 {
798 "datasource": {
799 "type": "elasticsearch",
800 "uid": "replace_datasource_uid"
801 },
802 "fieldConfig": {
803 "defaults": {
804 "color": {
805 "mode": "palette-classic"
806 },
807 "custom": {
808 "axisCenteredZero": false,
809 "axisColorMode": "text",
810 "axisLabel": "",
811 "axisPlacement": "auto",
812 "barAlignment": 0,
813 "drawStyle": "bars",
814 "fillOpacity": 0,
815 "gradientMode": "none",
816 "hideFrom": {
817 "legend": false,
818 "tooltip": false,
819 "viz": false
820 },
821 "lineInterpolation": "linear",
822 "lineWidth": 1,
823 "pointSize": 5,
824 "scaleDistribution": {
825 "type": "linear"
826 },
827 "showPoints": "auto",
828 "spanNulls": false,
829 "stacking": {
830 "group": "A",
831 "mode": "normal"
832 },
833 "thresholdsStyle": {
834 "mode": "off"
835 }
836 },
837 "mappings": [],
838 "thresholds": {
839 "mode": "absolute",
840 "steps": [
841 {
842 "color": "green",
843 "value": null
844 },
845 {
846 "color": "red",
847 "value": 80
848 }
849 ]
850 }
851 },
852 "overrides": []
853 },
854 "gridPos": {
855 "h": 15,
856 "w": 12,
857 "x": 12,
858 "y": 26
859 },
860 "id": 68,
861 "options": {
862 "legend": {
863 "calcs": [],
864 "displayMode": "table",
865 "placement": "right",
866 "showLegend": true
867 },
868 "tooltip": {
869 "mode": "single",
870 "sort": "none"
871 }
872 },
873 "targets": [
874 {
875 "alias": "",
876 "bucketAggs": [
877 {
878 "field": "agent_name",
879 "id": "3",
880 "settings": {
881 "min_doc_count": "1",
882 "order": "desc",
883 "orderBy": "_term",
884 "size": "10"
885 },
886 "type": "terms"
887 },
888 {
889 "field": "timestamp",
890 "id": "2",
891 "settings": {
892 "interval": "auto"
893 },
894 "type": "date_histogram"
895 }
896 ],
897 "datasource": {
898 "type": "elasticsearch",
899 "uid": "replace_datasource_uid"
900 },
901 "metrics": [
902 {
903 "id": "1",
904 "type": "count"
905 }
906 ],
907 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
908 "refId": "A",
909 "timeField": "timestamp"
910 }
911 ],
912 "title": "TOP 10 AGENTS - HISTOGRAM",
913 "transparent": true,
914 "type": "timeseries"
915 },
916 {
917 "datasource": {
918 "type": "elasticsearch",
919 "uid": "replace_datasource_uid"
920 },
921 "fieldConfig": {
922 "defaults": {
923 "color": {
924 "mode": "palette-classic"
925 },
926 "custom": {
927 "hideFrom": {
928 "legend": false,
929 "tooltip": false,
930 "viz": false
931 }
932 },
933 "decimals": 0,
934 "mappings": [],
935 "unit": "short"
936 },
937 "overrides": []
938 },
939 "gridPos": {
940 "h": 7,
941 "w": 4,
942 "x": 0,
943 "y": 34
944 },
945 "id": 54,
946 "links": [],
947 "maxDataPoints": 3,
948 "options": {
949 "legend": {
950 "calcs": [],
951 "displayMode": "list",
952 "placement": "right",
953 "showLegend": false,
954 "values": ["value"]
955 },
956 "pieType": "donut",
957 "reduceOptions": {
958 "calcs": ["sum"],
959 "fields": "",
960 "values": false
961 },
962 "tooltip": {
963 "mode": "single",
964 "sort": "none"
965 }
966 },
967 "targets": [
968 {
969 "bucketAggs": [
970 {
971 "$$hashKey": "object:99",
972 "fake": true,
973 "field": "user_name",
974 "id": "3",
975 "settings": {
976 "min_doc_count": 1,
977 "order": "desc",
978 "orderBy": "_count",
979 "size": "10"
980 },
981 "type": "terms"
982 },
983 {
984 "$$hashKey": "object:100",
985 "field": "timestamp",
986 "id": "2",
987 "settings": {
988 "interval": "auto",
989 "min_doc_count": 0,
990 "trimEdges": 0
991 },
992 "type": "date_histogram"
993 }
994 ],
995 "datasource": {
996 "type": "elasticsearch",
997 "uid": "replace_datasource_uid"
998 },
999 "metrics": [
1000 {
1001 "$$hashKey": "object:97",
1002 "field": "select field",
1003 "id": "1",
1004 "type": "count"
1005 }
1006 ],
1007 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\") AND agent_name:$agent_name",
1008 "refId": "A",
1009 "timeField": "timestamp"
1010 }
1011 ],
1012 "title": "USER/ACCOUNTS",
1013 "type": "piechart"
1014 },
1015 {
1016 "datasource": {
1017 "type": "elasticsearch",
1018 "uid": "replace_datasource_uid"
1019 },
1020 "fieldConfig": {
1021 "defaults": {
1022 "color": {
1023 "mode": "thresholds"
1024 },
1025 "custom": {
1026 "align": "auto",
1027 "cellOptions": {
1028 "type": "auto"
1029 },
1030 "inspect": false
1031 },
1032 "decimals": 0,
1033 "mappings": [],
1034 "thresholds": {
1035 "mode": "absolute",
1036 "steps": [
1037 {
1038 "color": "green",
1039 "value": null
1040 },
1041 {
1042 "color": "red",
1043 "value": 80
1044 }
1045 ]
1046 },
1047 "unit": "short"
1048 },
1049 "overrides": [
1050 {
1051 "matcher": {
1052 "id": "byName",
1053 "options": "user_name"
1054 },
1055 "properties": [
1056 {
1057 "id": "custom.width",
1058 "value": 445
1059 }
1060 ]
1061 }
1062 ]
1063 },
1064 "gridPos": {
1065 "h": 7,
1066 "w": 8,
1067 "x": 4,
1068 "y": 34
1069 },
1070 "id": 63,
1071 "links": [],
1072 "maxDataPoints": 3,
1073 "options": {
1074 "cellHeight": "sm",
1075 "footer": {
1076 "countRows": false,
1077 "fields": "",
1078 "reducer": ["sum"],
1079 "show": false
1080 },
1081 "showHeader": true,
1082 "sortBy": []
1083 },
1084 "pluginVersion": "10.0.2",
1085 "targets": [
1086 {
1087 "bucketAggs": [
1088 {
1089 "$$hashKey": "object:99",
1090 "fake": true,
1091 "field": "user_name",
1092 "id": "3",
1093 "settings": {
1094 "min_doc_count": 1,
1095 "order": "desc",
1096 "orderBy": "_count",
1097 "size": "0"
1098 },
1099 "type": "terms"
1100 }
1101 ],
1102 "datasource": {
1103 "type": "elasticsearch",
1104 "uid": "replace_datasource_uid"
1105 },
1106 "metrics": [
1107 {
1108 "$$hashKey": "object:97",
1109 "field": "select field",
1110 "id": "1",
1111 "type": "count"
1112 }
1113 ],
1114 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\") AND agent_name:$agent_name",
1115 "refId": "A",
1116 "timeField": "timestamp"
1117 }
1118 ],
1119 "title": "USER/ACCOUNTS",
1120 "type": "table"
1121 },
1122 {
1123 "datasource": {
1124 "type": "elasticsearch",
1125 "uid": "replace_datasource_uid"
1126 },
1127 "fieldConfig": {
1128 "defaults": {
1129 "mappings": [],
1130 "thresholds": {
1131 "mode": "absolute",
1132 "steps": [
1133 {
1134 "color": "green",
1135 "value": null
1136 },
1137 {
1138 "color": "red",
1139 "value": 80
1140 }
1141 ]
1142 }
1143 },
1144 "overrides": []
1145 },
1146 "gridPos": {
1147 "h": 8,
1148 "w": 12,
1149 "x": 0,
1150 "y": 41
1151 },
1152 "id": 37,
1153 "options": {
1154 "displayMode": "gradient",
1155 "minVizHeight": 10,
1156 "minVizWidth": 0,
1157 "orientation": "horizontal",
1158 "reduceOptions": {
1159 "calcs": ["sum"],
1160 "fields": "",
1161 "values": false
1162 },
1163 "showUnfilled": true,
1164 "text": {},
1165 "valueMode": "color"
1166 },
1167 "pluginVersion": "10.0.2",
1168 "targets": [
1169 {
1170 "bucketAggs": [
1171 {
1172 "fake": true,
1173 "field": "process_image",
1174 "id": "6",
1175 "settings": {
1176 "min_doc_count": 1,
1177 "order": "desc",
1178 "orderBy": "_count",
1179 "size": "10"
1180 },
1181 "type": "terms"
1182 },
1183 {
1184 "fake": true,
1185 "field": "timestamp",
1186 "id": "5",
1187 "settings": {
1188 "interval": "auto",
1189 "min_doc_count": 0,
1190 "trimEdges": 0
1191 },
1192 "type": "date_histogram"
1193 }
1194 ],
1195 "datasource": {
1196 "type": "elasticsearch",
1197 "uid": "replace_datasource_uid"
1198 },
1199 "metrics": [
1200 {
1201 "field": "type",
1202 "id": "1",
1203 "meta": {},
1204 "settings": {},
1205 "type": "count"
1206 }
1207 ],
1208 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
1209 "refId": "A",
1210 "timeField": "timestamp"
1211 }
1212 ],
1213 "title": "TOP 10 PROCESSES (PROCESS FILE PATH)",
1214 "type": "bargauge"
1215 },
1216 {
1217 "datasource": {
1218 "type": "elasticsearch",
1219 "uid": "replace_datasource_uid"
1220 },
1221 "fieldConfig": {
1222 "defaults": {
1223 "color": {
1224 "mode": "thresholds"
1225 },
1226 "custom": {
1227 "align": "auto",
1228 "cellOptions": {
1229 "type": "auto"
1230 },
1231 "inspect": false
1232 },
1233 "mappings": [],
1234 "thresholds": {
1235 "mode": "absolute",
1236 "steps": [
1237 {
1238 "color": "green",
1239 "value": null
1240 },
1241 {
1242 "color": "red",
1243 "value": 80
1244 }
1245 ]
1246 }
1247 },
1248 "overrides": [
1249 {
1250 "matcher": {
1251 "id": "byName",
1252 "options": "process_image"
1253 },
1254 "properties": [
1255 {
1256 "id": "custom.width",
1257 "value": 657
1258 }
1259 ]
1260 }
1261 ]
1262 },
1263 "gridPos": {
1264 "h": 16,
1265 "w": 12,
1266 "x": 12,
1267 "y": 41
1268 },
1269 "id": 64,
1270 "options": {
1271 "cellHeight": "sm",
1272 "footer": {
1273 "countRows": false,
1274 "fields": "",
1275 "reducer": ["sum"],
1276 "show": false
1277 },
1278 "showHeader": true,
1279 "sortBy": []
1280 },
1281 "pluginVersion": "10.0.2",
1282 "targets": [
1283 {
1284 "bucketAggs": [
1285 {
1286 "fake": true,
1287 "field": "process_image",
1288 "id": "6",
1289 "settings": {
1290 "min_doc_count": 1,
1291 "order": "desc",
1292 "orderBy": "_count",
1293 "size": "0"
1294 },
1295 "type": "terms"
1296 }
1297 ],
1298 "datasource": {
1299 "type": "elasticsearch",
1300 "uid": "replace_datasource_uid"
1301 },
1302 "metrics": [
1303 {
1304 "field": "type",
1305 "id": "1",
1306 "meta": {},
1307 "settings": {},
1308 "type": "count"
1309 }
1310 ],
1311 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
1312 "refId": "A",
1313 "timeField": "timestamp"
1314 }
1315 ],
1316 "title": "PROCESS FILE PATH (ALL)",
1317 "type": "table"
1318 },
1319 {
1320 "datasource": {
1321 "type": "elasticsearch",
1322 "uid": "replace_datasource_uid"
1323 },
1324 "fieldConfig": {
1325 "defaults": {
1326 "mappings": [],
1327 "thresholds": {
1328 "mode": "absolute",
1329 "steps": [
1330 {
1331 "color": "green",
1332 "value": null
1333 },
1334 {
1335 "color": "red",
1336 "value": 80
1337 }
1338 ]
1339 }
1340 },
1341 "overrides": []
1342 },
1343 "gridPos": {
1344 "h": 8,
1345 "w": 12,
1346 "x": 0,
1347 "y": 49
1348 },
1349 "id": 55,
1350 "options": {
1351 "displayMode": "gradient",
1352 "minVizHeight": 10,
1353 "minVizWidth": 0,
1354 "orientation": "horizontal",
1355 "reduceOptions": {
1356 "calcs": ["sum"],
1357 "fields": "",
1358 "values": false
1359 },
1360 "showUnfilled": true,
1361 "text": {},
1362 "valueMode": "color"
1363 },
1364 "pluginVersion": "10.0.2",
1365 "targets": [
1366 {
1367 "bucketAggs": [
1368 {
1369 "fake": true,
1370 "field": "process_image",
1371 "id": "6",
1372 "settings": {
1373 "min_doc_count": 1,
1374 "order": "asc",
1375 "orderBy": "_count",
1376 "size": "10"
1377 },
1378 "type": "terms"
1379 },
1380 {
1381 "fake": true,
1382 "field": "timestamp",
1383 "id": "5",
1384 "settings": {
1385 "interval": "auto",
1386 "min_doc_count": 0,
1387 "trimEdges": 0
1388 },
1389 "type": "date_histogram"
1390 }
1391 ],
1392 "datasource": {
1393 "type": "elasticsearch",
1394 "uid": "replace_datasource_uid"
1395 },
1396 "metrics": [
1397 {
1398 "field": "type",
1399 "id": "1",
1400 "meta": {},
1401 "settings": {},
1402 "type": "count"
1403 }
1404 ],
1405 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\") AND agent_name:$agent_name",
1406 "refId": "A",
1407 "timeField": "timestamp"
1408 }
1409 ],
1410 "title": "LEAST SEEN PROCESSES",
1411 "type": "bargauge"
1412 },
1413 {
1414 "datasource": {
1415 "type": "elasticsearch",
1416 "uid": "replace_datasource_uid"
1417 },
1418 "fieldConfig": {
1419 "defaults": {
1420 "color": {
1421 "mode": "thresholds"
1422 },
1423 "custom": {
1424 "align": "auto",
1425 "cellOptions": {
1426 "type": "auto"
1427 },
1428 "inspect": false
1429 },
1430 "mappings": [],
1431 "thresholds": {
1432 "mode": "absolute",
1433 "steps": [
1434 {
1435 "color": "green",
1436 "value": null
1437 },
1438 {
1439 "color": "red",
1440 "value": 80
1441 }
1442 ]
1443 },
1444 "unit": "none"
1445 },
1446 "overrides": [
1447 {
1448 "matcher": {
1449 "id": "byName",
1450 "options": "timestamp"
1451 },
1452 "properties": [
1453 {
1454 "id": "displayName",
1455 "value": "DATE/TIME"
1456 },
1457 {
1458 "id": "unit",
1459 "value": "time: YYYY-MM-DD HH:mm:ss"
1460 },
1461 {
1462 "id": "custom.align"
1463 }
1464 ]
1465 },
1466 {
1467 "matcher": {
1468 "id": "byName",
1469 "options": "process_name"
1470 },
1471 "properties": [
1472 {
1473 "id": "displayName",
1474 "value": "PROCESS"
1475 },
1476 {
1477 "id": "unit",
1478 "value": "short"
1479 },
1480 {
1481 "id": "decimals",
1482 "value": -1
1483 },
1484 {
1485 "id": "custom.align"
1486 }
1487 ]
1488 },
1489 {
1490 "matcher": {
1491 "id": "byName",
1492 "options": "process_id"
1493 },
1494 "properties": [
1495 {
1496 "id": "displayName",
1497 "value": "PID"
1498 },
1499 {
1500 "id": "unit",
1501 "value": "none"
1502 },
1503 {
1504 "id": "decimals",
1505 "value": -2
1506 },
1507 {
1508 "id": "custom.align"
1509 }
1510 ]
1511 },
1512 {
1513 "matcher": {
1514 "id": "byName",
1515 "options": "process_image"
1516 },
1517 "properties": [
1518 {
1519 "id": "displayName",
1520 "value": "PROCESS IMAGE"
1521 },
1522 {
1523 "id": "unit",
1524 "value": "short"
1525 },
1526 {
1527 "id": "decimals",
1528 "value": 2
1529 },
1530 {
1531 "id": "custom.align"
1532 }
1533 ]
1534 },
1535 {
1536 "matcher": {
1537 "id": "byName",
1538 "options": "user_name"
1539 },
1540 "properties": [
1541 {
1542 "id": "displayName",
1543 "value": "USER/ACCOUNT"
1544 },
1545 {
1546 "id": "unit",
1547 "value": "short"
1548 },
1549 {
1550 "id": "decimals",
1551 "value": 2
1552 },
1553 {
1554 "id": "custom.align"
1555 }
1556 ]
1557 },
1558 {
1559 "matcher": {
1560 "id": "byName",
1561 "options": "agent_name"
1562 },
1563 "properties": [
1564 {
1565 "id": "displayName",
1566 "value": "AGENT"
1567 },
1568 {
1569 "id": "unit",
1570 "value": "short"
1571 },
1572 {
1573 "id": "decimals",
1574 "value": 2
1575 },
1576 {
1577 "id": "custom.align"
1578 }
1579 ]
1580 },
1581 {
1582 "matcher": {
1583 "id": "byName",
1584 "options": "parent_process_image"
1585 },
1586 "properties": [
1587 {
1588 "id": "displayName",
1589 "value": "PARENT PROCESS"
1590 },
1591 {
1592 "id": "unit",
1593 "value": "none"
1594 },
1595 {
1596 "id": "decimals",
1597 "value": 0
1598 },
1599 {
1600 "id": "custom.align"
1601 }
1602 ]
1603 },
1604 {
1605 "matcher": {
1606 "id": "byName",
1607 "options": "process_cmd_line"
1608 },
1609 "properties": [
1610 {
1611 "id": "displayName",
1612 "value": "PROCESS CMD LINE"
1613 },
1614 {
1615 "id": "unit",
1616 "value": "short"
1617 },
1618 {
1619 "id": "decimals",
1620 "value": 2
1621 },
1622 {
1623 "id": "custom.align"
1624 }
1625 ]
1626 },
1627 {
1628 "matcher": {
1629 "id": "byName",
1630 "options": "EVENT ID"
1631 },
1632 "properties": [
1633 {
1634 "id": "links",
1635 "value": [
1636 {
1637 "targetBlank": true,
1638 "title": "VIEW EVENT DETAILS",
1639 "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%7B%22type%22:%22date_histogram%22,%22id%22:%221%22,%22settings%22:%7B%22interval%22:%22auto%22%7D%7D%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1640 }
1641 ]
1642 }
1643 ]
1644 }
1645 ]
1646 },
1647 "gridPos": {
1648 "h": 18,
1649 "w": 24,
1650 "x": 0,
1651 "y": 57
1652 },
1653 "id": 51,
1654 "options": {
1655 "cellHeight": "sm",
1656 "footer": {
1657 "countRows": false,
1658 "fields": "",
1659 "reducer": ["sum"],
1660 "show": false
1661 },
1662 "showHeader": true
1663 },
1664 "pluginVersion": "10.0.2",
1665 "targets": [
1666 {
1667 "bucketAggs": [{"type": "date_histogram", "id": "1", "settings": {"interval": "auto"}}],
1668 "datasource": {
1669 "type": "elasticsearch",
1670 "uid": "replace_datasource_uid"
1671 },
1672 "metrics": [
1673 {
1674 "id": "1",
1675 "settings": {
1676 "size": "250"
1677 },
1678 "type": "raw_data"
1679 }
1680 ],
1681 "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
1682 "refId": "A",
1683 "timeField": "timestamp"
1684 }
1685 ],
1686 "title": "PROCESS ACTIVITY",
1687 "transformations": [
1688 {
1689 "id": "filterFieldsByName",
1690 "options": {
1691 "include": {
1692 "names": [
1693 "timestamp",
1694 "_id",
1695 "agent_name",
1696 "parent_cmd_line",
1697 "parent_process_id",
1698 "parent_process_image",
1699 "parent_process_user",
1700 "process_cmd_line",
1701 "process_id",
1702 "process_image",
1703 "user_name",
1704 "syslog_level"
1705 ]
1706 }
1707 }
1708 },
1709 {
1710 "id": "organize",
1711 "options": {
1712 "excludeByName": {},
1713 "indexByName": {
1714 "_id": 1,
1715 "agent_name": 2,
1716 "parent_cmd_line": 9,
1717 "parent_process_id": 8,
1718 "parent_process_image": 7,
1719 "parent_process_user": 10,
1720 "process_cmd_line": 5,
1721 "process_id": 4,
1722 "process_image": 3,
1723 "timestamp": 0,
1724 "user_name": 6
1725 },
1726 "renameByName": {
1727 "_id": "EVENT ID",
1728 "agent_name": "",
1729 "parent_cmd_line": "PARENT CMD",
1730 "parent_process_id": "PARENT PID",
1731 "parent_process_user": "PARENT USER",
1732 "syslog_level": "LEVEL"
1733 }
1734 }
1735 }
1736 ],
1737 "type": "table"
1738 }
1739 ],
1740 "refresh": "",
1741 "schemaVersion": 38,
1742 "style": "dark",
1743 "tags": ["EDR"],
1744 "templating": {
1745 "list": [
1746 {
1747 "datasource": {
1748 "type": "elasticsearch",
1749 "uid": "replace_datasource_uid"
1750 },
1751 "filters": [],
1752 "hide": 0,
1753 "label": "",
1754 "name": "Filters",
1755 "skipUrlSync": false,
1756 "type": "adhoc"
1757 },
1758 {
1759 "current": {
1760 "selected": false,
1761 "text": "All",
1762 "value": "$__all"
1763 },
1764 "datasource": {
1765 "type": "elasticsearch",
1766 "uid": "replace_datasource_uid"
1767 },
1768 "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event1 OR rule_group2:\\\"list_processes\\\" OR rule_group2:\\\"process_events\\\"\"}",
1769 "hide": 0,
1770 "includeAll": true,
1771 "label": "Agent",
1772 "multi": false,
1773 "name": "agent_name",
1774 "options": [],
1775 "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event1 OR rule_group2:\\\"list_processes\\\" OR rule_group2:\\\"process_events\\\"\"}",
1776 "refresh": 2,
1777 "regex": "",
1778 "skipUrlSync": false,
1779 "sort": 2,
1780 "tagValuesQuery": "",
1781 "tagsQuery": "",
1782 "type": "query",
1783 "useTags": false
1784 },
1785 {
1786 "current": {
1787 "selected": false,
1788 "text": "ATBroker.exe",
1789 "value": "ATBroker.exe"
1790 },
1791 "datasource": {
1792 "type": "elasticsearch",
1793 "uid": "replace_datasource_uid"
1794 },
1795 "definition": "{ \"find\": \"terms\", \"field\": \"process_name\", \"query\": \"rule_group3:sysmon_event1\"}",
1796 "hide": 2,
1797 "includeAll": false,
1798 "multi": false,
1799 "name": "process_name",
1800 "options": [],
1801 "query": "{ \"find\": \"terms\", \"field\": \"process_name\", \"query\": \"rule_group3:sysmon_event1\"}",
1802 "refresh": 1,
1803 "regex": "",
1804 "skipUrlSync": false,
1805 "sort": 0,
1806 "tagValuesQuery": "",
1807 "tagsQuery": "",
1808 "type": "query",
1809 "useTags": false
1810 },
1811 {
1812 "current": {
1813 "isNone": true,
1814 "selected": false,
1815 "text": "None",
1816 "value": ""
1817 },
1818 "datasource": {
1819 "type": "elasticsearch",
1820 "uid": "replace_datasource_uid"
1821 },
1822 "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1823 "hide": 2,
1824 "includeAll": false,
1825 "multi": false,
1826 "name": "parent_process_cmd_line",
1827 "options": [],
1828 "query": "{ \"find\": \"terms\", \"field\": \"parent_process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1829 "refresh": 1,
1830 "regex": "",
1831 "skipUrlSync": false,
1832 "sort": 0,
1833 "tagValuesQuery": "",
1834 "tagsQuery": "",
1835 "type": "query",
1836 "useTags": false
1837 },
1838 {
1839 "current": {
1840 "selected": false,
1841 "text": "1116",
1842 "value": "1116"
1843 },
1844 "datasource": {
1845 "type": "elasticsearch",
1846 "uid": "replace_datasource_uid"
1847 },
1848 "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1849 "hide": 2,
1850 "includeAll": false,
1851 "multi": false,
1852 "name": "parent_process_id",
1853 "options": [],
1854 "query": "{ \"find\": \"terms\", \"field\": \"parent_process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1855 "refresh": 1,
1856 "regex": "",
1857 "skipUrlSync": false,
1858 "sort": 0,
1859 "tagValuesQuery": "",
1860 "tagsQuery": "",
1861 "type": "query",
1862 "useTags": false
1863 },
1864 {
1865 "current": {
1866 "selected": false,
1867 "text": "C:\\\\Program Files\\\\Windows Defender\\\\MsMpEng.exe",
1868 "value": "C:\\\\Program Files\\\\Windows Defender\\\\MsMpEng.exe"
1869 },
1870 "datasource": {
1871 "type": "elasticsearch",
1872 "uid": "replace_datasource_uid"
1873 },
1874 "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1875 "hide": 2,
1876 "includeAll": false,
1877 "multi": false,
1878 "name": "parent_process_image",
1879 "options": [],
1880 "query": "{ \"find\": \"terms\", \"field\": \"parent_process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1881 "refresh": 1,
1882 "regex": "",
1883 "skipUrlSync": false,
1884 "sort": 0,
1885 "tagValuesQuery": "",
1886 "tagsQuery": "",
1887 "type": "query",
1888 "useTags": false
1889 },
1890 {
1891 "current": {
1892 "selected": false,
1893 "text": "C:\\\\Program Files (x86)\\\\ossec-agent\\\\win32ui.exe",
1894 "value": "C:\\\\Program Files (x86)\\\\ossec-agent\\\\win32ui.exe"
1895 },
1896 "datasource": {
1897 "type": "elasticsearch",
1898 "uid": "replace_datasource_uid"
1899 },
1900 "definition": "{ \"find\": \"terms\", \"field\": \"process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1901 "hide": 2,
1902 "includeAll": false,
1903 "multi": false,
1904 "name": "process_image",
1905 "options": [],
1906 "query": "{ \"find\": \"terms\", \"field\": \"process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1907 "refresh": 1,
1908 "regex": "",
1909 "skipUrlSync": false,
1910 "sort": 0,
1911 "tagValuesQuery": "",
1912 "tagsQuery": "",
1913 "type": "query",
1914 "useTags": false
1915 },
1916 {
1917 "current": {
1918 "selected": false,
1919 "text": "C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\22E50B25-5610-443E-8B86-5C4B68534EDB\\\\dismhost.exe {DBDD6140-3B52-4E05-AB44-5FF8625E4742}",
1920 "value": "C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\22E50B25-5610-443E-8B86-5C4B68534EDB\\\\dismhost.exe {DBDD6140-3B52-4E05-AB44-5FF8625E4742}"
1921 },
1922 "datasource": {
1923 "type": "elasticsearch",
1924 "uid": "replace_datasource_uid"
1925 },
1926 "definition": "{ \"find\": \"terms\", \"field\": \"process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1927 "hide": 2,
1928 "includeAll": false,
1929 "multi": false,
1930 "name": "process_cmd_line",
1931 "options": [],
1932 "query": "{ \"find\": \"terms\", \"field\": \"process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1933 "refresh": 1,
1934 "regex": "",
1935 "skipUrlSync": false,
1936 "sort": 0,
1937 "tagValuesQuery": "",
1938 "tagsQuery": "",
1939 "type": "query",
1940 "useTags": false
1941 },
1942 {
1943 "current": {
1944 "selected": false,
1945 "text": "1108",
1946 "value": "1108"
1947 },
1948 "datasource": {
1949 "type": "elasticsearch",
1950 "uid": "replace_datasource_uid"
1951 },
1952 "definition": "{ \"find\": \"terms\", \"field\": \"process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1953 "hide": 2,
1954 "includeAll": false,
1955 "multi": false,
1956 "name": "process_id",
1957 "options": [],
1958 "query": "{ \"find\": \"terms\", \"field\": \"process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1959 "refresh": 1,
1960 "regex": "",
1961 "skipUrlSync": false,
1962 "sort": 0,
1963 "tagValuesQuery": "",
1964 "tagsQuery": "",
1965 "type": "query",
1966 "useTags": false
1967 }
1968 ]
1969 },
1970 "time": {
1971 "from": "now-6h",
1972 "to": "now"
1973 },
1974 "timepicker": {
1975 "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1976 "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1977 },
1978 "timezone": "",
1979 "title": "EDR - SYSTEM PROCESSES",
1980 "version": 2,
1981 "weekStart": ""
1982 }